Malware Analysis Report

2025-05-28 17:58

Sample ID 250520-nq5b9abr71
Target JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880
SHA256 e28946d1082fb107cfcc9fa2d0dbae466d60b27b1d52600945aa93e4f0d7f266
Tags
latentbot njrat hacked0=== defense_evasion discovery persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e28946d1082fb107cfcc9fa2d0dbae466d60b27b1d52600945aa93e4f0d7f266

Threat Level: Known bad

The file JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880 was found to be: Known bad.

Malicious Activity Summary

latentbot njrat hacked0=== defense_evasion discovery persistence privilege_escalation trojan

LatentBot

Latentbot family

njRAT/Bladabindi

Njrat family

Modifies Windows Firewall

Drops startup file

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops desktop.ini file(s)

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-20 11:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-20 11:37

Reported

2025-05-20 11:39

Platform

win10v2004-20250502-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe"

Signatures

LatentBot

trojan latentbot

Latentbot family

latentbot

Njrat family

njrat

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Server.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\76d6a3cdfe0225f3ce7e5917efc89fff.exe C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\76d6a3cdfe0225f3ce7e5917efc89fff.exe C:\Users\Admin\AppData\Local\Temp\system32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\76d6a3cdfe0225f3ce7e5917efc89fff = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system32.exe\" .." C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\76d6a3cdfe0225f3ce7e5917efc89fff = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system32.exe\" .." C:\Users\Admin\AppData\Local\Temp\system32.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\assembly C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
File created C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
File opened for modification C:\Windows\assembly\Desktop.ini C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Server.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\system32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 628 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 628 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 628 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 432 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 432 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 432 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2000 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2000 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2000 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3056 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3056 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3056 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3056 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 3056 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2000 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 2000 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\Server.exe
PID 1668 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 1668 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 1668 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\Server.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4732 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4732 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4732 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4732 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4732 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 2244 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Windows\SysWOW64\netsh.exe
PID 2244 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Windows\SysWOW64\netsh.exe
PID 2244 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Windows\SysWOW64\netsh.exe
PID 3612 wrote to memory of 4592 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 3612 wrote to memory of 4592 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 3612 wrote to memory of 4592 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4592 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4592 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4592 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4592 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe
PID 4592 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\system32.exe C:\Users\Admin\AppData\Local\Temp\system32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0743c67aedde35b9fe3dc919ef56e880.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe

"C:\Users\Admin\AppData\Local\Temp\Server.exe"

C:\Users\Admin\AppData\Local\Temp\Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe

C:\Users\Admin\AppData\Local\Temp\Server.exe

C:\Users\Admin\AppData\Local\Temp\system32.exe

"C:\Users\Admin\AppData\Local\Temp\system32.exe"

C:\Users\Admin\AppData\Local\Temp\system32.exe

C:\Users\Admin\AppData\Local\Temp\system32.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system32.exe" "system32.exe" ENABLE

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\system32.exe" ..

C:\Users\Admin\AppData\Local\Temp\system32.exe

C:\Users\Admin\AppData\Local\Temp\system32.exe ..

C:\Users\Admin\AppData\Local\Temp\system32.exe

C:\Users\Admin\AppData\Local\Temp\system32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
GB 2.18.27.89:443 www.bing.com tcp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp
US 8.8.8.8:53 ahmaddddd362.zapto.org udp

Files

memory/628-0-0x00007FF9E4E65000-0x00007FF9E4E66000-memory.dmp

memory/628-1-0x00007FF9E4BB0000-0x00007FF9E5551000-memory.dmp

memory/628-2-0x00007FF9E4BB0000-0x00007FF9E5551000-memory.dmp

memory/628-3-0x000000001C7F0000-0x000000001CCBE000-memory.dmp

memory/628-4-0x0000000001750000-0x000000000176E000-memory.dmp

memory/628-8-0x00007FF9E4BB0000-0x00007FF9E5551000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Server.exe

MD5 69e4e308c802ea0225be31138739279d
SHA1 95099c282b8833d38c2cc32a72eb6cc3ceef5cfa
SHA256 0278015c57cf069583fa9b3396a9278aea01c16c4780b05f4817564463841a40
SHA512 915a96622131b6ca87d6af3ee048247c9cf78f67ec6068fcdd01c3af2a938fdf319d44cdf0615042eb8f4a673cca953d63e0e325154c44d2741398abe510d04d

memory/2000-20-0x0000000075062000-0x0000000075063000-memory.dmp

memory/628-19-0x00007FF9E4BB0000-0x00007FF9E5551000-memory.dmp

memory/3056-21-0x0000000075060000-0x0000000075611000-memory.dmp

memory/2000-22-0x0000000075060000-0x0000000075611000-memory.dmp

memory/3056-23-0x0000000075060000-0x0000000075611000-memory.dmp

memory/2000-42-0x0000000075060000-0x0000000075611000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.log

MD5 cde6529abeea500fb852f29ba0da6115
SHA1 45f2f48492417ae6a0eade8aaa808d3d1d760743
SHA256 d7f4964443470b6729865676d76f5f1f416da633033071c34ea5eb19cdea53b5
SHA512 c95fa7faf6a90f32060dba70f79c4d66c68d6eec587306fb98f36fc3ba5d377ebf9dabf47298b71db208fb10f7ccb4e0ed82236c8f26bcc746552588bbb38234

memory/3056-54-0x0000000075060000-0x0000000075611000-memory.dmp

memory/3056-57-0x0000000075060000-0x0000000075611000-memory.dmp

memory/2000-56-0x0000000075060000-0x0000000075611000-memory.dmp

memory/1668-39-0x0000000000400000-0x000000000040C000-memory.dmp