Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 00:27

General

  • Target
    2026-06-28_0ec740e7401a051ad0731148ac7d374e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
  • Size 3.4MB
  • Sample260629-ar85yaav4m
  • SHA256 cffc837a6a9a120818e5bf521d83189abcd3ac6d0c934d4098a252e933c4ed52
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • xred

C2
  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Xred

    Xred is backdoor written in Delphi.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 54 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_0ec740e7401a051ad0731148ac7d374e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_0ec740e7401a051ad0731148ac7d374e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-06-28_0ec740e7401a051ad0731148ac7d374e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-06-28_0ec740e7401a051ad0731148ac7d374e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Users\Admin\AppData\Local\Temp\IPMx2\setup.exe
        C:\Users\Admin\AppData\Local\Temp\IPMx2\setup.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        PID:1208
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:1204
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5744
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntelChipset.log

        • Path C:\Intel\Logs\IntelChipset.log
        • Size 1KB
        • SHA256 3481bff63456677c6cc2e13d5748164361cb712440bb8b47378a337c14a2def9
        • MD5 SHA1 SHA512 TLSH

        IntelChipset.log

        • Path C:\Intel\Logs\IntelChipset.log
        • Size 9KB
        • SHA256 b1db9b33d2a7a584568d610a71ec90dab6e425b752d0f184bff7ec0fad5bded1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Synaptics.exe

        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 753KB
        • SHA256 49ffede9d0e9576a19e7c16678aa01c3a39ee08057a2da6320259a5cffb27fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ._cache_2026-06-28_0ec740e7401a051ad0731148ac7d374e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe

        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-06-28_0ec740e7401a051ad0731148ac7d374e_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
        • Size 2.7MB
        • SHA256 ea55454dc7188cfdadfe075a7f40c4cde18cea807c25f5f7384754bef34bfe97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        D7595E00

        • Path C:\Users\Admin\AppData\Local\Temp\D7595E00
        • Size 20KB
        • SHA256 d03430add397628e5fe5a95befca5a8ce94eeecefb6d43ee7c8098aeef53a588
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetARA.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\ARA\ChipsetARA.dll
        • Size 64KB
        • SHA256 9f82be9182f644cbf2cf2bc3f083ca416baeab8f406ba8f31fdda274705fe558
        • MD5 SHA1 SHA512 SSDEEP TLSH

