Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 06:43

General

  • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  • Size 977KB
  • Sample261014-hg28msg171
  • SHA256 16726a5322f5b86db8fe6c0a5d510b20db3deae2009e7374bba6854133174b55
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • HackUSed

C2
  • hackused.zapto.org:8090

Mutex
  • ***Estupidoo***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    franxd

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3264
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Extracted\server1.exe
          "C:\Extracted\server1.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Extracted\server1.exe
            "C:\Extracted\server1.exe"
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5880
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • System Location Discovery: System Language Discovery
              PID:3692
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:3116
              • C:\Extracted\server1.exe
                "C:\Extracted\server1.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1848
                • C:\dir\install\install\server.exe
                  "C:\dir\install\install\server.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1356
                  • C:\dir\install\install\server.exe
                    "C:\dir\install\install\server.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:1104
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 532
                      8⤵
                      • Program crash
                      PID:4356
          • C:\Extracted\Kernel Detective.exe
            "C:\Extracted\Kernel Detective.exe"
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4792
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 836
              4⤵
              • Program crash
              PID:1880
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 1104
        1⤵
          PID:936
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4792 -ip 4792
          1⤵
            PID:2732

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Kernel Detective.exe

                • Path C:\Extracted\Kernel Detective.exe
                • Size 253KB
                • SHA256 b98d6fad7ff58cbd4e5e7b4c68f9868525e2c7779bf0aa8a7de0864b72e610bc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                server1.exe

                • Path C:\Extracted\server1.exe
                • Size 942KB
                • SHA256 c4dad12bbfa20e8aea82f329ee57c5db3b9d0ecbbbf6182103e661854478ce8a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                UuU.uUu

                • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                • Size 8B
                • SHA256 898cde9160f6bfdffc1120b5c1cce821b1670e0f413c2f37fb6745596d097b2f
                • MD5 SHA1 SHA512

