Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 07:32

General

  • Target
    218baf501ba3b2ee6b536e71f38127f8_JaffaCakes118.exe
  • Size 792KB
  • Sample240703-jdcz1sshpa
  • SHA256 9da12abb52ddf115064d83b2d6dc2de8de0d82a9074f6d655181035db4502f44
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • peppekz.no-ip.org:8089

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    crome

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\218baf501ba3b2ee6b536e71f38127f8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\218baf501ba3b2ee6b536e71f38127f8_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4200
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2192
          • C:\Windows\SysWOW64\crome\svchost.exe
            "C:\Windows\system32\crome\svchost.exe"
            4⤵
            • Executes dropped EXE
            PID:1120
      • C:\Users\Admin\AppData\Local\Temp\218baf501ba3b2ee6b536e71f38127f8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\218baf501ba3b2ee6b536e71f38127f8_JaffaCakes118.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3648
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          3⤵
          • Drops file in System32 directory
          PID:3368
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2240
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
              4⤵
                PID:2424
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 980
                  5⤵
                  • Program crash
                  PID:4120
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 1012
                  5⤵
                  • Program crash
                  PID:2212
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2424 -ip 2424
          1⤵
            PID:860
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2424 -ip 2424
            1⤵
              PID:4112

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  XX--XX--XX.txt

                  • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                  • Size 229KB
                  • SHA256 5197822179c8735e3d83d0a3598879a7404839db019cf825f072bc8a29a851cc
                  • MD5 SHA1 SHA512 SSDEEP

