Analysis

  • max time kernel
    111s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 09:38

General

  • Target
    21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
  • Size 1013KB
  • Sample240703-lmbves1amn
  • SHA256 58143dd59185083563f699f4483b9c5e30743f1b392c18d108201a8a16f71d31
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • adsll.no-ip.org:80

  • mengo.no-ip.info:81

  • mengo2.no-ip.info]:82

  • mengonet.no-ip.info:2000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    windows

  • install_file

    taskmgr.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables RegEdit via registry modification 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3532
      • C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4412
        • C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe"
          3⤵
          • Disables RegEdit via registry modification
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
            C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3888
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              PID:2808
            • C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe"
              5⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1692
              • C:\Windows\SysWOW64\windows\taskmgr.exe
                "C:\Windows\system32\windows\taskmgr.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:5032
                • C:\Windows\SysWOW64\windows\taskmgr.exe
                  "C:\Windows\SysWOW64\windows\taskmgr.exe"
                  7⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:4152
                  • C:\Windows\SysWOW64\windows\taskmgr.exe
                    C:\Windows\SysWOW64\windows\taskmgr.exe
                    8⤵
                    • Executes dropped EXE
                    PID:1872
                  • C:\Windows\SysWOW64\windows\taskmgr.exe
                    C:\Windows\SysWOW64\windows\taskmgr.exe
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2192
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sil.bat
                    8⤵
                      PID:1792
            • C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
              C:\Users\Admin\AppData\Local\Temp\21e37195e68771000f8111c48f1b176a_JaffaCakes118.exe
              4⤵
              • Suspicious use of SetWindowsHookEx
              PID:3664
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sil.bat
              4⤵
                PID:2844

