Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2024, 04:33

General

  • Target
    98eb834f3eb75474bfdc349a832e1a5d_JaffaCakes118.exe
  • Size 304KB
  • Sample240815-e6qdlazdlp
  • SHA256 5f601cc3af274820eadde298875ee89a2f8f41736dd24d1fac89793e72102643
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • noip2010.no-ip.org:1100

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98eb834f3eb75474bfdc349a832e1a5d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\98eb834f3eb75474bfdc349a832e1a5d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Users\Admin\AppData\Local\Temp\98eb834f3eb75474bfdc349a832e1a5d_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3916
        • C:\Users\Admin\AppData\Local\Temp\98eb834f3eb75474bfdc349a832e1a5d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\98eb834f3eb75474bfdc349a832e1a5d_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4464
          • C:\Windows\install\server.exe
            "C:\Windows\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3868
            • C:\Windows\install\server.exe
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2692

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 c08d0d70f79f6d2a7a42fa7c9fe0ef695e7411f29b08e5d8a96b464750a161c1
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 b52243c7630bf39b84f5ea3bcfa7c36e3a3980cd713a0bd6382f5beccbac1f21
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 96a3cef6d17173cc0768d99b18a159593bae9985f903643834e861703eef4803
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cf3851b17a61c0b1cfb82b950831a1ca75a80f83ddf63d64f0664e1d22c24771
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d13759f8828c959214ec7cf10c5afa606aebe597365373440fc98daf83caeaa5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e1f68ae3f29c7a47fb4cd491d71f9bba833d44a3ba9c9b458cd05b9c90fc1c55
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 54885dafcd1d61f3aaf9977ce88ae872a9d805ad875d34d7c03201d32b6e9973
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d641d793d666546d96816fd9aed7a101d69c3a1ee1bd6358e10c2b5cd0d9c26
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1f7e20a95563cbf14fb6be4fecc6916d6dfcfc218779146598f8a4e0f857c32d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d80b352a545eb6b90a017b26aa5ab5692c7164ee7544d31ef1c3d3617890a5e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6a62f26d5e2101844642a6a60fce33a36bf29e446ba73d6730845140b5ed5bf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 815e4cfee98995a2a366185700deac12e18d47701ba3fb3e6a91e5b0634946f8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a8155f8df3d86c4c79adcc7441252e10964848c8bd22043ce36dd5839b4c208b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 090774d3d9d752b34db01b2832acb958b4df01095fe368c90118ac2c140c4923
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dd47d5e973e20e849ef756f06bc3ff7f9b38034e9ff23c7bc8b19149e38c30dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6c61e375c8b8aa3edff2a3b4f734ee40fdd27fddfad19e2329cee955fb6b26b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c2dff3b24169890deab1e8a51eb844791c94673c36e0714234af16db956eee97
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b9deb60f7208587ac5b4af00efbea03714aa44dffed52edacc013199a9f3e36e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 375fe73fd9eb1d2fb46f3fa23eef661ecef76c560daf3eb8def499fa63317fd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 86964c2052cd22103a2b1e25ee2e69f7b7727625a59e204ab9aa546d1fcb308c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f68c3a64abbee2f8bf48864aa774be3796f8ba61fc9bf11e23e91459671a905d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 203041126b1ba2acbcbf1ba1a87a071c8d12f476a134aaeae9fcc8890a209b04
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cb9e42a8f0f9793afaee456fc9aaec5dc8a8a2242edc864ec4ae61e6b25be442
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bd9734d895ef12b15e148a2e3025c151c9b22daa49e59b13804955dd9aabc422
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 85f0e45b36b65ffb13bc1adbcea4b5b02245e95152dc9dc8ed58e21f25c502ea
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a1e337ef50ce9788f266ccd62b1e82765a723728156cffa0a56888263758c0fd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2a1837ba1f9225d0989f68757542956e975e3961443091534ae0fae3de2dcd1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 14f3a6109e2d7bb02440322dfd8f12d1676b4b0d2f07d0a15f0911f8a9e60d55
