Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/08/2026, 14:25

General

  • Target
    b3429d26e759d9c35017ffdc9be9e27b0fb32ad8aa06866fe5bd9e5811685390.exe
  • Size 4.0MB
  • Sample260828-rrf8laygra
  • SHA256 b3429d26e759d9c35017ffdc9be9e27b0fb32ad8aa06866fe5bd9e5811685390
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Nabucur

    Nabucur is a ransomware first seen in 2015.

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Renames multiple (160) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 7 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3429d26e759d9c35017ffdc9be9e27b0fb32ad8aa06866fe5bd9e5811685390.exe
    "C:\Users\Admin\AppData\Local\Temp\b3429d26e759d9c35017ffdc9be9e27b0fb32ad8aa06866fe5bd9e5811685390.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\ZGosEssY\mWEQUAsA.exe
      "C:\Users\Admin\ZGosEssY\mWEQUAsA.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1504
    • C:\ProgramData\dkEQIsYc\OmMYokws.exe
      "C:\ProgramData\dkEQIsYc\OmMYokws.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3952
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Optimizer-16.6.exe
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Users\Admin\AppData\Local\Temp\Optimizer-16.6.exe
        C:\Users\Admin\AppData\Local\Temp\Optimizer-16.6.exe
        3⤵
        • Executes dropped EXE
        PID:1788
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:2376
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:3556
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • System Location Discovery: System Language Discovery
      • Modifies registry key
      PID:3248
  • C:\ProgramData\sqEIQoIk\pSUAAgkM.exe
    C:\ProgramData\sqEIQoIk\pSUAAgkM.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    PID:1152
  • C:\ProgramData\dkEQIsYc\OmMYokws.exe
    C:\ProgramData\dkEQIsYc\OmMYokws.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:4184
  • C:\Users\Admin\ZGosEssY\mWEQUAsA.exe
    C:\Users\Admin\ZGosEssY\mWEQUAsA.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    PID:1072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        device.png.exe

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe
        • Size 1.6MB
        • SHA256 b3ef49723c551f598f669cbe68bb7dcc404777677340456efcce4267ea87f3aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RWAA.txt

        • Path C:\ProgramData\RWAA.txt
        • Size 11KB
        • SHA256 e3e7ce5f6a39c939e223bfad0084ab7f497cd2f55ff95215930fcb8ebd66287e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OmMYokws.exe

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.exe
        • Size 1.6MB
        • SHA256 cc57503cba901efc6308ced5d3b802b2b925ce789a1675c3d617dd30949a1191
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 f7dc8e7fc2854165a65306c95f3345a8d9479d304cef0e2e93afe825a200c67a
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 7ee6226f79ed3364f6e98b59e98cfa04d933aed1d903acd1d45129ee8c059e60
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 e79b6024ad23a967cd013ca6c6294e4a6b6edffac2a5303031c7ac2f3cfd3417
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 f089221cfe9b3875754b5e368a376e68521fb8281ff86cbb791f9299b2c1a4df
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 2035cde0c318eddce07e2bbc192e3820e18d88e6c19017b90bbba3dacb60e76b
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 47d0f9feca7cc8751c6b1541cf4a0349a70da9580202b4474e33b3cc40d80f24
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 7a3da878e289b29c0855e90d20111894da3a8ed7eb38ad17eb2cffa16d2ea500
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 a5e12711ee8dcab0bcdcf0763c1e5be39578410f4cef7172507e5928d64581d8
        • MD5 SHA1 SHA512

        OmMYokws.inf

        • Path C:\ProgramData\dkEQIsYc\OmMYokws.inf
        • Size 4B
        • SHA256 e2ba26741f4b3bb1d61fc4a03dcd42163692874843e3cae9ce2950bf65ead333
        • MD5 SHA1 SHA512

        pSUAAgkM.exe

        • Path C:\ProgramData\sqEIQoIk\pSUAAgkM.exe
        • Size 1.6MB
        • SHA256 f21c31948a5bda9aab056d1c8eba3cd364e8c0db7042161b395852b4fd2ef666
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AIIo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AIIo.exe
        • Size 2.0MB
        • SHA256 4d8d588f172075902a0014612e128a8516cff8cf90fd75d828b13df941559883
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AMQG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AMQG.exe
        • Size 2.8MB
        • SHA256 35f9aef15e6441e146a9818d2c0259e4971c2fabdc4fff96f487f69afacda27d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AMYa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AMYa.exe
        • Size 1.8MB
        • SHA256 0a00cb07eca3436202de4ff166221341542523cdc1815c91f1dc75e5a48ad147
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AScs.ico

