Malware Analysis Report

2025-01-22 16:55

Sample ID 241007-jl9nysxhmd
Target 1c4ed93e152e93cfecac0871341349c8_JaffaCakes118
SHA256 d15fb20a7df2aab845ef54a0e45771fcf1ec96365a4e067d3871d299dd3ae628
Tags
gozi 1100 banker discovery isfb persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d15fb20a7df2aab845ef54a0e45771fcf1ec96365a4e067d3871d299dd3ae628

Threat Level: Known bad

The file 1c4ed93e152e93cfecac0871341349c8_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

gozi 1100 banker discovery isfb persistence trojan

Gozi

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Deletes itself

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-07 07:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-07 07:46

Reported

2024-10-07 07:49

Platform

win10v2004-20240802-en

Max time kernel

146s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

Gozi

banker trojan gozi

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Authbk32 = "C:\\Users\\Admin\\AppData\\Roaming\\Castider\\AppVider.exe" C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1984 set thread context of 3204 N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe C:\Windows\system32\svchost.exe
PID 3204 set thread context of 3532 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 3532 set thread context of 4080 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 set thread context of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 set thread context of 4704 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\RuntimeBroker.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\RuntimeBroker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2588 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 916 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 916 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 916 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4192 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe
PID 4192 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe
PID 4192 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe
PID 1984 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe C:\Windows\system32\svchost.exe
PID 1984 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe C:\Windows\system32\svchost.exe
PID 1984 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe C:\Windows\system32\svchost.exe
PID 1984 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe C:\Windows\system32\svchost.exe
PID 1984 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe C:\Windows\system32\svchost.exe
PID 3204 wrote to memory of 3532 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3532 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 3204 wrote to memory of 3532 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 3532 wrote to memory of 4080 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4080 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4080 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4704 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4704 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 3532 wrote to memory of 4704 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D90A\6C85.bat" "C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe" "C:\Users\Admin\AppData\Local\Temp\1C4ED9~1.EXE""

C:\Windows\SysWOW64\cmd.exe

cmd /C ""C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe" "C:\Users\Admin\AppData\Local\Temp\1C4ED9~1.EXE""

C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe

"C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe" "C:\Users\Admin\AppData\Local\Temp\1C4ED9~1.EXE"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 andlegislature.at udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/2588-0-0x0000000000620000-0x0000000000627000-memory.dmp

memory/2588-1-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2588-7-0x0000000000400000-0x0000000000483000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D90A\6C85.bat

MD5 27586c36f3f83535a436b63ef801c342
SHA1 24cdbd668c891ef9d19640a894bd3059b0c9f60e
SHA256 3e2f4ae43f58b1a4e3faf64028dd7613740776ee7c829fcb2af5b668f8855ca3
SHA512 9ba554f155d00be8b52c0f8c878e8709bf95c4691e58e28b03bf2e1a9cc8a030e988432113f8f4753fd7024af2d40fcc7492c1511f7527c50958d5fe88e3c3c6

C:\Users\Admin\AppData\Roaming\Castider\AppVider.exe

MD5 1c4ed93e152e93cfecac0871341349c8
SHA1 4abf656619a854fcfc71074973476af31059a63f
SHA256 d15fb20a7df2aab845ef54a0e45771fcf1ec96365a4e067d3871d299dd3ae628
SHA512 6524390e5cd8968953ebd59cd630ff696e651071d5b7e43f77b1f3c8eb7b10c9c048ff77ce434dc93e47e09447d9328dc4ad295f77dd12abc9092d30f2cc6ca5