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1d29547b5defb32b42df2a7968abead7370c2ceb6b2117690f2d789995ba29f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1e4fae8b56b50bea10a78f32687d85052e46c717f8f05626b84f30e634b789a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b372f838b0824ac3fc85c964a51f5f794fdee2191ac2682ffaf257a098737c5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44e88904390a480f818b164523e8323675289b321c7425c48ceb370f8f47e89a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7d21a4a2f059faadd3f93d099c5a4190d9428ca462bd6ac26a4b40b983f8cfe2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e590228d2d169db4125def14fba0be59288509d4885e1f1a91e839b65290cc01
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b21fc9d12150aff6fd370f4a26ed906c9e798f93f93fba2127b1847e00a55f77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a51492b21d73c0d5fa9cf33b1511a5ea91453be2e950d70022e971ce50696fd9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 53de06a547cb3335eda9b31093c74058f7aea79a4b08ed13f13a3e2c6aefec88
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8fa27b1c9ecb9cd4a80f058f06e5c9468160dc91c00c65cde1d1a89476720d21
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1bae5841725b98283dd2d5ab11881dac4d5123a45926870516e21443822d5036
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 212e4b3173d31d54a7fe590a8523acf1083a6a3b6417c5ca4ed62feff560e31b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e0a83565b34854c4ede32681ea5635227f112c9f8ea175b9f9b5920a4296f70
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3a9497670e01147e2cf73b9bb56fe1efe482a701f0adac74acd06e395920bce5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c97a8f6e48618379409b4d888f424366df0cdd530810d337105087384b1e09d9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 26bc11a7346952cfbd124f03c8d2f8685b778a235642b8af68e1b1f706c95ec3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c3d11fc360a6bc4409087b8932ca65b9ab2ac61357e666f58bfdda0451700601
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f99ba42109133734bebb17b7df958b261a3637b3686734de4f87de845f7e4834
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 10f8fe900703cf6831c5a6412f16e697e3879b62bfa8f6950381dbae8ee9723c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 257b5c86a09d48aa328dc4b6f55ddb718ebec84c8bd5ee0b7233f3ae4616de98
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 afe17cd37c47aa1bc8405a38839ffeb2eb07e916e1e7f34b66f07eca61263e90
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 12066dd0f14a322c59cb1cbf9ffdae09d0c0762106ec9d464319d445d9fedac8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de506f1f6d142acb4160e64f8233d603d8237751f30e3c7c996d337b1755afab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 756fde3d0fd76ce0c3474df580dbd87b6e66853e187cd2f87cb8d4c10f93eb6e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f9e4c7bf48601547ec49cb5e10f7bfb209319db2fbf492a19537e7a5c8c437c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bf577d7897fe5567e9fe98283abd604a1bba1c6e1a3d589bbb7a12c25de4b4ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 80e46a2fb61527eef17e5a5228caa77eee4b691f44fd1b07a47897c6f3377ee6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de3ce98a6edff5f367edd3bb7929557965b413b40035899d066e8987b0d753e6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f96d9cef282dd240abb81e10cb85f9c3c69eac730f5f9f7f146f297e86e30b8c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 df939503bede271ad68106b7c0aac30a2b1d5d743778f0c956737e5d933f65db
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a42b35f1b5459f1d26edda12e61ecf76e26648f7d155442de1dd49c32c6ab90d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 45d0ff4064ac03a22f63c1e9ad545bb977a40ceee2ce5b24db9775972f5a5622
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7432aa4448edfe217be2460693260a1c142d62db77bd5149936d42f13b51f991
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 daa2073b0df305c67b569e8581e3139bb4014f9a95bbd41c620eb7055d2d3c11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff590270fe7fdc1b97e7852af884b6087722ec109ee096b3844d02cfa2184507
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9652aea7e8a18b0f1c5f33225af1a2fce6f2970e03ad1673cf91e3826b9cf825
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b8bd96bcb374ae1061693bdc5892ba3333e0b864b5d6419a4afacd3a14a08d3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f9238473f35a44fd3d809231e3ad1b92bfb7515d24fbffdd5b4e28b7a92d3b52