        • Path C:\Users\Admin\AppData\Local\Temp\AScs.ico
        • Size 4KB
        • SHA256 be3e79875f3e84bab8ed51f6028b198f5e8472c60dcedf757af2e1bdf2aa5742
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AUMY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AUMY.exe
        • Size 1.8MB
        • SHA256 1928b73aac39d6f54fbc1e36dcf7254e809d23e8b93bcac1d5ec5666d4855cda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AUcs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AUcs.exe
        • Size 2.0MB
        • SHA256 5a99a96e06e687c1a608a251118502b763fb90a035ff907b0835f131f846c82b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AcQE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AcQE.exe
        • Size 1.7MB
        • SHA256 eb2838d1a37249943a323f301fb07171f88aa90c71398cd97550617af714b0e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AgEk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AgEk.exe
        • Size 1.6MB
        • SHA256 f4a7aea67a2823b21751fdc44c8bdc2a8644c97c167dd7ea59f46c42dff5e057
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Aows.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Aows.exe
        • Size 1.6MB
        • SHA256 de26cc10240532869aae2ec8da6414541966aa66734624517902a1a2fefe0f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AwoI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AwoI.exe
        • Size 1.6MB
        • SHA256 0fa28077ead156aaf5c0f041111eb85a4c3730988ab24eb725905fb17d645175
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AwsW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\AwsW.exe
        • Size 1.6MB
        • SHA256 98da735337c2aa4910581eaa31dcee3ce89e3c2e23daded67f0da012d0846e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Awwm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Awwm.exe
        • Size 1.8MB
        • SHA256 b1d73f59bfd06a3502d6cfa31d1d93404ff650d119a27db30421e0d2e8e246f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CEES.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CEES.exe
        • Size 2.2MB
        • SHA256 3460f0e0dbb468c03b620d0087e6af09699fe9274791b03e202015e9d94712ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CMoE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CMoE.exe
        • Size 1.6MB
        • SHA256 b0c02c9717f87644f1944673e59ff551563c5dee71540a79664aeec917e65c42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CQII.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CQII.exe
        • Size 1.6MB
        • SHA256 10d41ea75ce98dd213f56140c5477b1bfc631ee1c9fe9c0688b9c1351623f07a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CgkC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CgkC.exe
        • Size 1.7MB
        • SHA256 4a4d6973993a332bd3b505b76fe361bba5d667601c4c3a455e17faf502ec0031
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CkUU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CkUU.exe
        • Size 1.6MB
        • SHA256 fec60903d2e3d51fd5a4075eba8297c6b8d3be3d0fac99578ea8b11efb63dbaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CkkG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CkkG.exe
        • Size 1.6MB
        • SHA256 06b9e21f5efd3122511b713a38363fbb0e477857a7f8fc441b9d4cbff72c0bb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CwgS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\CwgS.exe
        • Size 1.6MB
        • SHA256 2179e293d7cdb8c04e4546ad87264d7e5f173593f5095b14bd66f771175d3bc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EAsy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EAsy.exe
        • Size 1.6MB
        • SHA256 b3dc68230a844515a287c6d7efd678dcdb971155ea5a827a4d891c3df5d29b4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EIMG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EIMG.exe
        • Size 1.6MB
        • SHA256 95a61b404731109be8b018970344870d1f7e939f8488f56b8fccb26ff9b99e01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EMgw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EMgw.exe
        • Size 1.6MB
        • SHA256 e6c1cae7ae49a8b8ffabce50b811da651129afba214b1ca74939bf6733e0236c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EUUi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EUUi.exe
        • Size 2.1MB
        • SHA256 6a0736b53d0c3e69fa5b68ee4f6eff32695f3953df94007f9ca74fd07c4e3f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EkYU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EkYU.exe
        • Size 1.8MB
        • SHA256 0e4d15f12e7ddb76f22ed9fbe1f7923670857b1c54236bd53f8d07ddfd1999e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EoQk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EoQk.exe
        • Size 1.6MB
        • SHA256 e8a59b3e3abba1e4e858457ba1ee0219cc64d52669ac4fd04f8c14a30b86142b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EsMy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EsMy.exe
        • Size 1.6MB
        • SHA256 b394cac7333f6a342d8ceb59e2d0652e588e4c0599d62b801eb9c052d9687e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EscA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\EscA.exe
        • Size 1.6MB
        • SHA256 5e499ebd392340973b09552d8036aef8717ac6e200feac83b445580c60729d80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Essy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Essy.exe
        • Size 1.8MB
        • SHA256 e9abb3673c94d967ade849fbe7d6db6956e7e85fae292dd5f74e5b397c31ae19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GEQg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GEQg.exe
        • Size 1.8MB
        • SHA256 a11665878e126367ee33c7e57a1a4de7a4c7ce606be8bd64aa6901fa85298924
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GMAk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GMAk.exe
        • Size 2.0MB
        • SHA256 10dbf3c0fe91b39f5de590dc8e8d96bc27140962e0d53ba51736c2bf58924a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GQAs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GQAs.exe
        • Size 1.6MB
        • SHA256 dcf2f891e36c85034f4c83604c34418ac6565bb133d66b4cbcb80a38648f7eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Gcwm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Gcwm.exe
        • Size 1.9MB
        • SHA256 c8fc0ef5a38ec255f677dc47ce1e8923c1faa24dfa17e125437e34653b125af2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GkEe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GkEe.exe
        • Size 3.1MB
        • SHA256 de4c4392ce032e0e90138c7ad216447fc343ad4446a730ebdd0cd10cec2a7b73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GsEi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\GsEi.exe
        • Size 2.2MB
        • SHA256 c23d4905ceca3bdbf543a8009de0c7a81e116af299b360757312110507903ef9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IAEy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IAEy.exe
        • Size 1.8MB
        • SHA256 0a373e3705b4c7b900163fd3aa1e222648ad4a3134a0b435cdcdd0f852ed32f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IIsY.ico