                XX--XX--XX.txt

                • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                • Size 229KB
                • SHA256 f7f0d9bff8eca0e11a332a5a4714342b10c70135a03e31b7e520e13cd46aeab2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f3299afd8ef7ce098e60451e2e44e1c63028e57dd68434d8e87ba2685453daaf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e9c031f851b92fbae7214a5e69c1f8c59896c7c1b8752bf1ea11f5ee9626a99b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a1dd8c018fc62d2b2c55169cfad25266c5fd411b85ff23c97bcf0a92cb0bc9ac
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cd0f3b350be848ab4647c8642fe95c590e93470846f102bc4ebf31189e3ea80f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5bf2bd4afcc559b7e7eebec79a0087d2e9075fd31ba345bf6669b6e7318e65d2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4204c74cbee813930c1614e2b91282fc0199e6954124f2b0f6008f8d345fbb4c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6c7137e1439fd3e7c00f7f8e69e08d695eea8268be7fa811b353f5e197dd81a9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 10b65479d2c5db9f345a7d0863d978c71f333f61d7f343f7d84fb469d484aec0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 035fb191aee08145438a186e7e00fbe1670b8d9a64f6e714a95f02cab6ab7d37
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a65d99550073666cc61d04459a8826f0a9b652ce08504286259feccb7ad33ff4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5c7bec50b2d94ab042306c7b7771a5ed906f87f2e85cd0de708a8b6703f8e9fd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e557cef7ac40e8cea815b89186390f834bbf974455383250246edf706f2037b5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1aeb5a3e3006dde0472c1367db1f710f7fb11832ef7f6cb11e62ebe8d6736e3b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1be335e733204e55583547d290e87256faebdc7cae962695e941b1ba2ed89432
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6322ece564ad776337caa52eb45aca9c6ec3efbd4267d41a4ae61d558d4bc28a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bed6d6ba229c49eaeec78be0bec0b1da22ed9a1d4480a2c465714be47d3f722a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7a8a3b1340ea30dcd9fd2001d868e5b5b7c3e2aea1572ec5b70dbc14c45ba3ab
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b487be86945a28105e23d08f994ffe953cda1526cfbcc3ec9406a647c2585161
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f623d4b56bd7674122c6638ee180ac8856f20343ed59cf2fedcfccae674b94a4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f9cf11b37062bfafef02b823ee210b18273f1ab4c0d5908f70806406b4bf974a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 89dd84e2df631a82aa94d6af357ed140fd59e12012a72e2cab59f4556fb8242e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 77508fc8f40a0f4c8e80f05cb2a82bb66cc62f553e81ed5f793584e90728ed1d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8d8d9691c0f720f8a1e8e0241d013865877fde0948b1e17884be23bf678876ba
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9e3877f51596e90f8f4ba819acb9b4e36de5db21ec24cc8a7a1982f2c39e22a2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 88f0e071c82e8123d34bf50eb4797d9c744f1774c298d8463946d8210a963610
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b4982e38115e57091926c2eb966394bad3a9b737452b3d4442a67ec847d022b0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0498784446e65d9c7bf5a02cf6fafe4e0fb295189ef957e40eb7cd9d2199b4a7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4ddb92ed7e43b2a194e0912e41f788f3a8ae29ddfdded4db985b5ef40dcd2c73
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 93e171a792bfb5009ff56a72d75b89852d9446684ccaff186bc7b2dbed7a4990
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 021042df43dbdbfd62bd50379839ea5518dded60cfd79c9f5ab105489e7c9492
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5fa70089d37e1cdc183578cf92e59f88c0a26bfdf038c8e6ff013a237d75f75d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c5ae085cd6fb663ca7ceb4896b4d6c54e89862f4d78b8e69e97e8cc722a4d982
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 627747a5acc1481f417362734bb8eb89f1561605eeca8ca9a0a38867be3c9f92
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dd4fae906cdf2c854dc0fc91027c729ed0f3d7ba0812c831ed087580b69a0e07
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1bd9a36e0840a84d8517aa0a2dd2b91c414cce3835c8d45715905566f9087937
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 03dd0dd85b2916ea26ab1ea237d14c7a9a4e94ff101da8d9508de2aa0cfd9062
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9573e59fc013b4e77aff8c64b96e604403ecf716c7e711aefa882ff38dc6918e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 67ebd3d8b275cbecab7088b81872d28b48c730bb10d8c6917f75795a28a4e04a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 67264541e8b16db94667d2c749208f7fba1bb9ae79bf6ba1f9dbcc052c9b1d8c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 be731c483489f572a03c276f108dbcd3bb925fbfea53e06f455637d13f2111bd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bfd67103fc13ffd31185cd4f63e61054624e127b2056022f3fcec6900781961f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2d8a21491cffc5af1d0fd5762f2349c02e20ba89e9c5581b2da776873e4f348a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c0a333b7cc6cfed64e087fd5bc99c126439c31c1815a63271797d7d6f272bf87
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b3373658e8065a874c9997df029ca65e97424c34d92278cd54b9a5392b2fa17a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ae53930a75529b734e2280a09abe4352932417839b997fe0b01040e7a056107a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 17bbf617fa978ffc8420d18cc62bf586cae8dd622b8db18ab88a41da1578394d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f3de6ce1553a34acbebbefbacff5d774d202cd083764a669e541fd8709c79334
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6c998f02486ce06ae5dbdbed24e51df75c4441547d1f0b69ed6179f406e5fac3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bf5275c18977ec134bf4e52f3072857a77674de079ec6a4ce6c877dea9adafb5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 daad9fea76b07a6a8684a165f52d5fa67f557d45ca0bfa7bb6edd2c286afdba7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ace4363a8e0376fa598b18973d5d6740ecf4661edf012f89d02916a90fb9e841
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 946a39ef044f8a7ec01454b1e3867604afd91c27da3c813de408091d350274f8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7aac54018c422bfb1a717bc3c6c002ebf9f3dbc10e7fa38b362badef06d0af37
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 985c982f3dc97e164a46d93585c8689821d98250712dc7cf05968043f97c165f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b7d4702090f1cfb7a342a5610e981d2f11dc687d4c10c01c82ba337e761aa32f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 85c3bb6023a714d21e6566bf953bf8443a569d06ba1238bf21731dab034ae074
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c77df49d5c3e4b35e061243d8abd113a0f1b64a93c3778f156910799a4e0ee6d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 04e76b01b3e1640427679dcdfe86746f63bb044484874776230bbb9bba4c11f9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2a45c8550d966a423fbcc7b0eac68d3b289780897b34bc57c5c6bc739fde0ccc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b9a33f44c79728a67c086d2f55db63fcece7a38e4cb81d20ab7e67940ab9dad2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b99eb7240b5f760395de61e6bfe9a09bc6640b780da954068b540ebdf964945a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 003e6d811cf53eaacac387706ecd85c4c445abff4e83f66f20f056e1844c66e6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1b737ccf089e5b33b12f335ae6aa35e4e5a1e987e17568f16975a18d498c2090
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4c9e10c30791a1c4ae132f93202b6f7a08e56278eae35c71fb7a7f739aa522b8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 31bb92aa1d6017b2f086a1d43b7b7d696835d3e3f886f08b06033dbe26ba168a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bc5015d6c6936c58ec03195f8363a55e7e3213b2447527c0343077b2091f40bc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5c1cc5232177f84912394bcc50e160748a51064b4704212ea31dec056e59ec4b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c32c1f1c4a32f3763ac7ba786f6eeea0b0384bff339f982cbb0721f87df754d7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 77555ddac6ddd5efe5d3917722de4cd82c15f2991e0524e510bf4c309780fb49