        license.txt

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\ARB\license.txt
        • Size 8KB
        • SHA256 4b1c0eaf62712409885af232169a74c2a2b7796cafa57f24434c4fba2c37af46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetCHS.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\CHS\ChipsetCHS.dll
        • Size 60KB
        • SHA256 ba52e3ff70818c6265fb161637dcdbdfdf3cccc9d032a5fca1c87ff1db014f60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetCHT.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\CHT\ChipsetCHT.dll
        • Size 60KB
        • SHA256 9e29c3a8ef3785cbb5a338d3608df05136dfc488616f4f1307f5eb0636dda2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetCSY.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\CSY\ChipsetCSY.dll
        • Size 68KB
        • SHA256 43a9787f9a9887c5e1756cca3bbc6b018209bf7cf5b3689ef15766fbeb43e86d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetDAN.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\DAN\ChipsetDAN.dll
        • Size 72KB
        • SHA256 692b2ee2ebb91197b6cf2e3ada22907d68e7e96a64d63775fb3ca4d105ef90bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetDEU.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\DEU\ChipsetDEU.dll
        • Size 72KB
        • SHA256 c02073b5693165aa6e65f1e6c95cacfa35edeab81a9ae6f1b96beb53e2b69f04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetELL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\ELL\ChipsetELL.dll
        • Size 72KB
        • SHA256 d69fd04482ebced8231eba2abfa4fb956eca3169823e6d661da477a6e42ac111
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetENU.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\ENU\ChipsetENU.dll
        • Size 56KB
        • SHA256 da49d72a61f5d58120e14f6fcc2d5fee750f1b7f09a206430d54c2feacd8fdc6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetESP.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\ESP\ChipsetESP.dll
        • Size 72KB
        • SHA256 3a91992a1236a9d3f516e6ce575147ceda20825fa2fb785f70d78b99ccfbc485
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetFIN.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\FIN\ChipsetFIN.dll
        • Size 68KB
        • SHA256 bee3bffeca896fb5dd9f0bdaedf156a30e1a8415c7e2f63ffdd5232773a6f3ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetFRA.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\FRA\ChipsetFRA.dll
        • Size 72KB
        • SHA256 e37acfe4eef4cbbd29534e72533e6a9c5b7efd4c391f27b15c0308b9fd4aa3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetHEB.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\HEB\ChipsetHEB.dll
        • Size 64KB
        • SHA256 288511f5191dea876d5d1d03e8e7effa4a9c25572a2b52b3f0bd6317fec3a03e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetHUN.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\HUN\ChipsetHUN.dll
        • Size 72KB
        • SHA256 5764d34131267316a7c516b30d95c2605a93e86d10530804eec3698014a56c89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetITA.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\ITA\ChipsetITA.dll
        • Size 72KB
        • SHA256 9d3aa9b2173a812064ad9d71ea0b0223c42de3e726595174f2c4bbbc56fe53b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ChipsetJPN.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Lang\CHIP\JPN\ChipsetJPN.dll
        • Size 64KB
        • SHA256 ad51dffb7ae2630e124585cd09f7465a186d9f19c64f9af1c077b4cafb042379
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Setup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Setup.exe
        • Size 934KB
        • SHA256 59ca610e4ae1db9ee6f74d003f15d4d4a0673949042fa61ceb8a60ba8ef0e407
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2008s4el.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\2008s4el.cat
        • Size 12KB
        • SHA256 b4d7d166881730ad6545c9ad408b5017e33775d97cb0f98853789ce24bd2c729
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2008s4el.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\2008s4el.inf
        • Size 5KB
        • SHA256 c8b7cc284567a62e7b28700fe3b78c180e125f91b01c52fbaccfbb3feaff1bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5000XZVP.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\5000XZVP.inf
        • Size 14KB
        • SHA256 0aafda3d1bf7deec01b9ffdcf745b16c938257c0e44467d60b3e6a34b540ea62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5000xzvp.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\5000xzvp.cat
        • Size 16KB
        • SHA256 7a89f9573bd40499d26b4c2509443978a54e1cb7cfc830b0650aaac08630482c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5400.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\5400.cat
        • Size 17KB
        • SHA256 cbeab08b554cbfb99d16342767e83157dd87b191cb537b5c665d74fe1db97d21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5400.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\5400.inf
        • Size 7KB
        • SHA256 31e678d8114662264eceaa47c08e5fe14620cc90d26f08719aab15ec2687165e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        945.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\945.cat
        • Size 18KB
        • SHA256 d13035b420bcf36df7a3700b743c5c267be6eba8febab195cd922773936425c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        945.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\945.inf
        • Size 4KB
        • SHA256 b7aa26bb3c0f4e0b5d92369466615f2625dac9665cda10d5700fa34e401be8fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        945GM.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\945GM.inf
        • Size 4KB
        • SHA256 0a1220db3cd1eb38e4f1fc3bd3b1c7e6b1c68dbe775e8749e9c40bdbdf9ed5e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        945gm.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\945gm.cat
        • Size 10KB
        • SHA256 c64b250c3d83351fe5f3a949763e6a0a66ec979ee4d5198caf5a317c1eb344a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        965g.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\965g.cat
        • Size 13KB
        • SHA256 15ec541cf8a453a6f0762b8948a77924476d506c99bbc194bad85e3056f19e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        965g.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\965g.inf
        • Size 4KB
        • SHA256 7c21c0c1b3214ae391dcc7642d9411814d896a9abb2bb806de83bd9200c9a87d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        965m.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\965m.cat
        • Size 12KB
        • SHA256 37a7048a3215d4732554bd869c80c26ce0c010bb6521e26f327218184b88b3c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        965m.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\965m.inf
        • Size 3KB
        • SHA256 4b96db2f7d80002eb0339bb9dc79bc769eb9dde416e2fd453be0dc87a9e525e0
        • MD5 SHA1 SHA512 TLSH

        E5100.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\E5100.inf
        • Size 6KB
        • SHA256 aa9a4a952b7a921ac18302f3950082829a310cfb237b2bce2a847a02ca2d7bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        E7300.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\E7300.inf
        • Size 6KB
        • SHA256 d27805aa0d82d341a6758ca1dd482aab112a2a5b26062d27688d7744219a517a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ESB2id2.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ESB2id2.inf
        • Size 3KB
        • SHA256 a7f3d32a5d170c5057d2892c3052f2ffdb6a7961440c93285732bd5b7bf26d9c
        • MD5 SHA1 SHA512 TLSH