        • Path C:\Users\Admin\AppData\Local\Temp\IIsY.ico
        • Size 4KB
        • SHA256 0b945cd858463198a2319799f721202efb88f1b7273bc3726206f0bb272802f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IUQi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IUQi.exe
        • Size 1.6MB
        • SHA256 4798caf81919862c43825ec06037afac609301ee68e7c1e4cad9f618b65f6a05
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Iocu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Iocu.exe
        • Size 1.6MB
        • SHA256 f76d6b7a728749f567019eecd7057d39f92a95690639dcc8e7c9323a8b8da9b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IsgO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\IsgO.exe
        • Size 1.9MB
        • SHA256 8392492f5621a72fc2d4027e34821d31180202d7502eabb172df3325dac0976b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KAAs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KAAs.exe
        • Size 1.8MB
        • SHA256 abd7bb63bd524169b9c59382179951c20278b980602ae19ee89f228cee2acbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KIUY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KIUY.exe
        • Size 1.6MB
        • SHA256 6b6fdcbbab139074a9139f27931df745eb711746d41f3b410c2ba9129f458896
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KIYW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KIYW.exe
        • Size 1.9MB
        • SHA256 189cf339b6fd2c4cead7481dad1a57a496557f6cf38dfddd192a129b5c33ec6c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KMAw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KMAw.exe
        • Size 1.6MB
        • SHA256 74d07467a56a071904baf80b7ca21e984501a348dc2fc8d5259231dbd1972e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KMUw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KMUw.exe
        • Size 1.6MB
        • SHA256 250c4663a4481e804fc568812a235b2bb35dd71227e79e931eaec37c539523d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KQgw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KQgw.exe
        • Size 1.6MB
        • SHA256 40804adc47020da037a2d6a3c416856f2777a3157198040cba5449625851dfc6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KoIA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KoIA.exe
        • Size 1.6MB
        • SHA256 26c6aec6592fc1b42116c6eed39dc465f0c76f6eea90a070f78e6c5b4bbbbc51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KwUE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\KwUE.exe
        • Size 1.8MB
        • SHA256 69b1c1a957e85ca71c7e34404ac5cd2953422e43d2e74235d2d4edfc726c1589
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MQQG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MQQG.exe
        • Size 1.6MB
        • SHA256 78b5bbb6574e427d425c9cb26fef6fd7757571519818ef426dde1851df874c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MUQK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MUQK.exe
        • Size 1.7MB
        • SHA256 9e7e9e88af081a5583ce659be458d4fae6141c52c9e1c28021b62c1ecde772ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MUQM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MUQM.exe
        • Size 1.7MB
        • SHA256 7972f1616ae024705ebb7041cbd49e3c9d12f4266495ad6ed42fb2df5fae2b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MccA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MccA.exe
        • Size 1.9MB
        • SHA256 fdcc73671fea1599401ef41dd81dcbcaf7b9becb259dc3d96657c547ec0f905a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MkYc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MkYc.exe
        • Size 1.6MB
        • SHA256 f60ed689c949694e8ea153a8ba7c04293add41ed481860f9c39d90abae8030b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MkgQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MkgQ.exe
        • Size 1.7MB
        • SHA256 718d9977cb4f0aea757c3389c0089ae5e76a8f3bfe23f7c1466b1e347542736d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MoYg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MoYg.exe
        • Size 1.6MB
        • SHA256 19179160c1ee4760d4ed7eacb71e82c60772573e2073b7d6bb01b98062c8834a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MsQC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\MsQC.exe
        • Size 1.6MB
        • SHA256 8b80743f34f7e8e5f8f52ba174e816ba5273b1c802b4a95fb5f58a46b6d538a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OIYI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OIYI.exe
        • Size 1.8MB
        • SHA256 7081911c952aa84671419db0115ee3524bb8825dca713738ff8393eef0d992db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ogos.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ogos.exe
        • Size 1.6MB
        • SHA256 c926d1475d8705181fc83a134af154ace49e9bbe58f24bcd05e09d25ae8b4711
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ooww.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ooww.exe
        • Size 2.0MB
        • SHA256 15519223d904fd75a47d95e725fa7d4d2c16fe0d636148e130cda2811bf80d40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Optimizer-16.6.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Optimizer-16.6.exe
        • Size 2.4MB
        • SHA256 8b29c9349e7a814e30cce1cfb788f5a21740c798268b0a45ab805195faad9105
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OswY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\OswY.exe
        • Size 1.8MB
        • SHA256 fffba4865c9cc2ded45c4eeb0b5b07e63b23805f6b657e6d8005c9d2668d5e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QAEq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QAEq.exe
        • Size 1.7MB
        • SHA256 c061b1ca4fa2a81a52aa208c62cf052c12afbebc2ffd745d37e8e8b30bbd1678
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QIAK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QIAK.exe
        • Size 1.6MB
        • SHA256 74ec96f72fccebf9fb095f5dbcf11493d7206ae885389175b86b3f12208e2f86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QUcs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QUcs.exe
        • Size 1.7MB
        • SHA256 4b7e9b7fcd3a8c8022928c75e0f3fdae536afa57e86b916191435aedec29db98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QgYk.ico