memory/1984-12-0x00000000004D0000-0x00000000004D7000-memory.dmp

memory/3204-21-0x00000000000C0000-0x00000000000C1000-memory.dmp

memory/1984-18-0x0000000000400000-0x0000000000483000-memory.dmp

memory/3204-16-0x0000000000030000-0x00000000000B6000-memory.dmp

memory/3204-22-0x0000000000030000-0x00000000000B6000-memory.dmp

memory/3532-30-0x0000000003910000-0x0000000003996000-memory.dmp

memory/3204-24-0x0000000000030000-0x00000000000B6000-memory.dmp

memory/3532-29-0x00000000030F0000-0x00000000030F1000-memory.dmp

memory/3532-23-0x0000000003910000-0x0000000003996000-memory.dmp

memory/4080-34-0x000001D59F360000-0x000001D59F3E6000-memory.dmp

memory/4080-39-0x000001D59F360000-0x000001D59F3E6000-memory.dmp

memory/4080-40-0x000001D59F360000-0x000001D59F3E6000-memory.dmp

memory/4080-38-0x000001D59F3F0000-0x000001D59F3F1000-memory.dmp

memory/4104-46-0x000002A3E7F90000-0x000002A3E8016000-memory.dmp

memory/4104-45-0x000002A3E5BE0000-0x000002A3E5BE1000-memory.dmp

memory/4104-47-0x000002A3E7F90000-0x000002A3E8016000-memory.dmp

memory/4104-41-0x000002A3E7F90000-0x000002A3E8016000-memory.dmp

memory/3532-48-0x0000000003910000-0x0000000003996000-memory.dmp

memory/3532-54-0x0000000003910000-0x0000000003996000-memory.dmp

memory/3532-55-0x0000000003910000-0x0000000003996000-memory.dmp

memory/3532-50-0x0000000003910000-0x0000000003996000-memory.dmp

memory/4704-49-0x000002AD21990000-0x000002AD21A16000-memory.dmp

memory/4704-56-0x000002AD21990000-0x000002AD21A16000-memory.dmp

memory/3532-57-0x0000000003910000-0x0000000003996000-memory.dmp

memory/4080-58-0x000001D59F360000-0x000001D59F3E6000-memory.dmp

memory/4104-59-0x000002A3E7F90000-0x000002A3E8016000-memory.dmp

memory/3532-60-0x0000000003910000-0x0000000003996000-memory.dmp

memory/3532-62-0x0000000003910000-0x0000000003996000-memory.dmp

memory/3532-63-0x0000000003910000-0x0000000003996000-memory.dmp

memory/3532-64-0x0000000003910000-0x0000000003996000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-07 07:46

Reported

2024-10-07 07:49

Platform

win7-20240903-en

Max time kernel

118s

Max time network

119s

Command Line

C:\Windows\Explorer.EXE

Signatures

Gozi

banker trojan gozi

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\bcryider = "C:\\Users\\Admin\\AppData\\Roaming\\comrtext\\Devidisc.exe" C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2248 set thread context of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2580 set thread context of 1196 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1388 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2752 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2560 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe
PID 2560 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe
PID 2560 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe
PID 2560 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe
PID 2248 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2248 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2248 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2248 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2248 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2248 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2248 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe C:\Windows\system32\svchost.exe
PID 2580 wrote to memory of 1196 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 1196 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 1196 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1c4ed93e152e93cfecac0871341349c8_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\D098\E84C.bat" "C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe" "C:\Users\Admin\AppData\Local\Temp\1C4ED9~1.EXE""

C:\Windows\SysWOW64\cmd.exe

cmd /C ""C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe" "C:\Users\Admin\AppData\Local\Temp\1C4ED9~1.EXE""

C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe

"C:\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe" "C:\Users\Admin\AppData\Local\Temp\1C4ED9~1.EXE"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 andlegislature.at udp

Files

memory/1388-0-0x0000000000220000-0x0000000000227000-memory.dmp

memory/1388-1-0x0000000000400000-0x0000000000483000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D098\E84C.bat

MD5 f91bbb77e9eb41f52f9c45f63d977dbf
SHA1 b00b9820efbbdc4bacac917a3b40eca9aead1d05
SHA256 e5f32506c1035267477a0444d8af37ce92ef3604e98454d80d3aa7490ec7e0ef
SHA512 620b34c81fe3d33c0e702b44d6e1e4ee3f3847f03c5f5dd75bea8e06e774c075adfb2e059842d66b8b0a800ea9ac599deeaf70d9839949fdbe544d0bc13ecc69

memory/1388-12-0x0000000000400000-0x0000000000483000-memory.dmp

\Users\Admin\AppData\Roaming\comrtext\Devidisc.exe

MD5 1c4ed93e152e93cfecac0871341349c8
SHA1 4abf656619a854fcfc71074973476af31059a63f
SHA256 d15fb20a7df2aab845ef54a0e45771fcf1ec96365a4e067d3871d299dd3ae628
SHA512 6524390e5cd8968953ebd59cd630ff696e651071d5b7e43f77b1f3c8eb7b10c9c048ff77ce434dc93e47e09447d9328dc4ad295f77dd12abc9092d30f2cc6ca5

memory/2580-20-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

memory/2580-27-0x0000000000140000-0x00000000001C6000-memory.dmp

memory/2580-24-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2248-21-0x0000000000400000-0x0000000000483000-memory.dmp

memory/1196-30-0x0000000002610000-0x0000000002611000-memory.dmp

memory/2580-38-0x0000000000140000-0x00000000001C6000-memory.dmp

memory/2580-33-0x0000000000140000-0x00000000001C6000-memory.dmp

memory/1196-36-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-41-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-40-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-43-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-42-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-44-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-46-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-47-0x0000000004500000-0x0000000004586000-memory.dmp

memory/1196-48-0x0000000004500000-0x0000000004586000-memory.dmp