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 b9e76f41c0ea86762899a5688d500a7fb64e3b6765169093f1f5eeab816c91b2
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75aec2270135acf3c7791ae518bc6869d273a627b90ee8ce893c2dc7a36abfce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b57ddafd110a21d3a4ac710a6e77924864ef1191ae8bfa266fe1a082f1b194c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71047ce35e524fedf53da86c5462704b83a867f4f374bcd3cfde8b9f19ce5a8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e015931cd3dc3cb1ba9921fd7d0fc567e23e8f011ae86bb6d5d1d1d0b332510
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 824d900b1713f2fa8a8d7365a60212587e1f18baf8c5cda6217cf811b006d5dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a80af6568a2dc7dc79e0c6e17f27bb45b6a1f82ee527df4dad0f76ddff7d25ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e4fb9d686bc193a22ddaa4c115da0f23e9152a44459fcb77eada3569e1968c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 169ebe78173790b2532401984728a5d58ad65db7794f011c377ff859fe656ab0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5811682b80d68caaf37dbd3f266db2a967aaa4f9c2cd28b04873cd6e05edf9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14ed1b3a0325349428add22939ea1c543b3a476ea98e884badcd9eae6f3c915b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5bd7e79de94020781ec773b5fe2bb486217218c583b35ab5e53a91ab7226d24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84fd5d9afa1450645e8fc69507440235506d0bf83de267809ecdbb3e699ed84f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41a114c89e6f0717b585fafe2e73e0af36a86e388cb363a0fdc3c61682f4d705
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6473de2d527b3b7808deb93dc9c263443ffd5d52309f86ea9d5f555b0c03a589
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4743cfd247b15e62be3433cd2e45e971c63b60103cf58418e504a9689803726f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c7ea73bda6f3eb8568b99351b8120cbc28d53208113448de3f985b3dfad18b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3a6b75f6ac31b46aa447c7302a2b951ae44e67b709252c06329c0970737f642
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ea2380c8a4cc6f07e2cd6d80c3096a2d6304e880c38a7dfb34f5046c15ee4dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89e21f0de90a621bb6d8443a8f7530c9e355408f81fea26b04d045c3a5acef9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59689efa03f7acba5e5a7ccdcfe004a3c06a611323651e4fc9a65b02f2d0bd29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e482fd0c09b6f44a9eedb27fd8d1b4e26c7a6575eb39337b632854e0ae8a7b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5864210581602be1161f439e168e22ec6bcf273fa25a79f87f4225e7b2abceb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75c4f10b0e2fc27314783c145b2b7f11bae98bb3d58b74aa0afd3a7c8ca78297
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 845bc1d8022cf4b963fbf31704ae373529b73fa1e562d314369dfdf82711b060
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b7251f5a1051d01859fbd482e6d45a269afe7290c76f1d9fbe24744130fe962
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d49c3d4e9d04643d10e0c5a1f0a63e3595da64785706c427da44a4ce72343a83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 325a59b3634af40338add8734517d9191806e1c6631ea6acc2803e1cc93675c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d4716004272c6f7cd391ab1b694861619b9ff1fb51507b4c744b73b3236765c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 248a7aef00c86aa64ad915c3230bb7e998bf4cf9fedf2a2c012e80e8dfcf8c7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e96e0589f64cc9c612fab736242372e6fadf77c80752f64d671dd6c3076341a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 379cac02a9f39364875dea310037b8c8a83c67f9af643bd4557acf4e772d5042
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b8bf221b1b817afc4a491c6f90dbcbfef5095b1e5341f3d810a3cdbf8b6b733
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 839a144ef094cb4f422300b48f1aae13f0ec213837409dde2ebc0a588e9c74a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f97d8e5876a74bedf7b3caa4c8fb8286b04a51f2070d48e8bb3b1e9dad63c6b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 caf553e2bbdea2272ff338e345260a18724de6e2944d1fbcc04ea198bef470d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d02358d7839a8bf6033541599458c7294b7ef73152ec9718eb870b5d52b10f81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06265ec774028e44e816623525721c4dcd816b925bbd8a84e254425836e661b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a333bb20425ddd13416db5160f85cb391e8042f7bbf60ff290e93640a4929c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68b08451841c45b047feb463c6fe9ed47485ac879827ae4dd31187b48b227e16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db6213e26cde2e4b8ed4e2535043e86284a36cc78f0bebce75be18ca19a94f8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b26b1897b25f583cd3140b3a0a0465024a0754b1a84648bf80f379bce88c4ede
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9448da6c5aab0c07e58d44ce8bf82cfc66cfef0c9e2a92aaf6d5ffb3efef58df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9c38624abe26471aa8a98bb55c0d5b6a45f7d6b43e59be5b51ffeaf7b82f16c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c46b2dcb87943da537ad75ef97539f3cf86c71fd46ee1d2c9bbf815d8565382
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bb4811d98ee4e0e3e84fbfc945bbaef4da0bfac7730b9e0146438a51850ced4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7287f66c7987d2246f0864bf6dff60f141bb6ed1d5962a7e0333c3de64e7c8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30a7f41bd45315081a9bf035024293d85f4948821b808af2f5d32b6da08b7032
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67c061b65801b69650d5befbf054f5b1270c86aaef334a7bbbf8282bc89a757a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 007f3369676e622c194ed8761afaa8a9c69726e251aec885ddf1a93bc297f989
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 124e3519805f4f38bed97a5e39622876a5dc0f525ab5869f6ca3f1f591491f10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89148f05b166d51fb7a4aa0bd92b5f27fe463411baf367e3fa76b52d1bd6f219
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3a1c4052f340b35c07729683b307da7dcd3332dce6e400a40e217768f9bbc0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85233fd38203adb95d27abbb62789164d58540f2481319f5dbc0c11034c0ddbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d1eb853a1ed271911e4a16d915b9a7384ebbb69a0694743afd9259b4cf8f66d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 603e75aa291fac9ad34bea37f4ecd4da4d1755e80857a04927ca8d559f60591e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2d9e552bb07f32520ba8c92e2b2a13ee0036945e73e66d9f79d448f2dc2571f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2bda8c91a1b7d5204e36f9a1abffe2a271f5884e6ebaff4dad3b793616d2208b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 660a077b0bea54d676a971b241191a4e8dfbbb763ec23182fb84b00d0555be5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca4c8049a065988ed31b1232e7e46533fa71cbce365b53e71416b6a982c31545
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 202b7a42a392e0ac2ad7a437c3d5a81546ac4195a8a6425d15f7f75006b76a6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 643b435c90f3cd07e1f5b8ea2d35b0f38986eb515b257c35fe672e29d609ddff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b56266550a2e728fb4f6b73c219bd660579b7fe559a4493ed35f50d117cc53f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d32f298e63f45bb228ff049cdab9ae102586bb0950eb3971627dccbe2479d6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcdeca94b442afd14bed4b84058a741d7bbb19b718578a51a43ea8ec16d9b6be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c3eddb96cea8ae7e16292d37310df4de3443ff3ee3bacd367f8d48d44936d5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d22214cb8336bb06b93f90042b23f98e8a617fc060fb3711fac9189f4d81cff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c5287210c2ad3be4d70206e91badd4bfb17cf7ca811667ddc43b293f0d5abd4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6783f81735601788b02b584a6001f21c38f4a26056c975219404bde312a2b0f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7aa20dff37c06ea38014ae77350aa6302bb574514008df1e9d1fd057dbd4476