        • Path C:\Users\Admin\AppData\Local\Temp\QgYk.ico
        • Size 4KB
        • SHA256 2dd714e9df3921b1194d3d890f6509ca5ee753d81f9fd83dbeec831440d22938
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QkAi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\QkAi.exe
        • Size 2.0MB
        • SHA256 de6ad9e77404e73e406877e35f638f645792e01dcf75a8d67e721f5dc434ef48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Qoww.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Qoww.exe
        • Size 1.6MB
        • SHA256 06f37e8fd70d7ff90fc5ac3001269dbe8b1e2dec39e251db8cae4ecd4eb2e928
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SMEq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SMEq.exe
        • Size 1.8MB
        • SHA256 571ee1f7cadb5e417fd8f61af16d1a7c9d2c1d43b39e36a2b074b25b2b08f57e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SUAO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SUAO.exe
        • Size 1.6MB
        • SHA256 12609cc0c537a97dddb817217b9a1501b5d37d4c6cf16b045d69ab16f1a26994
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SYwI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SYwI.exe
        • Size 1.6MB
        • SHA256 1181450f5063ed8d82dd6dbe6d9d46ed4e3891a8b49cee9f5b2fcc355c2aaabb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SYww.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SYww.exe
        • Size 1.6MB
        • SHA256 06a288a2a792f5ea8913ede800185150cdde6660a856c7c6a6e598b79ffac355
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ScIK.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ScIK.exe
        • Size 1.7MB
        • SHA256 9f135c436b6c70947e4e5325701532fd3175199a08bb9dfce49a869cba5cd30b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SoMo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\SoMo.exe
        • Size 1.8MB
        • SHA256 f12f411f7d2fa985baa6648b018b77e80a9e12c876fb41796eb110368d4388f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SyQo.ico

