Malware Analysis Report

2025-04-13 11:32

Sample ID 220622-g5y1fsbgb2
Target 2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb
SHA256 2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb
Tags
cryptbot discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb

Threat Level: Known bad

The file 2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb was found to be: Known bad.

Malicious Activity Summary

cryptbot discovery spyware stealer

CryptBot

CryptBot Payload

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Checks installed software on the system

Enumerates physical storage devices

Runs ping.exe

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-22 06:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-22 06:23

Reported

2022-06-22 06:29

Platform

win7-20220414-en

Max time kernel

90s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1440 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 1772 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1772 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1772 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1772 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1720 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1720 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1720 wrote to memory of 2012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1720 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 1720 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 1720 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 1720 wrote to memory of 1788 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 1720 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1720 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1720 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1720 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1788 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 1788 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 1788 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 1788 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

Processes

C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe

"C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo Tmqp

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Ebbene.tif

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^olbWzuGsDjNJLqKVecIMawnynPQVOOEbgFuctWvIrlmMslNTQrohAawuLanDfKDOHfxyTfQuZqIoCLOheXyLGsXWEqJMbSazHKyeQHZBjwg$" Ricomincia.ppsm

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

Per.exe.com o

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 30

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com o

Network

Country Destination Domain Proto
US 8.8.8.8:53 rIuHfARGLbxXDnErvjKcKo.rIuHfARGLbxXDnErvjKcKo udp

Files

memory/1440-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

memory/1768-55-0x0000000000000000-mapping.dmp

memory/1772-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Ebbene.tif

MD5 37d64db57fd752986e622543824e0725
SHA1 b60b7fed41991144e1ebad4b39b2412a36fa195c
SHA256 36e19eb1e5d62ada20ffe19e391429cba8d8d8dae5049efa0e48e7e542782d78
SHA512 74f916e1ff9bce2bb420ab5505d9828e64a3d4e23cb97d3043a7a3378d92ef11e031ed186246135409102d4bdc35929d652e8c30b7445f896cdee7082b058b50

memory/1720-58-0x0000000000000000-mapping.dmp

memory/2012-59-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Ricomincia.ppsm

MD5 773ac9dd64caeec02da29baa94ed9d46
SHA1 7a03637337ef579e1d3c48c451e07fee4b5b40df
SHA256 e810ef8c05059226d79d8b780d4aa8e79f37344a82005e5abcaf02ff5b22cdc0
SHA512 9247f617380c38a3914c667cf0695a0c6707408184f6bb3a387df55b35cbd7be1e10c6062c62ae0b0ff36d7c3ddf1f7565d8c041aeec34b71898f27aa30d4e73

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Ora.wbk

MD5 1075d9c9ddc5021e95c8f81a8410d29b
SHA1 5e071d8362ef3d46779d761969e82055385a9ae4
SHA256 596b2e47f3cd2b9cb75cf1ed1eeec58f0564eb8c6e8d64cb3610b0ae2d80ec2f
SHA512 f611d1ccdb87a12315567e491b59e36127017c92791cd89b77f681d520ce6d6b2972701daea39204e15539b65452c0b5e887af559b683d328e325415327ff993

\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

memory/1788-63-0x0000000000000000-mapping.dmp

memory/1484-65-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\o

MD5 1075d9c9ddc5021e95c8f81a8410d29b
SHA1 5e071d8362ef3d46779d761969e82055385a9ae4
SHA256 596b2e47f3cd2b9cb75cf1ed1eeec58f0564eb8c6e8d64cb3610b0ae2d80ec2f
SHA512 f611d1ccdb87a12315567e491b59e36127017c92791cd89b77f681d520ce6d6b2972701daea39204e15539b65452c0b5e887af559b683d328e325415327ff993

memory/1016-68-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Grado.pst

MD5 bad56ae474914adabb5dc6809e3f5dd1
SHA1 cf6165513ed373d5ad5ebeb1cb4ddf417bdc17dd
SHA256 02eb64fc3ba40f3774a6fde8c0dcfc50bb9c34d83391f907271fcaff58814223
SHA512 6b283363c60d8030a72629e6aa9ba355346e28bf736a10fbd2dc8e9b74ac1ffb45918125cc81e1929a1a8194e298676e614d5661addbab39a3461173b4ba9e81

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-22 06:23

Reported

2022-06-22 06:29

Platform

win10v2004-20220414-en

Max time kernel

186s

Max time network

184s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe"