        ESB2ide.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ESB2ide.inf
        • Size 3KB
        • SHA256 fc33408665dd9966410d07566af38633e0d88f620905e3a0a6d4f3510304104b
        • MD5 SHA1 SHA512 TLSH

        ESB2usb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ESB2usb.inf
        • Size 5KB
        • SHA256 faa3faad9c6f9e9e0a340b623e9fa53c529769fe01a5b8b68064dda0c31be8af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntelCPU.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\IntelCPU.inf
        • Size 7KB
        • SHA256 64090587a5f268e8ea2a9cf8a8a8ada341870c134efe5943009f9dc3d5706731
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntelIOH.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\IntelIOH.inf
        • Size 10KB
        • SHA256 3a7e33f2c41d2ca42706afc9bd2e347872ea756937db41f5ecb5980e625ae0c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dmi_pci.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\dmi_pci.cat
        • Size 10KB
        • SHA256 98ec81242973a15d7605ef2dc9b26c7811bb8ebf0f762228a01246618eb3ba3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dmi_pci.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\dmi_pci.inf
        • Size 3KB
        • SHA256 807b5284238366ac50ef816bd810a6986c6e74820055db0dfb5a284810901b82
        • MD5 SHA1 SHA512 TLSH

        e5100.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\e5100.cat
        • Size 12KB
        • SHA256 b5472124edbd1212b6c8b803091239d660b7dbf9db98280bda421df759e0b36c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        e7300.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\e7300.cat
        • Size 17KB
        • SHA256 1f42db98f264a756d9ed5b99a45a6f2e1dc22e6696b6624aad7df66fe42a70c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        esb2id2.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\esb2id2.cat
        • Size 17KB
        • SHA256 e6cdd00a4adb5e4d11df1b34515d8d4dbf2ed1ff1c58cbd87bd40c9b792e2d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        esb2ide.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\esb2ide.cat
        • Size 10KB
        • SHA256 39ac208f1258b5c5b019f33151f33911181e442180b25d80bd1c1bf62b2ce12a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        esb2usb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\esb2usb.cat
        • Size 10KB
        • SHA256 172c2a41642999ccbba00d2b62510635ef6655854226abf1f84dc3ddff960153
        • MD5 SHA1 SHA512 SSDEEP TLSH

        g33q35.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\g33q35.cat
        • Size 17KB
        • SHA256 b0883cb536db477fb83e886cb0e21c92a55dfa656cb4b11f8b838279eed4cc22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        g33q35.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\g33q35.inf
        • Size 6KB
        • SHA256 b13a08738045146533b056efd27107ccc1003a80efd485837934e42fd3ab5311
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich78id2.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich78id2.cat
        • Size 10KB
        • SHA256 289a636b7dca33f9ed15d8711510511cf63ce3ed2d54769c727d36b9a596abeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich78id2.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich78id2.inf
        • Size 4KB
        • SHA256 53a72384ef4de830fbc63d6641c8123ddf3fcc87f6ae618d0b909278f31e2103
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich78ide.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich78ide.cat
        • Size 10KB
        • SHA256 a61c7493f63529e83a5324f75c5509b55a68dd74a7005f5ffd0846db356ec418
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich78ide.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich78ide.inf
        • Size 4KB
        • SHA256 854ebbf4b905454e812231dfea334ecf3680697101648b09aa994370121af4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich78usb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich78usb.cat
        • Size 10KB
        • SHA256 f8b48b43b8fb8c99c6425eee30ef1e014372ae66aaeab4ef3959caaa83cd6352
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich78usb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich78usb.inf
        • Size 7KB
        • SHA256 3e17b66fa322794aa64575ec5233ff115a07d448bef446b6df5b923af6d1a8cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich7core.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich7core.cat
        • Size 16KB
        • SHA256 01915f94f0f46bc1c45de45c7212519a800e24f2518dd3ba018b64f7164c3732
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich7core.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich7core.inf
        • Size 5KB
        • SHA256 5ff116f01b8e5a7170e0037fac420cfa99e56e0fb4beaac2b542608f0173736c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich8core.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich8core.cat
        • Size 16KB
        • SHA256 8860bcec8cd6d4c09066043a4cdaff81d10d14d69295736750f001a39e84a9c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich8core.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich8core.inf
        • Size 5KB
        • SHA256 8a78b933e1fce6c20d811039d5060b44deb3655b9af80ffbaf16c9b5d2c0a0dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich8smb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich8smb.cat
        • Size 10KB
        • SHA256 894d0420515d5267e2be367a16c746bcdb67b3d53c19841d3a2f2f2f5a973943
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich8smb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich8smb.inf
        • Size 3KB
        • SHA256 de16a672fe4db4f3732fa26c7b87fef92d12ae6356f4dba91f3a905ae0178b05
        • MD5 SHA1 SHA512 TLSH