        • Path C:\Users\Admin\AppData\Local\Temp\SyQo.ico
        • Size 4KB
        • SHA256 9a233711400b52fc399d16bb7e3937772c44d7841a24a685467e19dfa57769d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UAQg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UAQg.exe
        • Size 2.0MB
        • SHA256 307bc8c23397b9fb107682ec65c960cc3ddfb08ffcfcb31d3ec12dd197da521a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UEMI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UEMI.exe
        • Size 1.6MB
        • SHA256 d85315915e162c4a2564e8135892b35f8ba0e3cf3687b72f3f3ea0d4d0909010
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIck.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UIck.exe
        • Size 2.2MB
        • SHA256 912a9c27e3e7ba2570c4ea45cfe84a0e1836eadc4faa50cb30e4dd733a0a240d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UIsU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UIsU.exe
        • Size 1.7MB
        • SHA256 b892ec84b09a838a2ae842cad3bae682fbe87adea43e73e63bb9cdb7e5d057a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UQEw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UQEw.exe
        • Size 2.1MB
        • SHA256 610da410221bac0d65ac52c356a4ca7878ed8ecb874f9c9bce30ca8e659a14c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UUcI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UUcI.exe
        • Size 1.8MB
        • SHA256 78223664c830013f94003872bfe33ff04105e9bba50e93c4c09f0cee7b59e847
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UcIO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UcIO.exe
        • Size 1.8MB
        • SHA256 14b712b004774f9e87fb420c6a91b683a7d24f112212726153f44ce8b0c2abbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UgwS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UgwS.exe
        • Size 1.6MB
        • SHA256 12d8e6e1e0c246c0d8f8a99fb3789460575d43c3cc4d22f4f75c39291ef10f47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Ugww.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Ugww.exe
        • Size 1.6MB
        • SHA256 cb8c734e114c03c2a94788bc31741b901167a02b91d8e81b128fd633c9c12109
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UwcI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\UwcI.exe
        • Size 1.9MB
        • SHA256 829711efaed18890c05269720ad91d9fc722edd5d64f019f27d140ed23e676f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WEQu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WEQu.exe
        • Size 1.6MB
        • SHA256 5f003ecb55ece3ba20f2a7784cd26d84cf77a879a13a58f0e67d9d6259a932d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WEkC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WEkC.exe
        • Size 1.6MB
        • SHA256 56cf317754ff3480649c6db80ae3823707a5c1866ce2b5a2fc00cef9af0171d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WMQa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WMQa.exe
        • Size 1.6MB
        • SHA256 0aabb0262046608535526c86d661fd493d67594c1c90854e994f6e361cde0e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WUAM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WUAM.exe
        • Size 1.6MB
        • SHA256 a38cd41c07502d723980cc95e59cfb28d3a32ec48837e6fd69ee32454ba2f1ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WUwk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WUwk.exe
        • Size 1.6MB
        • SHA256 c4693cff70c43863a7e40d671b6d951f44a2862d685e888358851f045da05b67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WgMw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WgMw.exe
        • Size 1.7MB
        • SHA256 3ae7cde63f2e5eb0567f9800cd87653ae8855b09273dc4c1117979108ed1b894
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WoMo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WoMo.exe
        • Size 2.2MB
        • SHA256 ecc853d95686dd729d058acba088a01eef36a957e537674c07ecc7d63c0b5f4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WwIS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WwIS.exe
        • Size 1.8MB
        • SHA256 a289cd7ba858612b6d93efbbc6761793cffeee71c312dcef05f07c9aa74096e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WwcS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\WwcS.exe
        • Size 1.9MB
        • SHA256 e27ed1b4275bcddb986f0b71d4a9ae0d98427ec9cb428ee77b7cdf5a836458f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YIoi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YIoi.exe
        • Size 1.6MB
        • SHA256 744b71ad861141f8bcfccd267df046a94a44a24ffa72fe040a6573a2d27d7496
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YUAu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YUAu.exe
        • Size 1.6MB
        • SHA256 3ab10f8323f0e15e109058824dadf12ba1553e9076762972850b8b88e1862800
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YYgI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YYgI.exe
        • Size 1.8MB
        • SHA256 fbef021b95738bd609b26ac0dea57ccc1c7469306b985d614b6a7b2c683f569e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YsAw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YsAw.exe
        • Size 1.7MB
        • SHA256 901438dbf0d227c40823a862f43fd55d710c2a8390d6d08dd86c990593523e72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YsUs.ico