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 b0a41504a3ce966177b1c4be85fa654579cc9f46a443328db921f79aacc0691f
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 334242f5566bf1c4ec387590e1d7d2160ea9a7741c97f17e74f46db5c64665f8
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4918d66efc57cf1401e3d99c76d28887deea84834d8c38174103bb2b04237b82
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 286852057f11701643eaaeee8afef2770c3b280533a2fac79cddb97e7a1bb622
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 bb40810f403dccb1dc06d151d5e11ff55ec8270ca2af7c77f6a7de709ab979ef
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 52b934d97ab3ac1eb936ce4262cf5de8e258e76ba9d52e287d076773f24fe0c4
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 55978eb92926b6a9b9077efc31e3b0cd6e57072c272843b412f1dbffac2032fa
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1adb967de56f330558ce033c348b96314ca51d70599761af958c486e361465c3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 98f69088de5691a246a30ca3fad50fc1f7bf94be4b831005f5bddd6901bd67c9
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d029763d5409264980a6979ab023c4f388d3de9c3fcba2c16811e424867108be
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2e2a1883f8329bd86e19b837055f9acf9e846b2b40b1373464f263b120d7ec69
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f77790676e42a0efa8ffa0afec0240114493dcc5b74608c9512130dfb7b57655
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 33c1ec835a8f2bb30730758e112019e8c29d5165b6f0676d1cd937911b6c3ba8
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4461a081bec0b1979765ab94b616408426d3b21b8c5da45101ff891bf794bb8a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 eb34506f9ff63b982532561f9b5d45feaddbdad4f9a7c8f09bfcd151bbe600de
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 88a46d552c3a48d1b470f7511382b4906abf8783367beb34db85ed69de1f6c0e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 100c57b73c367f467c48773a197e19c3a161ee84f81c2ecb97ae65240b095fb2
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 da564cb90d495cd99621f859e97bcbe0dfaa0fd879a3f53d14b7b12f646adaea
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 a561102808a5d03b9dd6c64fe226bc40b3fff48e22e5b242101236d340061fc5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 0683c386ffa5ed8aea52a48e444cb81e5031545edb680fdf797f0002d5532a3a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 326b7aea9009edb708347ad7d6a069ed5e4ae0b87dc951a593d1bef8211c5b48
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 55a7934ec3423b9a55fd606d81684fa8fe8418f779f101dea8754c8a28398d4c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 142a606b8e353bceb3f74e84775e5c9dd27ec143a9101e749bdb098b25fa9e9d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ebf9da63b9f3739808ddbc3024504f666ff146e9a62171ec01235bfaf82b6dd0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9e7b43fdfa85318c819284c906e165a32e3698dfebf447ee7581c838416593e7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 268b349587b6fe4962eab67ae364b2c20eaa71eca7748e15fc6e2d5ed1b21a3f
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 bcd2d9a24f8e8283237a40a8eb702656604bacab2d53e538976adc9707362ff9
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4d8ccb8b91726d948fdd1f7e43a22a2ac85c0873d2adca553db40fab4c0a5aad
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e9cfde4043d558f2d79a89de4f4137c033932eebd7368e726a696ada389512fc
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 7319fe71f29ddbbd345ff37760989dc76ed7e72d7d36fedc6614816e97af76ba
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2a9aec5c631a6cc666dd97a55658a1e667b6415450cba52f519245a9df1aa37a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 b3abd69d94d1740bcd7a59716fc6612f1bbd20bc480b8b69832f225d49892c7a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 8fbe47100d0ef1114f7dbd4c1e5cdb35bd9cdae0e09480f6315185cefcadac31
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 c7d2b93e31941af3e45a4e9845979f671fc94610a56eda1886974b69200de625
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2aeaa2f95e4b9afcea340a61b00e6c232d6c91afdd84b6ddba4998896be5a47b
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 c78972b466a9095c31cc574251d882839e48aabd8f2bc4a5506f5755566fcea0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 23a6335c1023a68dd924d3cefe99ce694b0d3a9ca2a120b148c1b0c01eee0b7a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d65226a0c5694e9fe8623343d35e978b644f82f1a488e9b63a0f1b40d1292314
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d01ca1c516ad9c4b141713e25ed80ab15c25f39bd0f143c85fd339a5222b61dc
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 560d1a98609a6270d7b1ad9097a55fbf61c149743783bbb435ffada0677ace75
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 536a6cae6f04834df2a04e9c1c384be63f1f1fba4386114f0b8712dcf5396ea9
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 679f6a554690df04524ad9f13d85097684b68a4216bdaaa0e56db46eb6e87fcb
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 757725e516863e14030f6baebb348e3784df3d950113aab2b0c0f3ed3fdd50c2
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4252dbab0b05365ff38583225faa8b0c6bd0491f0d02c3665dab7208c860797f
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 3a46f9007f3ec7b3ebf3b737194b9e3f7367c7ab1d8f7da2d732f647da0d25c6
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 cdfa78c0138874938c18ceda5ae000362977495016c3ea0b8356234f1138fe22
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 533a39e7fbe728613cdc9553f776d72cb2bbb2462aa9620fd8d7c0fefbe08929
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 0141ac5f182b193d5273cc33007828f0ab599ab0819079b55f1310165f2dc9b9
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 476b52167ba7cc29a13f5e12c9c441602c2359e982783c208cb0c242735eb4aa
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e02f17366b66fbaa5cc9ccdcf31f1540a2e7724f81e2ad16917508aa0c860268
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d28519f74a9f753c2b79cf8ca3952602c6894c27804d895f02e418286a46fccd
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f15e62efe1b6d6f9b4e5cd5aff806360411db4fa1e45072ec76fcf5c30707484
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4f14fc9c0be3646c810488ca143dc31b5e56d81d54338619009edc89163aae48
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e3ea96b6a3f55906242609041682e0a2dbd6be7f9f2bba3fe1499da07007bf04
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6b6d380efd8dd319c10d1307fbc6100945e695dea3723bfd94f343accf797a7c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 b8d0684d5245f6bb6376fee5ef3a87c7ed3ef98baddbea5bd330271697bfb747
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 68c7bb7f1d8ecb2d6579d86a6e7230af4f5906032fd2b430e2b4f6ea91234ff0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 c3ec2e6c858f175b3fd902eb4421337400d16ede7339ed8b0151c50e9be8efe7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 82b61294405915a367f17ca429f4b7b8cccf98fbaca68468be0fad02145f0fe7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 60cf8a4438a6c7b443a8cedeb0debde184268b65c49b193ff81ec67851f178c5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2b7356bdf2102f0298dddb2634a1735b867fee5c4bf02b4bcc2bed5e836d286d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 8bf0f0bbaf1f0928fb0f265a4b109d4a4a84094e827560321235fac2dc57bcf4
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e0aa9224b01315f457b6afd7c32b0318757840d05b69e2a5fc51bbda884eb588
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2560153379c7f267c44794774738414b63c004f9072ea580ebe6c3ae04d10661
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 78d651e27f40bf0af3897174a640cd3b2c9b02d0c4a80aafd748110de51aa890
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 26517984383005699edd511b21ae251b5784ea87fa7c9312f0f952c8ab03e676
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 288afd94dfbbde6eb7703ce273efa448e351ab1d619bd5e9eceaec930d7dd3f7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 26d75c10dac059e556e14ad948bd208274417cd6f35fd299aa25bfe2a3c15dff
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 52653070c1c7256866cb1b0ffe202c60d4b322c481f7c13600309d3cf787328c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9b3ae0599b4720b3072ec79c80bd1124af79b4b4fca7528240189415721125f4