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 304ecf42f684e5502e553f76f66d14eb47952aed205984c57db992c40505cd29
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 90c28f511b5b03a7ac4ecf7fb826e26af0e2f063ac36176a81e69598872042e9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e5fcca7ea331f811dc837d28aea22683cf47cfc008ee20ac1b8b98fa64c905d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f92a742b63eadecde05617a14d7b57869edcde6e8d8dc8fcee474687ad1ab355
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c9ea7120f01d39e176cf9a7412a7619305bb85bee79bf3c3396898aab016bd8a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 efcc48c2e41de6bfd0de08149aae25bfe4e86737d343236539d0ec1f1c808560
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3b953d05e78f5943676e0d76d0e4e1e9e84c7b0ae8dcf758a37751d3ddde7e9e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3905491ca427a0640b3f577a306ec375e9864e04559f37d861ffd67912056352
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 105a8071ad1be6ab186db259081e913ae33f309a7d950bd8428cfcfbb3966168
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 292feda01c68537b191c07e95fb6ca04a5703be05362d3a5d20df63119c58a74
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cbbd7392249e4ea03f04d7ece48a1ce25e50f2d76391b5b702dc071a209a6502
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 487a62580ba2a90d63651c014fd85c7ef2e653019a5928bc86668add300c94eb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9cefca298c313cf3f38cc84521e37221e8c74fb973a35d4ec43bc78b2ea05d79
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e7e27cc769f6fdebf2b98da2f8a9c72fe76358bb4707e08b0235013d74d57fd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d156f0d65d46751e565c659126561d244224bc56c3e2a84d005b95417dd6bb05
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db0ff16147514ad03bb579965dc3c3b95279d839ad39358c384667554cbca190
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ef46427453e1ed479a3b747c703a16af307b3eeb10ed9343014b4c0922be914e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1766b6b60ff9d49b121d1fa9dc79841b6aa376f9d9e0cf2f8be1f17eac3ed1f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5102c81edf73849fdec3312ca9714c9e32b44ba9716fd3aa5beb3b37d7c658ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aaec44d8bbf416ca1e5ae7c1261182a9d0ef9517c0bd1b3e8b8c5416f2a55bf0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 000a6639769824c6abab74e8f0679e6d45fe40bb60fc7152b443a22715a7ec02
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 84ebb8248e7c9a98c64841f270019ac07983bb3210b4fcb8138ada40fcf1bf7f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3e84ec1fdd828ebb4a5fd2fce6d345aaa3298bf01054420d704624965511af84
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2efc08b97b5b4fed38e65ed6965380f766888d682145c468dc4fe0e62c2379ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2ddf317d0ef3dcd3d86e452094116b51beee37d74b082e2bf3e4c66b567c579
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe9c3530d1749b9ad08813f351b0dfa5d80a154edf2809b38480543c97ca54da
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f748c2e369b87ccafe84dff5214e78400e91f61451672968a8330e1a6e7c585
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 abcfa4634429586c181cd129d4097bcb634f868deefde91658fb614cd4246dbf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 84ce92c70a50341491cd00e9d6241e4c416a72bc4c8064995308f83ba0b0b5af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1be9cd5a32f068280f758496b58e60da1b76c900bbebb9d29807a99905d7f577
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1657dccc30da31903b9dbb4df2bdf398a1a3014fca42d5dd7f73c8ee42ea30af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fcb83594e84403d8ec095f40834f73a699681c6df37ae139467a5170daad9de7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f5d36b9d2454a5f63c5819635be6ee7291793ef1188c3b986d0ba984b1d1f00d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4a48b03acf35ef7b97f414eb8e66b481dec822b06bd1c03f4065844e06aba615
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a36ccead364255b3ff03beb287d7b5a45b8abb23c553b432e3ffccdd8a2a078
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b360786e47189c10a647812180aad7a1ec110127f69216e6f73f5fae1bbcf22
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b278b674d747ac00d9268fe1188d2382358379db1a232fba5dd1cc38eec8b349