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7c6b747a01dfa98df727095298670d1ed1eab551307cc6abd436a670d033796b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e16d7bb319851925827deb672e9c7a284a7ae506e20a29021327cbfc7d826772
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cf2fc9917218e082d38938f1f4820ca87d1ed416ec297279727a8716a515e60b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 62689819c74d5183a96b294ed2a74591f073e986b9bce4f06ac950331ae0d172
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c3f4971d41ac583a4c484b46ffd5f1ef5ac993a9ab2295be6083a3221e52d163
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 429897ceffa282db7ee2816b0ee70e48f35ed37039035a495efc833bad5697d5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bdd3493cb23e7d0be96868476b94ade998680f428be02472a33ff95c6513e719
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f35296fd2bdbd237bdf6ae862853e54d05de071b8182d0fd1d390e4a0cd7edec
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 14e7b3ff1c4b5824ddb2393204e46d2aec69a0a8928493afd4c62c7d8ce33e96
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 994a47676c3e455b3fc109d27c798ca1a35969f3e2aa07c6cc792f859099de67
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cba1a0cd7ce99f033a3391e41409d3c205a9aba4f7b40033bdd90ee7eecd46c1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f0249ffd8a06e08235861122053fb1c63915d5518f8a0bf7cc47e36158b28538
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0549d954ed8b6144520c35a334d10161c4f68a666ea4c6b00cf60d1e12346378
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b004a82fc745d253e76a73f8a3366b13c4f72f4b994a9abb200d8711796b472a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fed2cceb71ffbc37113d26cc5a2c5cb684d12e9a4b122ce888a8724982108454
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9566a7fd415ea6469aa2e294b62924cc56cd69d1c113b7a2c518262c0728c3aa
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d13e615a6a817a285c6f4710fdbc8b608298360fa1a96f7179aaaea12ca8dc9e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 96ec9563fd120e423d512e3e6e870418548928d304898d974e8633cfd24ca9cd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6efd5219546562f5dcf90c38264b3260cf472d03cfdd682c0e4d9e5d98a92284
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a4d9bdb8a90c95be69c8e2d5a1004fff238dba25f03defc12a46e01136dfc49e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 25fae0e052c75aca302afe9052632d74de8dba9ffe5d91b27fe4092b1a1f43df
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 32b02faee9526b4fa3c3b1e002d2d0c65945ca5181cb232c80420815a09bfb1e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 95e75c8a23c68d80218fa6c10b80df80bcff61544f957d03cc989e4b68a7e791
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8eb5e1180b182709e51533b9f54387f898e5daaa20dc4a7b9c62e96fb849f4ed
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 106e0dc4d46bf5bc7e7872f70b33232d3685f5991bf00ad2b7c15c6a3752f73b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 26979036f66f8505a57b9d76d31dba9bc3ba225549d02debdc860a1d5b37f3f1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 840ba0f3570d3e7cfc98137151df1cb0e81473ae0687ec1c9f183f9d2d3d1539
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e7d9ff75f0aab8fc3a6c423f2a8cec62d3c8cfc7dbaee70d572d4d69efc3464d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 da9a08cea893e968945c7da64fa4425e7831bffa3129eac6370fb5b90ee31b66
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8f2acb53fd4f541cf5cce556e205fa6e9fbefe91e7ef7e11798e652bbe7bffc4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0341b12a9873e47b7ff4bdf8f8f23b1406df24050f5388ce257655a22dc2d3d2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 75f833d3679961c7a3d0bd99d9236f64b0e14fe9d36af8f40d516604657744be
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1fa76ae24d8ae27990997890328a3cdb75c5058311d6f3d78456363a8878001b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ac8c0afdcd34db0548f187a5975b7231f640d650bbed2ae9f233c393b4bd9dc1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 61182169692942f6113e241505a9a41e0e08dd9519930dd7a345998ae06222b9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d46f307aa9d9647fe461b5d748eea3cf60e3be43869dccf7d0a018266e8c7f7e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d3d48fa45ca3c1633913009ff707cc0e513f32fd87971d5719236646abcd2c82
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e294728a864aaf5d2b675fc1f2c4927392059e5fcd8b96a1078e431f6d2a3af1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 835f56b10c20f4526783c7aae500780bf1f6bccbb261f3e21e6edc2b66a0d262
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 61460652828ec2bf42e37509d118327087bf43ec60b7ae5fbcd24a72350992e5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 be5359d36d897955a0628785bd67c8d7304b59a2d05dc67f075d46f3268ce6c6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c863357c5a5d4d34886e408c31dcb6051af03045a4fa4853fdead677d2c47dfa
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f4eb3ab9e5b42890a52853dfe11a74e03fc383da9e4f34c5d99e06d4fb7802be
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 67ce37a5cf659cc85f4175f4f8a8ccdb0cb6e8c6f5707f4c789d5372b7e9835c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e156df6f9ca0fc7a30eb9533ad8a554b5bf3f27846297fb4e0eb81823ad690f3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 61c5843d602ca545a83fed8b21d4b0f43738f8827e5ebf77b92b12f4fd195f27
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b60575993e9e663e131ba7b797d0709dfbebce15f17f4719c04c682cb37f94cb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b08b0d66301e535954a08cb035930cf96a6aed493c18856d493317c09012b55b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 671e796f7cd2a19a6d1fe61d1090bf692bf2a7649fbd6f43bbf8d15cc238a0e7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c01fcae11ab35a83c1c858247e7ae8b30de226130dbb24c97dccab27ab3c7737
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a304feaae6eeca480169e63a2a3e278b1ae900a11fb9648c257ee1c7682365d9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bc6fe5395216e312bf66cbc640d691050cdc705377de28a948c325cb9b5888de
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 173dc2713426b3a2cefded853135143d1c46c96dad70c7aaf945afa2f81c1937
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 66f6de5eb370b7d5fe9ca6f6272935a55ad8b50f9a354f345e16bada0759b933
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8ac5fa36493ec8b9f42c8d664a1f5c5e84335d4792382f71dc0010f930b07106
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 995e74669bffede4fbb6ac51489f464fc16e67e5209a5960bd291c6060684231
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0611359bab2a8a922808e68755eaad55774fa454e5f3c596f662ccfd8e548fa7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f57bf0e68eb2134ba02dc1fdba1ddb6f652e1a4c80567d4437c58aef04a4308d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2b87e4397453db65e7ed3300468b2a5c6e6c694358b0d2523073582ab6b4c54e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 08dfeb2ad3b133b3b5ef22f064b892f4f18e671dd61be56dc013755831f42875
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dab16441fbebec7d3c66a2c2286409f8f74dccd6dd058477cd1a8005bf93b46f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4422f790909e4b2370943e23f697e137c02705198e377b7a5b5db709652fba34
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0d25647d574d3a947294b9c4b5a927258db57b10a28fe5d444b5f7709e5de92a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bcb6061fdac717b7a515d6eb40addad4992fcd6b7ae47035fc7321e5c54f7554
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 420bb28691dc3092ccb3f9be65e1e6bdb18ebfc82c062cea2f3c53fa7ea09d9a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a87ba349545966ae278dacca67925e54e40b70792c4cc7d01fd7f6c2b1d76c79
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 accc327b7f135dfbcd4d508f90bbe69c51a6367d04a311547260b012bea2179b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b8dbf649e4d9fe03b192deaa55fb559260def2f1795a5a1247283ea241c088f1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 36d4c1eb5378231fe7d4f2c51aa30a4b493de18f915162392445a70810ec61c0
                • MD5 SHA1 SHA512