        ich9core.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9core.cat
        • Size 16KB
        • SHA256 291f4007f6611e377df3d7df7465517815b3bd8cceebb437e88118835fd43d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9core.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9core.inf
        • Size 6KB
        • SHA256 8e155e495fdf602e92594ccae8dd353bf238a6e0d5f554b839ff6681071722e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9id2.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9id2.cat
        • Size 17KB
        • SHA256 7fa36bfbae04a0caabf94c45f81d26d02a4dcaae648fcfdbf0c431897972a6e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9id2.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9id2.inf
        • Size 4KB
        • SHA256 ce646512cad37cbb3ced071794533456a89b5ff8e2f49ac1e1b1083692176309
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9ide.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9ide.cat
        • Size 17KB
        • SHA256 f405c8a853422c5e9fd0f1784bd133fe03dda7a495937b17ec57071cf24fd40f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9ide.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9ide.inf
        • Size 4KB
        • SHA256 7ad3352336829da535b5a8898514160fca79980cee3e009e1f66957a3aaf8790
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9smb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9smb.cat
        • Size 17KB
        • SHA256 397f1dff9458a0b7af8efcd844ea111762931e9d3f0c54d37b531876ddf2d258
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9smb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9smb.inf
        • Size 3KB
        • SHA256 0257c4d63fcd9d03671a4716b54a9d743b8cd2e500becb24b320d7668983fea8
        • MD5 SHA1 SHA512 TLSH

        ich9usb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9usb.cat
        • Size 10KB
        • SHA256 53903ce9d4b9b07934c4b5c23eb775169717ab526048f09527d075cf4178f046
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ich9usb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ich9usb.inf
        • Size 5KB
        • SHA256 58bfacb1dd93fafbe611dd2cb176967712109e2219c078b48ccca6f3566f64b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichXdev.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichXdev.inf
        • Size 3KB
        • SHA256 22a3bf97c650ceb6c863354b56fb0c77b0870a175d0cd0154facc5d7c5c4f935
        • MD5 SHA1 SHA512 TLSH

        ichaahci.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichaahci.cat
        • Size 14KB
        • SHA256 4c9d2eaf56f640f399d4d3a23626ccbf81099eaf2a47f53d4fd9a87dea39a9a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichacore.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichacore.cat
        • Size 12KB
        • SHA256 42a2178f447922aa22b0f8498a779df5a3bb67f03c19661f5dac017804f44ea1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichacore.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichacore.inf
        • Size 7KB
        • SHA256 12c8535d0eed5d66294049bead9d9f12f4567196a9d8decadecb5818af33b266
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichaid2.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichaid2.cat
        • Size 14KB
        • SHA256 34867ad2340c0554a26084f9dd52307fdad8e511913f19ade291c028999d5608
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichaid2.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichaid2.inf
        • Size 4KB
        • SHA256 095c62c0c91e2575113ac63c6f6c652ac89f2e5492967aa77b0c5369f47baac0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichaide.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichaide.cat
        • Size 14KB
        • SHA256 7302273ba659c9b115d9f7b4f309cf922d5e51fcccf04724831b629cec6b6bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichaide.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichaide.inf
        • Size 4KB
        • SHA256 66290dc7bc6d2af6c061fd8fffbfcdcf1efe10fc8ea73ca71309550a581e9af1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichasmb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichasmb.cat
        • Size 14KB
        • SHA256 90f649d6e04c5d2068c77176233ab275f2c58e3108923bf95e0c4392c3ab7855
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichasmb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichasmb.inf
        • Size 3KB
        • SHA256 879e7ed7455e2119f807cbdd7ffe6ba6bca924dc0e7dae755ed14ca2b3e8e215
        • MD5 SHA1 SHA512 TLSH