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fa1d4c0501a614f96e66c0936ae5a2a1e41baaf0a22602ead0a4a17b07457ab5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 abf1f0bfe0893b708a9d99702a8c66c18605ca58d48e3e05fd683eb23d53b286
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0710c890ad62c592a14ff24c6088ca0dadca2d5d5d01f789ae32c23a8abb22b1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 84efbdf1a1ddd32d6b4d40aa33578305056c1dc2bd9ec1952fae8945671d29e0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 002aa187e9d1e58325d963682fc03d0a7f0c8b66ca708b5a0a2e423a108618c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f35d3cc477d830012db68138191019100f6359ec50927ed82d989a0c54ef621c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fea152dfef0b0f200fe03d44c882463fd758e7c78d6b2a39bf5f2527e0ceaab6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0375133a2772665e63a922ea6b865e0ac1e3d0f3d2bcf728bd3599eedb2f66bb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a97efe3692a2a036158732d1a2d8934b3723b9b0c9c1a72ea52c6e65fad06abe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 675bf9d0829f943ae93223639b50b64637e5f8f675d6e885a648dd377c5b8309
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 548fb44f222bf2e35361a4a086aa84f4deac738b7143cde63cbc3a40c2961fd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c948e117d51829bd19e4ac57e6931c87d58d445b9fae537e90db91ca37f1f537
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c56db97c270bc4f3a047e9404618a33b22835706352625ca7daec5c76a80bfec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3b2820ce48e24fb9cb4378aa99245a962498189144530628ed32e7f31f709717
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7424c16526495f79f53b109debffa6042c9f4ccf3cb910a2de82dac5db4d16a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5180a872514d622cf500fe7a04d3536c1c74033277a24dfe5c28925c73ef91a7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b5a453f85f04adf3fed3a00492af9921d8bb9a63df4af5a0a9739d287aa83030
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7d9f98183057f60f11966097e00e3034a1820b93dcb2fe3efb734684b6739d56
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 99310d165884c8ced0f4fdae093bd3a10b28dc6272dd422f7fa88c7a29901a86
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8c28cc06c73fb69a5b0342857680567bff41b8d4fa30b69b71443bd716aa88c4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 efac19815821b173a5984020275c1b5064189cc76df5ae86ce9ddb08d63cbec9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de715e76aba4584f2b1b59da912f1cf3e9f564632549e00272aff5ef7962186a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5bcb66cf4f96c8e6cb1b352f2c092921e66a773c8f0aa5ac831637739d65f8c4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 be05d8b021731d588847bb903d3e1b291ac3988589ae1d0351a55ff90dc0f49c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8d8e5e84aafb5d5ec12385ca257e83148d44da6bbe9242641effe2f070d84e45
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e56f51a201ffda0afb94fc169cf528df3e10bab62a2f95351cc6948bc4eec730
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db35d3b2419015b717db9a75a5a4816cbf111a128a27589d44bd360ac7ebde23
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 42ec53a765c4f65669108012f584cbf46ef3e053c2e942cf98340e5ea098adaf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f6de2cc94365f7b65c2f643b426d5bc0429634749211a40308fdff42bac4e3ff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 028925f920a62899938c52b19c37f0e046ab565b4fd22f40bfacabdc9ef41cbd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fcae1cab3540ac0c070467a8331fb049a37dc53931a6e3f7b5ade288b9649095
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0b825ee575623a0d61162c20f6b60d761f623b92579583a6b088b305c3f83d4a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1ce98c9c82de9d6173ee28d5e8a568ef46ad288346a3104d1257c373eecb20e2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6e227e6b9075ca95888ae3b378b320da7a234434f1987e291029e3f9a3c863d6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fa291f7f6d362db8db412b7eaef7bd837c5a85357c9298d890c0a641e98534d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1ba4dbde8c96cad32f51368daf901ec87910573d2b8f43e15f9b705c59abfb41
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\Windows\install\server.exe
          • Size 304KB
          • SHA256 5f601cc3af274820eadde298875ee89a2f8f41736dd24d1fac89793e72102643
          • MD5 SHA1 SHA512 SSDEEP