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f4edf555d390ee83a16c32b6db2b512436d6310819b32ac602f3dc54966113c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 436534d954c23df586971b546649191fd65b36af86f66a7a6ce30815579a91f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 652040d1bac564308010650e221952925a50c5555226780e7486cc38cdf33f86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2292727b0d03d72845279894c1f31c112d823349addfc88e247430a10e6d6c3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fabbf1e94147bfe6ca8865a0621d73d82ca84fbbef64815e8da004af1d93923
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6d178eaceb0614a5717c557df1235aba552e67695c9337e6893ad8b9ac75b81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 458f08bd6a819117a23be3e0955a17f3c7cf8cf4262984050953758974479949
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71dc517f6de8ca3e1580b99060f3aeca4f8c550225b46846a91c18140145d55d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 253408ecbb01d90a195119b7a8578e2bad50b3e0e57a9f86038185e498f95a33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d94eb5a4dfb475002aa214247c03f0ebd4a7e9fdc21e8f2fb6f8607837734113
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ac5b1de746eed2915e0e78b3d2cc7437b1934344b07cb0c2fd0134cf9667169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 492dbbe3dd4ead2c751124d56b16f7c77be809f0216884fe26655eca39e44369
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30b09ed9f820885a45488532906e75be9554ac15f0036b0643413d21dab56623
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9fabdfb868405ccd2ff7ff8545fc46fed1ecc3369ee71d7d1ebe1afc3c3479b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8be9e4a8897fd35e84a0609cf0f1c5236cdd2806c9a1d93560747dba5e1c427
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 627fc9e7e31748b9b0c23923c3ee4c0191335cab95c48700f88fd665d7a8c745
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b99314d2e4166ed421fc16d4121fedc2ea530a7bb1c02f071f798c0f1300319
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecf6feec537917d93c5346890d4f73db5e05d47ec5fcc7d3420a4cfa3963152d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 272241340b635451d0262d692c0b876c8f8a257e6115981700b484d036f83f1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3a00e194b124bc5c88be3302c556f392c1b078ebc8a589db6a27980fd558567
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2e59f093fe595d4f089e748a76fc974863905eaddddda663740fe07cac5083b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e7c7f326a539fb17b76e05369e8dd7422f71ac6e11e83f6c184c93e1b391c12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96619a6cd5e82dfa3d65f68bf1f053e3c1cae830a469a1264c5199d8e926d917
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aedfba3348682a791a634b2641a75acf42db1f8a4e620ebd09d70b1c0950d881
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a8737058cc40a900228fa87a1d1b3fce36e42512288e58986b5e563caa41a38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94ed1da21de1f9b1acfdb96c3bbcf067a4ea5c5214bea41d728c8db36e28d1e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e48ecb3fcca6a2085277a68e1acf4564f47a750259cebdcc25c274fc192809a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cdd564dd21981d9a4ff52679c4d4269c922c356b3763f1d695165deb07bb5e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ab441e8b5ca7654d9dd5f6b65557ba23425b4d6427fdbe94bb7f313b080b6ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ac015b1b643c97e3acac9f6f5041c0b61d4567dbd187e27adcf36a6564592fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cabeeac76530dbdb2114351a62e621de00ed5cbac581adf8df4855168e422ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63c95b73e402374eeb840118e2ba78a02c59b6d708066866e2cba63b4486a302
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f609bd42bfbff2fd66e9cea2efca23ac621aa0f4d5cf719329df2d9aa673d7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0809ed3f2f305b6f408e0c148aa1638372bbc2a47bc81ecf021d74b2e2ce3368
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51d4c3677fc7a84a9c57c49373e02270900799ede429af6dea950efa9e4a4930
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed1ea262bf24dede0050ddef08af1977f1263cd70addd3fb00c85263215101d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e4ea687ef7999ac35c5473a0b59a4406b21c553169d839386c44b68e2368520
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f14464fc4888e4dd71a1a34da329c1d0bb5a8dd8026bc8cb6cdd302d30d8bd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b3dd783c22b317e71463c47da741ff115fbdea1b4cd3cc2f4dff85ea6fe598c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d47f02d9e977bd0502402a972ca613d8b4b4b7f7e990a8c4341d6ac61eeb4171
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb6c2520fd6bcd42f8f3c335d516132e9005e5b16d7da5a6238a2f7e51f2a4fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e29fe80324efa1bdc97debbe7060fa99489545f666b6d34f2c180a20ab9b12d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e437f008fefb2b6732e560c26eea002e520f40efd22f90b453ba1f9e204b4af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41dada88ba1b66feaaebd5c20aa6a1fd39512c6c44ea6a91a62ae38f80e989c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab98774f3ece11043bae803078008714cbb2f1259a7d55beb316682da7014b54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 350340bf6af24848e8cfd4b1f97ccca529039339dc38ce155eae17885837fa32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73c01cdc400bf7295ae19d8dcf65e5e6d9dd6367286580d5610942e567028062
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82208a38299b33d4b249fe87468c9ef50195601086e87c3047b140931938f12f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f860ba20d1d4e6f98326227f15972d2675d67db8609f79a50729cf694d87c155
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2cff577dfa459bb19d58d1ba85265a26ed9283ac4a7837221ee1bf7bdc430a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64f58a2e38ba6e6c755c09780d1ce1e8a234cc451147f3a560ae3a52ee9d1380
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4621486a81c537b5401b57e197dbd0253fd87fd0b2a3d6827d4b7601ee1b62c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbf06f985bacf97319ec9e4fa6b8b43fbe50044f388eef27c951f978b4f18b8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54dc823f82feac9ed0b362622d53d5a0e570685b7ca5aff4cf26a16eec464e76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b673cfddaf62da63852aa01d9a06d59bb2d6ec8ca6c9e3813d49a256199898e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12f623f751ea8ef76dbb3b005e1f40f7dc11ce78f6f430ea64c71d21895741f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5398e378808e2a4212544f50891890607ad6c2a172e68c0b25759c9c20d84fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ecc59e13e688d991e2cd697f881dc0cd9fdda8ae89a35a29c35af745d1ac4ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f05ff6773df7cdf8c2bdab425d1e06b44bd7c374bae7ce430f5f520cdb0f5c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 746a8bb85b350bb4484722bad5645c0521a419a5d64e7ba7028841f653b9d035
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50315a801930906bc8b4ad84cfe21d38d70a2f37ab39ca0e0298fecab3f410a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e833e2d0bb88728ac6e36169165afe84d2a3e444358965af9e9fd10897a68aa1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e38968c3b882dd230f8467164378efb75d6e78ddde25c858de1f81a30a2e457f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36585223171aaece9e9f10f3a43241cd3ca8e4f666500918969aa6419765c13c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4a0eaa2aa81bb8de3d69fc74358fd8431de5384677c19f0eec45db4eda6fbb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51a7e908ed8fc9e0fc2765d09b55ccaecc8266bafa3db3095c3ad32af5798335
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41b4020bd09414865cbbad649726ae1e69080b9b1931f5742107c85279c5884a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fba332ee74a3191bad3221588e4db7f8f2c4fe71c074f23a7fddef89dddd422
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84eb45309c2f43515be92efd8fd9e1ff58bd40ac732e0c20316579fc65fdc584
              • MD5 SHA1 SHA512