                sfx.ini

                • Path C:\Users\Admin\AppData\Local\Temp\sfx.ini
                • Size 206B
                • SHA256 cc12652dac484035a05ed6aa038c91d7d8105cedc45d9b7d5f69cb438d42e306
                • MD5 SHA1 SHA512 TLSH

                logs.dat

                • Path C:\Users\Admin\AppData\Roaming\logs.dat
                • Size 15B
                • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                • MD5 SHA1 SHA512

                memory/1104-212-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/1104-209-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/1104-210-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/1104-211-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/1848-186-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-183-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-188-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-195-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-196-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-197-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-200-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-202-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/1848-187-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/3692-52-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                memory/3692-111-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

                memory/3692-53-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                memory/3692-218-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/3692-113-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/3692-112-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4792-43-0x0000000000400000-0x000000000047E000-memory.dmp

                memory/4792-215-0x0000000000400000-0x000000000047E000-memory.dmp

                memory/4792-214-0x0000000000400000-0x000000000047E000-memory.dmp

                memory/5880-120-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/5880-108-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/5880-51-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/5880-116-0x00000000240F0000-0x0000000024152000-memory.dmp

                memory/5880-27-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/5880-178-0x0000000024160000-0x00000000241C2000-memory.dmp

                memory/5880-185-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/5880-48-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/5880-30-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/5880-33-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/5880-39-0x0000000000400000-0x0000000000457000-memory.dmp