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e116d7be32f73fcc76ecfd78e3d83ea5a772caccab716a2efc832ebfc66a4406
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f0d3300ef0dce567a937e1304af4dbf61bb0c8148da8a9d9637a423666f68a31
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 626ccf88cd716f7c068e5112195c12d31d46589f0fd5f16b7db800f47f33524b
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f17d4c0a504cffda699b89aeeffaf1fec03ef08513092c8663a31bc1571a2b91
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 34f15b3a2bc09dec40b6f6d4ec27dd7ab83ad132fdc9f39292b2182b6ff46593
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5b3cddfa181490f032cf5bad512436a84893f781732439624625c08aef709a1a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1dbb972ba75ed132244aa446ec34f6023653d2ca59780c199408401187fe7f9c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f0b9b16bb6ead3689dbea9840d78b85f78a1d63f3a9924af2b35213fc95c6aca
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 87881e4079c709a17317c095c03c0eb45c439f146c261c22ce00a7ab18f5c3eb
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 bda77e27ed37f17541dbdae7fb7b870386e3d8f4bb0101e78148f061dc5f7ead
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e3ef78125495c7439a4504b5422672ab92f99eb7a45887012d1af095f15cb954
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2c1ad4f7060518eddc6de8d36579a83c8590725a3929e066d3df5ac165f50aeb
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 42cd63e65cf9fe72c8540712e75866e4bb09224dda50957429b536132e059936
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4340ce76c8f4cbc964ed4c4667c2cf091cb01e9241dbde518098ca86215e3f5d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 924ed4096d0bb3be075774f091ec0b748274947f6b49af031a7578ed0156a1a0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6deb7ba4ac98976530f0f69bf72be8a57807a91a4887f6f8a2554a23470aa595
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 23e5617911f730b7b1dad53c721fd7bf3c4b9404e9775e5ca8109696ccbab42c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f30822859b05a990eb6a5893d79137a0da5a4ac94303b5e05ee527dc5d41de8e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f415dfedd0945c12311e11ca292de1193948a4c59f9bff743538d9ad2dde4ac5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 dc496800eb66e23cc13f8710c7084025a1c469e8d5245ff6f37b1006f173419a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 cdb220d234bdc6996cb0ad7e52dec57b2340476e5347e7a9c039c244df5b1e3f
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ee413d7d92a396f4745e8214e6f2da4aa358c53eaa5da923706e408c5ea2ccb0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 bd19a4aa6dca657f2fa57983f7139d5b0e19c3aa7a08390d119321dcecf930c8
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9be7e6ccaed49ef97df6030f4f4e7fb0cf7782d4d2466d165ee8b10920cdc929
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2ddc773a89717c39307be11ead7c51a0842699c6517e6b4d17ba349ad498da87
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e95b2f165e5049f5f28f945c6c8dfa08c875fc98e90d015175e43cb969478e80
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f9ed03390a7fafe3e4588e449ba6bbd443e7179281b453283a91cccdb4026698
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 26240fade03097df90968c7e1750de7165a938686275375219cef0f57cb87353
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ed3e133a9b825ece69ca680aa56c1d38545c56522878a15fda599614b13aba21
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 942736a1ee1944d9e76962f448c03b9e7f16320494220dbf3be25e36dd26dbaf
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4ad68a84d18b8e7327dd7e4888b4c87cf44f38851d16a16480f7fc846a256b86
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4895e66c5f0984484fbea0d9a1a1f64a04c944c71ba64aff21914f205bb6a129
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 336215f94032dee8cd0fc7f0729649153a75490dfe03221a6117534ba4c31b60
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5b51be3996f9d0a281ccc33a2a344ec8b74cbfe8b82f2f0bec9cd0f86d42ed2e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d6d24e332e8a5e66c87ed3ed5590b44dad723ee79d8848a4f15b58baec345d30
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 218ee6efa2e6647e9f910ae29b1a8ac2ff9b016eb33aa8b0084650fe6b304311
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 40a3d1a98dfd9c25aabd20de6048dda7d170ea4b42b990e7746bc6eb967eec76
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9f108a575a19878e43c5241c9ae005a2e8767876afad6cba4cfaa43fd9a41ea9
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 67ccd52ec22fac8ef62a1b44525eaf7054d54f99c1186d12d310eb82939bfe6d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 af0d4585217b21b297ad713948ccb403e99ae90b9341a82b8edd7f3f2697d143
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5f7156322d9faeff2f6a5b667774f268781a08be64e8380d7ad1d714d2360f18
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 00344e8206859083535f5f2b43d7ea95dc90306ba36a4c0f76bf8c2909a3ebf7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 239e9b0299ab7c270ea79a382663537548903c0607b7df948eda71a6a3afb78a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4704dad7f2164250d22fb0fe54e67840769f17cf0574ea652646aad0e907be56
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 184f98c6952bedeb9a323b0120fe74641f088e8d73605bf009e808f52be35fb6
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 48003ee9fd186bbf2a1c97e6138c242eb13eb0b9487bbf11846f8e14913d2558
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 eceecee2731bfa0dd2dd69e5f6a000807d11f4422d5d676afdc2e09a22d133c4
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 8f8c13d18c5992c426917858075a77b0763c0c36e98f42d79394db6687e95548
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 54017d4b3821af26b27cb0f8c094991c0e239db3dc17e0c2822bb16ba6035efd
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 857d97ab25e7cc8d6963b15059438c6665375ed253314594d87c1988a2a21473
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2edeb8f09ee69cb66a4270444acb103163ad724e74ed841ee86bc31a2d51aa65
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9b31f2b5bdf5a8e132f769014ec57a9750dda0862d832053b8d182df8dfbc792
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 540f33383a96d8f7d8b8ece4ffafb23c33b3273eb77184133f24ea4c2c593272
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 80e2509755d7caaee7b242930f4f9529ad9d991ed594aa5b1929560928201bf3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 b0da5cfdb583f482845101a7f967cfbd6c024e7657f9289d73c92a8700d0f80d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 805cee606d56b5475a491ba0ec0b1711375bed89229de711ff1f1cfa641fda68
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1c9c4b245143cb3601d04849d8c8742975e6a951bc849f1267501353b16e06c2
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9af606c06305d6b60376ff748856edbf7a33b64065c641d02f320213149497a8
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e850cdb7ca31ae15e1a6e8e657933d279e3572e2726aeaed4f00e3dde8b74649
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 87a1184046966de6ae252f1bf101e68242679399f2ee5f978467698b022f4e58
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 af778e2816bf06d7f07e6be4895381436fe737cc62c410db1062013ace449631
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ab7f3af6e8d016893edb3f0ed4e19a9e832b9763e25bcd52b2d7d8ff41a39349
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 70d78082b973eddbdc0cb8997e872b026efb7b195fa8a7852eb5fe6768979103
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f63210190a1385143dfa001d5c4d181535379146a00111867749c2a03191ba8c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6da904dce077ea359f749fce43c13cf0e228a351655f0da2d84bac1bfcda883c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5bf6df01f39fceca4e356b0614abd5e190fab3fcf80630700e6016a470f7ac18
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ec9296cb97fd54db936771abe2531af6cf562d58eccf925c269c909523eba999
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 849904a0ff2edb09e925436e6175d9c3f0e47fbae5832f21054bb47548f8ec61
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 94da9bb7a315d3fdddf2d09bfd60211d70df77b13787825478f853be273d25ae
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9e5e9ddfd32e8cfa6b6c3401f2ce44f7eb3f8d8c6082f32c00f4872d80ceb91c
                  • MD5 SHA1 SHA512