Signatures

CryptBot

spyware stealer cryptbot

CryptBot Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3696 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 3696 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 3696 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 3696 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 3696 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 3696 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe C:\Windows\SysWOW64\cmd.exe
PID 4104 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4104 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4104 wrote to memory of 2360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2360 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2360 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2360 wrote to memory of 4500 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 2360 wrote to memory of 4500 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 2360 wrote to memory of 4500 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 2360 wrote to memory of 4432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2360 wrote to memory of 4432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2360 wrote to memory of 4432 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4500 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 4500 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com
PID 4500 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

Processes

C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe

"C:\Users\Admin\AppData\Local\Temp\2ee6c1d5b61c10718061d22bfcaf956d3bfdf9dce64b7e7fe026403bb95881eb.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo Tmqp

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Ebbene.tif

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^olbWzuGsDjNJLqKVecIMawnynPQVOOEbgFuctWvIrlmMslNTQrohAawuLanDfKDOHfxyTfQuZqIoCLOheXyLGsXWEqJMbSazHKyeQHZBjwg$" Ricomincia.ppsm

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

Per.exe.com o

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 30

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com o

Network

Country Destination Domain Proto
US 20.189.173.7:443 tcp
US 8.8.8.8:53 rIuHfARGLbxXDnErvjKcKo.rIuHfARGLbxXDnErvjKcKo udp

Files

memory/4676-130-0x0000000000000000-mapping.dmp

memory/4104-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Ebbene.tif

MD5 37d64db57fd752986e622543824e0725
SHA1 b60b7fed41991144e1ebad4b39b2412a36fa195c
SHA256 36e19eb1e5d62ada20ffe19e391429cba8d8d8dae5049efa0e48e7e542782d78
SHA512 74f916e1ff9bce2bb420ab5505d9828e64a3d4e23cb97d3043a7a3378d92ef11e031ed186246135409102d4bdc35929d652e8c30b7445f896cdee7082b058b50

memory/2360-133-0x0000000000000000-mapping.dmp

memory/3712-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Ricomincia.ppsm

MD5 773ac9dd64caeec02da29baa94ed9d46
SHA1 7a03637337ef579e1d3c48c451e07fee4b5b40df
SHA256 e810ef8c05059226d79d8b780d4aa8e79f37344a82005e5abcaf02ff5b22cdc0
SHA512 9247f617380c38a3914c667cf0695a0c6707408184f6bb3a387df55b35cbd7be1e10c6062c62ae0b0ff36d7c3ddf1f7565d8c041aeec34b71898f27aa30d4e73

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Ora.wbk

MD5 1075d9c9ddc5021e95c8f81a8410d29b
SHA1 5e071d8362ef3d46779d761969e82055385a9ae4
SHA256 596b2e47f3cd2b9cb75cf1ed1eeec58f0564eb8c6e8d64cb3610b0ae2d80ec2f
SHA512 f611d1ccdb87a12315567e491b59e36127017c92791cd89b77f681d520ce6d6b2972701daea39204e15539b65452c0b5e887af559b683d328e325415327ff993

memory/4500-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\o

MD5 1075d9c9ddc5021e95c8f81a8410d29b
SHA1 5e071d8362ef3d46779d761969e82055385a9ae4
SHA256 596b2e47f3cd2b9cb75cf1ed1eeec58f0564eb8c6e8d64cb3610b0ae2d80ec2f
SHA512 f611d1ccdb87a12315567e491b59e36127017c92791cd89b77f681d520ce6d6b2972701daea39204e15539b65452c0b5e887af559b683d328e325415327ff993

memory/4432-139-0x0000000000000000-mapping.dmp

memory/4372-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Per.exe.com

MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

C:\Users\Admin\AppData\Roaming\xWyktprslGXXCcoEzi\Grado.pst

MD5 bad56ae474914adabb5dc6809e3f5dd1
SHA1 cf6165513ed373d5ad5ebeb1cb4ddf417bdc17dd
SHA256 02eb64fc3ba40f3774a6fde8c0dcfc50bb9c34d83391f907271fcaff58814223
SHA512 6b283363c60d8030a72629e6aa9ba355346e28bf736a10fbd2dc8e9b74ac1ffb45918125cc81e1929a1a8194e298676e614d5661addbab39a3461173b4ba9e81

memory/4372-147-0x0000000004650000-0x0000000004A83000-memory.dmp

memory/4372-148-0x0000000004650000-0x0000000004A83000-memory.dmp