          memory/1528-36-0x00000000036C0000-0x00000000036D0000-memory.dmp

          memory/1528-34-0x00000000036A0000-0x00000000036B0000-memory.dmp

          memory/1528-3-0x00000000021E0000-0x00000000021F0000-memory.dmp

          memory/1528-4-0x0000000002240000-0x0000000002250000-memory.dmp

          memory/1528-5-0x0000000002250000-0x0000000002260000-memory.dmp

          memory/1528-6-0x0000000002260000-0x0000000002270000-memory.dmp

          memory/1528-7-0x0000000002270000-0x0000000002280000-memory.dmp

          memory/1528-9-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

          memory/1528-12-0x0000000002B20000-0x0000000002B30000-memory.dmp

          memory/1528-13-0x0000000002C40000-0x0000000002C50000-memory.dmp

          memory/1528-10-0x0000000002AF0000-0x0000000002B00000-memory.dmp

          memory/1528-11-0x0000000002B00000-0x0000000002B10000-memory.dmp

          memory/1528-8-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

          memory/1528-1-0x0000000002170000-0x0000000002180000-memory.dmp

          memory/1528-2-0x0000000002180000-0x0000000002190000-memory.dmp

          memory/1528-0-0x0000000000400000-0x000000000040A000-memory.dmp

          memory/1528-15-0x0000000002C60000-0x0000000002C70000-memory.dmp

          memory/1528-16-0x0000000002C70000-0x0000000002C80000-memory.dmp

          memory/1528-17-0x0000000002C80000-0x0000000002C90000-memory.dmp

          memory/1528-18-0x0000000002C90000-0x0000000002CA0000-memory.dmp

          memory/1528-19-0x0000000002CA0000-0x0000000002CB0000-memory.dmp

          memory/1528-20-0x00000000035C0000-0x00000000035D0000-memory.dmp

          memory/1528-21-0x00000000035D0000-0x00000000035E0000-memory.dmp

          memory/1528-22-0x00000000035E0000-0x00000000035F0000-memory.dmp

          memory/1528-23-0x00000000035F0000-0x0000000003600000-memory.dmp

          memory/1528-24-0x0000000003600000-0x0000000003610000-memory.dmp

          memory/1528-25-0x0000000003610000-0x0000000003620000-memory.dmp

          memory/1528-26-0x0000000003620000-0x0000000003630000-memory.dmp

          memory/1528-27-0x0000000003630000-0x0000000003640000-memory.dmp

          memory/1528-28-0x0000000003640000-0x0000000003650000-memory.dmp

          memory/1528-29-0x0000000003650000-0x0000000003660000-memory.dmp

          memory/1528-30-0x0000000003660000-0x0000000003670000-memory.dmp

          memory/1528-31-0x0000000003670000-0x0000000003680000-memory.dmp

          memory/1528-32-0x0000000003680000-0x0000000003690000-memory.dmp

          memory/1528-33-0x0000000003690000-0x00000000036A0000-memory.dmp

          memory/1528-14-0x0000000002C50000-0x0000000002C60000-memory.dmp

          memory/1528-35-0x00000000036B0000-0x00000000036C0000-memory.dmp

          memory/1528-60-0x0000000000400000-0x000000000040A000-memory.dmp

          memory/1528-37-0x00000000036D0000-0x00000000036E0000-memory.dmp

          memory/1528-38-0x00000000036E0000-0x00000000036F0000-memory.dmp

          memory/1528-39-0x00000000036F0000-0x0000000003700000-memory.dmp

          memory/1528-40-0x0000000003700000-0x0000000003710000-memory.dmp

          memory/1528-41-0x0000000003710000-0x0000000003720000-memory.dmp

          memory/1528-42-0x0000000003720000-0x0000000003730000-memory.dmp

          memory/1528-44-0x0000000003740000-0x0000000003750000-memory.dmp

          memory/1528-43-0x0000000003730000-0x0000000003740000-memory.dmp

          memory/1528-45-0x0000000003750000-0x0000000003760000-memory.dmp

          memory/1528-46-0x0000000003760000-0x0000000003770000-memory.dmp

          memory/1528-47-0x0000000003770000-0x0000000003780000-memory.dmp

          memory/1528-48-0x0000000003780000-0x0000000003790000-memory.dmp

          memory/1528-49-0x0000000003790000-0x00000000037A0000-memory.dmp

          memory/1528-50-0x00000000037A0000-0x00000000037B0000-memory.dmp

          memory/1528-51-0x00000000037B0000-0x00000000037C0000-memory.dmp

          memory/1528-52-0x00000000037C0000-0x00000000037D0000-memory.dmp

          memory/1528-53-0x00000000037D0000-0x00000000037E0000-memory.dmp

          memory/1528-54-0x00000000037E0000-0x00000000037F0000-memory.dmp

          memory/2692-218-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/2692-222-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/3868-219-0x0000000000400000-0x000000000040A000-memory.dmp

          memory/3960-66-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/3960-62-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/3960-65-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/3960-57-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/3960-134-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/3960-61-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/3960-59-0x0000000000400000-0x0000000000455000-memory.dmp

          memory/4464-71-0x0000000000570000-0x0000000000571000-memory.dmp

          memory/4464-70-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/4464-74-0x0000000000400000-0x000000000040A000-memory.dmp