                  logs.dat

                  • Path C:\Users\Admin\AppData\Roaming\logs.dat
                  • Size 15B
                  • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                  • MD5 SHA1 SHA512

                  svchost.exe

                  • Path C:\Windows\SysWOW64\crome\svchost.exe
                  • Size 1.1MB
                  • SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
                  • MD5 SHA1 SHA512 SSDEEP

                  memory/2192-22-0x00000000001F0000-0x00000000001F1000-memory.dmp

                  memory/2192-23-0x0000000000690000-0x0000000000691000-memory.dmp

                  memory/2192-32-0x0000000000400000-0x000000000051F000-memory.dmp

                  memory/3100-201-0x00000000748C2000-0x00000000748C3000-memory.dmp

                  memory/3100-2-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3100-202-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3100-371-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3100-1-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3100-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

                  memory/3368-182-0x0000000000400000-0x0000000000450000-memory.dmp

                  memory/3368-14-0x0000000000400000-0x0000000000450000-memory.dmp

                  memory/3648-9-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3648-603-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3648-13-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3648-836-0x00000000748C0000-0x0000000074E71000-memory.dmp

                  memory/3648-832-0x00000000748C2000-0x00000000748C3000-memory.dmp

                  memory/3648-8-0x00000000748C2000-0x00000000748C3000-memory.dmp

                  memory/4968-4-0x0000000000400000-0x0000000000450000-memory.dmp

                  memory/4968-17-0x0000000024010000-0x0000000024072000-memory.dmp

                  memory/4968-6-0x0000000000400000-0x0000000000450000-memory.dmp

                  memory/4968-5-0x0000000000400000-0x0000000000450000-memory.dmp

                  memory/4968-86-0x0000000000400000-0x0000000000450000-memory.dmp

                  memory/4968-7-0x0000000000400000-0x0000000000450000-memory.dmp

                  memory/4968-21-0x0000000024080000-0x00000000240E2000-memory.dmp

                  memory/4968-18-0x0000000024010000-0x0000000024072000-memory.dmp