        • Path C:\Users\Admin\AppData\Local\Temp\YsUs.ico
        • Size 4KB
        • SHA256 57e72b9591e318a17feb74efa1262e9222814ad872437094734295700f669563
        • MD5 SHA1 SHA512 SSDEEP TLSH

        YscQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\YscQ.exe
        • Size 1.6MB
        • SHA256 bfd80ca532e14446e6f3470d752a793b3141d61f5404565d5a3513fb68e64dca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aEww.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aEww.exe
        • Size 2.0MB
        • SHA256 ddeeb159ee0e15450750720b2c39bfd506334300b9091e6752b8f1ff021a007f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aIgo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aIgo.exe
        • Size 1.6MB
        • SHA256 78ffe9afa7a40667b8b108e5ffc6e55e6ad62b0e20196933ac1ee636d0fb3f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aMAM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aMAM.exe
        • Size 1.6MB
        • SHA256 a209f9b2cad2d89aee9a3a355efce2db010f5d6d18022d9accfaa1ed64530a8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aQsk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aQsk.exe
        • Size 1.6MB
        • SHA256 7c3ef57565579857661a81081194e033fb4645e6cad19d1780085f606ee6114c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aUAC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aUAC.exe
        • Size 1.6MB
        • SHA256 00a3fab7f65f101e878e66ffc25d2cd1719f4e0b2cc8df6b02213b0b5e4876e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aUQu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aUQu.exe
        • Size 1.7MB
        • SHA256 28e28ed5ab9df7dd084cbfda9fd5b02dec70d294c6fbeeeb102e25ba1ea30f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aUgS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aUgS.exe
        • Size 1.7MB
        • SHA256 2e3be9e367486da1da8a63ff2cba1c71f0cb5521cbe61a256418c98b6742c637
        • MD5 SHA1 SHA512 SSDEEP TLSH

        acsG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\acsG.exe
        • Size 1.6MB
        • SHA256 6783129361a857c6670b2ddeff301060b1830d8622a4fba3e211fdc93d37bac4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        agoe.exe

        • Path C:\Users\Admin\AppData\Local\Temp\agoe.exe
        • Size 1.6MB
        • SHA256 98f2f1e8259e9dd8f05739cd1e734ce3e51a44a47440442b97e3395cb1af35bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aksG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\aksG.exe
        • Size 2.0MB
        • SHA256 c882a7f9b13afd9b62c509d8b5855ad1a6cfc0df8b8f9e15538dcc3654af12c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        asUc.ico

        • Path C:\Users\Admin\AppData\Local\Temp\asUc.ico
        • Size 4KB
        • SHA256 8fca10b6f4873e2116b823c0de6cb3622e02fba68294dafa19c4d65c131b3405
        • MD5 SHA1 SHA512 SSDEEP TLSH