        ichausb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichausb.cat
        • Size 14KB
        • SHA256 249a9ae78bfed4cf0bf8770b16e0fde9a83b6756fb07ce66865baf8e2234b4d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichausb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichausb.inf
        • Size 8KB
        • SHA256 ddf359e8152d4ccb8923bd2125d3ca253cbac8536d2b363fdb3e10cfc94408ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ichxdev.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ichxdev.cat
        • Size 10KB
        • SHA256 a9d7c45c86ebdc67897de75de976fa2d58e5b0c64f0328303d0fabc93f26a723
        • MD5 SHA1 SHA512 SSDEEP TLSH

        intelcpu.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\intelcpu.cat
        • Size 10KB
        • SHA256 8798c9a7b5f0a182a467df112a52cb27daf460e0cf05b40c7b08c8f1f4fb71b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        intelioh.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\intelioh.cat
        • Size 15KB
        • SHA256 edd2fb40868a1b068a1ff17cb84f1c022e7f60ab84b1c82b20bd71bd0c8f781a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ioatdma.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ioatdma.cat
        • Size 15KB
        • SHA256 b1214f7cd9d5a5c80c87745f87f5c4f404401577fe38bfe124408e5a0f145bee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ioatdma.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\ioatdma.inf
        • Size 2KB
        • SHA256 8385b95c96c61400840694e0179ecc37882c5a71e42be753231b1c90d4e9f32e
        • MD5 SHA1 SHA512 TLSH

        pm45gm45.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\pm45gm45.cat
        • Size 10KB
        • SHA256 e55700ae633f5c3e13a4acafcc16554bfaa3b503619aad10d937dd32f0ec8891
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pm45gm45.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\pm45gm45.inf
        • Size 3KB
        • SHA256 8895e7bf2a86028c83c5b2f818975ea35ec4dfc6e3cbea8f7e21c250b7ad9e99
        • MD5 SHA1 SHA512 TLSH

        qd3nodrv.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\qd3nodrv.cat
        • Size 15KB
        • SHA256 db44f90daf9c2f86b5dfa5151961137504ff4f9b62b095a98534fd2330bd4be8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qd3nodrv.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\qd3nodrv.inf
        • Size 5KB
        • SHA256 92072c7141376019bae177b3b28c48c313454eb76d181c30334111daff4fe2cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        whed_dev.cat

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\whed_dev.cat
        • Size 10KB
        • SHA256 4823c5747e5255466749c81e96b28741164ca967e04546cbe93a5196457a77af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        whed_dev.inf

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx2\Vista\whed_dev.inf
        • Size 2KB
        • SHA256 3ede54dc82e45fea64da6e36c763cc7e77ceaacb632deb37805c995b39c84906
        • MD5 SHA1 SHA512 TLSH