              sil.bat

              • Path C:\Users\Admin\AppData\Local\Temp\sil.bat
              • Size 434B
              • SHA256 f4e902f734b281fb19a5d7fa3c74ed5b397ea721f520da42916cc00d6a35dd9b
              • MD5 SHA1 SHA512

              sil.bat

              • Path C:\Users\Admin\AppData\Local\Temp\sil.bat
              • Size 262B
              • SHA256 16188869c081e6d159c3ee03c8b31f5ae91c6da3e98dd388250267b4998365b7
              • MD5 SHA1 SHA512

              who.txt

              • Path C:\Users\Admin\AppData\Local\Temp\who.txt
              • Size 253B
              • SHA256 c8f98c6687b5ad4937e0d2f921b37a8124f5880f41b7898c6fab1435ca82055d
              • MD5 SHA1 SHA512

              699c4b9cdebca7aaea5193cae8a50098_468f6343-c0e6-4931-9703-30c6539573cb

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\699c4b9cdebca7aaea5193cae8a50098_468f6343-c0e6-4931-9703-30c6539573cb
              • Size 50B
              • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              taskmgr.exe

              • Path C:\Windows\SysWOW64\windows\taskmgr.exe
              • Size 1013KB
              • SHA256 58143dd59185083563f699f4483b9c5e30743f1b392c18d108201a8a16f71d31
              • MD5 SHA1 SHA512 SSDEEP

              memory/1692-124-0x0000000000400000-0x0000000000502000-memory.dmp

              memory/1844-6-0x0000000000400000-0x0000000000480000-memory.dmp

              memory/1844-43-0x0000000000400000-0x0000000000480000-memory.dmp

              memory/1844-4-0x0000000000400000-0x0000000000480000-memory.dmp

              memory/2808-41-0x00000000001C0000-0x00000000001C1000-memory.dmp

              memory/2808-42-0x0000000000480000-0x0000000000481000-memory.dmp

              memory/2808-103-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2808-1138-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3664-24-0x0000000000400000-0x0000000000416000-memory.dmp

              memory/3664-35-0x0000000000400000-0x0000000000416000-memory.dmp

              memory/3664-28-0x0000000000400000-0x0000000000416000-memory.dmp

              memory/3888-21-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3888-39-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3888-17-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3888-12-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3888-18-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3888-19-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3888-22-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3888-13-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3888-26-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3888-15-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4412-0-0x0000000000400000-0x0000000000502000-memory.dmp

              memory/4412-7-0x0000000000400000-0x0000000000502000-memory.dmp

              memory/5032-202-0x0000000000400000-0x0000000000502000-memory.dmp