        packmanara.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\ARA\packmanara.dll
        • Size 28KB
        • SHA256 243f16cfa112e9fa30a1659c05ead4bf743d368354dbed9f4afb2409ddb1668b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanchs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\CHS\packmanchs.dll
        • Size 28KB
        • SHA256 f55fa490a73b878a509d66d741883a757104fbca8ed090efeabee877de8d9a85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmancht.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\CHT\packmancht.dll
        • Size 28KB
        • SHA256 0caf9fd0be1f18ab8ebb27f997c9b46c1a8d6947b8cef57097fe19ddf41cfd64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmancsy.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\CSY\packmancsy.dll
        • Size 28KB
        • SHA256 61fe9d63b9993d4822375ae334683f451302394620d16ace01b9314024dd8612
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmandan.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\DAN\packmandan.dll
        • Size 28KB
        • SHA256 2eea6d176ba550b6dfc4589f44ae41320f1851234b91651de645421030778ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmandeu.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\DEU\packmandeu.dll
        • Size 28KB
        • SHA256 82a4706b6265d4afd0630775f6aeaf76cd007f19adb3dc8174b832c3dd83ac5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\ELL\packmanell.dll
        • Size 28KB
        • SHA256 f282f45b42dd7583f3b3bf5e389ea6081f5bc59a43aee3a6e8686a2a9cef6f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanenu.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\ENU\packmanenu.dll
        • Size 28KB
        • SHA256 8ccdcf0afc61dff2bb8c7ab6d332e9180f91a8c56424eebbf8f356a6527cc7f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanesp.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\ESP\packmanesp.dll
        • Size 28KB
        • SHA256 785cd790d58a7783055007d5cff8aa0abe30362af1676901e4ea04acb9e2536b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanfin.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\FIN\packmanfin.dll
        • Size 28KB
        • SHA256 6dd34676e9bb85799efd0de90d2474a518ce01516590f3483616e7f983b892f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanfra.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\FRA\packmanfra.dll
        • Size 28KB
        • SHA256 445cfe9fc4b8831031b26867ffde00d80c7eba93c032690b9c2fcd9f5ced876a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanheb.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\HEB\packmanheb.dll
        • Size 28KB
        • SHA256 e7e21523460249e08535d3375c2abe5a613d1948522c3d6e26ec371cdb0ee809
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanhun.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\HUN\packmanhun.dll
        • Size 28KB
        • SHA256 bf1411318cfbbbf9c28f9604d7642c317f3fecc2290f6b2f974bd09f0e9469ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanita.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\ITA\packmanita.dll
        • Size 28KB
        • SHA256 86bca5eed21d80a9f425b1a9c208727cbeef7371a57b14ad971328fea5c79ada
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanjpn.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\JPN\packmanjpn.dll
        • Size 28KB
        • SHA256 8e1634af2b86451cbbb0913e5c517de10c7bd0bb51e44117a06d8b37dd289d6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmankor.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\KOR\packmankor.dll
        • Size 28KB
        • SHA256 3ab2d4ac221270cbd26d415aae524067d8d36d58cccdea170d1b1392aa390e59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmannld.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\NLD\packmannld.dll
        • Size 28KB
        • SHA256 5a7adbf88bb3ef6ec23664b25dd765498288ba88ed6ebd67a8e665e7b71addae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmannor.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\NOR\packmannor.dll
        • Size 28KB
        • SHA256 c044e55f52d8337d0976ba5aec57292c0c217098e7786836ed48257cfea23835
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanplk.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\PLK\packmanplk.dll
        • Size 28KB
        • SHA256 ad7d3e43b9cab94efc353041b485294a1735bbea56edb4856297d88e96132164
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanptb.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\PTB\packmanptb.dll
        • Size 28KB
        • SHA256 b0e999c4c3edc34ae2f2de08d3834ac3c8f93682a239abec133b2fdd5460cf52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanptg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\PTG\packmanptg.dll
        • Size 28KB
        • SHA256 bda8249b414bacb1c7d69729ee8d85b6aa327ac0a3168c963588afd5fabef796
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanrus.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\RUS\packmanrus.dll
        • Size 28KB
        • SHA256 8c3c93f072ba07b1428da2565ee328fd9c8cb4837dabdd57bac62dcc6dc2d9d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmansky.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\SKY\packmansky.dll
        • Size 28KB
        • SHA256 38fbc58a2985c00968786c82d734665037c5ce4f879783493227fdd9e4b2baef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmanslv.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\SLV\packmanslv.dll
        • Size 28KB
        • SHA256 42d1bb2ad498f48f9f6078ab42796355419f0a9c35a6942ab5cb27e39e357073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmansve.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\SVE\packmansve.dll
        • Size 28KB
        • SHA256 4d9ae4d6486024987865298aef94268584dd1abc1fc0a74cf0e54543d1b15513
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmantha.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\THA\packmantha.dll
        • Size 28KB
        • SHA256 fe29068f573ab6c7f20c30e380df111860d17a9829e719d387f9fce3495a012f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        packmantrk.dll

        • Path C:\Users\Admin\AppData\Local\Temp\IPMx3\Lang\PackMan\TRK\packmantrk.dll
        • Size 28KB
        • SHA256 b455c919d5ab30c7c0c1483fdb6e9551e14437ed90b07a7c5159da12419f1123
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/624-204-0x0000000000400000-0x0000000000774000-memory.dmp

        memory/624-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

        memory/624-0-0x0000000002530000-0x0000000002531000-memory.dmp

        memory/1088-4088-0x00007FFA98E80000-0x00007FFA98E90000-memory.dmp

        memory/1088-4089-0x00007FFA98E80000-0x00007FFA98E90000-memory.dmp

        memory/1088-4084-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4085-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4086-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4087-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4132-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4083-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4134-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4133-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1088-4135-0x00007FFA9B440000-0x00007FFA9B450000-memory.dmp

        memory/1204-4082-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/1204-4136-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/1204-4137-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/1204-4157-0x0000000000400000-0x00000000004C2000-memory.dmp

        memory/5744-298-0x0000000000400000-0x00000000004C2000-memory.dmp