        awwG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\awwG.exe
        • Size 1.8MB
        • SHA256 813aa4a7d39b2fc09a8a9bdcbc8bd9809cd13e199cc25c326cdd64dad5fe1e37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cAMw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cAMw.exe
        • Size 1.7MB
        • SHA256 0cfc45c6bbd60e91425dcb05a1c475b8fa40eb6565c3037d043bab028ba9f265
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cAcO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cAcO.exe
        • Size 1.7MB
        • SHA256 e56ecc2e6f196a5c97ea00dce5491c4f0b75901247dffb2b774ed40ed80490b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cEAs.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cEAs.exe
        • Size 1.7MB
        • SHA256 d08dcde337cb4db77c9ddd32469d28dce01d47bb54dfc5c7bb40a94c43d27039
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cIIq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cIIq.exe
        • Size 1.8MB
        • SHA256 4c1298d9c89f6f6e42a46254000223e2e805833b99d4542b85f03b55e2147249
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cIsE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cIsE.exe
        • Size 1.6MB
        • SHA256 f94d152e01aad2200d290f64cdbc54897130432ace1c0255532fc17ada448cbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cUQw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cUQw.exe
        • Size 2.4MB
        • SHA256 e3fd03deb968e7088b8412ed495d50c2a85908477170d001be1e85b53ce1dbb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cUwQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cUwQ.exe
        • Size 1.6MB
        • SHA256 4336e98cf018e3becdb44c7db76f71d6d67886609580fa99528270a37d0a9683
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cYci.exe

        • Path C:\Users\Admin\AppData\Local\Temp\cYci.exe
        • Size 1.6MB
        • SHA256 b347ec08038e463f41508806bda83162b8e8e980f0b6a35468b43606846e446d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eYkE.ico

        • Path C:\Users\Admin\AppData\Local\Temp\eYkE.ico
        • Size 4KB
        • SHA256 701a17a9ee5c9340bae4f0810f103d1f0ca5c03141e0da826139d5b7397a6fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ecIE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ecIE.exe
        • Size 1.6MB
        • SHA256 d6923ae3679f3f049519265c2a9d6e1a884cbd049ee3d9b1780955f7d2f6eaa6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        egAQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\egAQ.exe
        • Size 1.9MB
        • SHA256 2ceb5033ccb0046b53134768ae1f38f22b9411ee3da7f6dbc641b51b9fa51fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eigY.ico

        • Path C:\Users\Admin\AppData\Local\Temp\eigY.ico
        • Size 4KB
        • SHA256 daa05353be57bb7c4de23a63af8aac3f0c45fba8c1b40acac53e33240fbc25cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ekYm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ekYm.exe
        • Size 1.6MB
        • SHA256 638f738312914087563b1d65da52324e7e6a7c09a973a7703a8ab8a2d40b65a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eksc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\eksc.exe
        • Size 1.6MB
        • SHA256 355a39aaa6ce2a98d57561ff18f02632fd7c1d9b545f6019d686ac75f19bf888
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gAMa.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gAMa.exe
        • Size 1.6MB
        • SHA256 c71ed6890e4254725f728d42d5017ea3b2ed846db3cb15d0b7a68f5d5d0a5587
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gEoI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gEoI.exe
        • Size 1.9MB
        • SHA256 df9b6f395a1a61bdaa474e13d3cb36f36ed5a2f7a8f9d2fc3adfc83e40a7c3b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gEwE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gEwE.exe
        • Size 1.6MB
        • SHA256 b42c88012f29f54340d94c345e9acf99a922147d2b76fcf93a7e87e919c684e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gIsI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gIsI.exe
        • Size 2.2MB
        • SHA256 dccf4d8e0a4c684df414bf5ef653afca783ac0204b44013fb1523b199ba79e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gMEW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gMEW.exe
        • Size 1.6MB
        • SHA256 497cd4b03f868a762496568afbe98601811c6ffc6c2bb1cf848cd6b870a9deb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gYME.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gYME.exe
        • Size 1.7MB
        • SHA256 b76067f5f592df4bf59bf496e67d367181aca135dc13b8b444ff143cbd9b113e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gYQQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gYQQ.exe
        • Size 2.4MB
        • SHA256 fd0a26b1daeb20d1db899a81340ac097fa8948e33ff947ba593d9d26a4937dab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gcYU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gcYU.exe
        • Size 2.0MB
        • SHA256 c1a5c05a418be25d133597122c44f0115e61d205a8240813e51031208d36a5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gsgy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gsgy.exe
        • Size 1.6MB
        • SHA256 1330c7fde92648e031f74437adf40633295abaee00ddcf4a6ef50c5b3e9fdd68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gwUq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\gwUq.exe
        • Size 2.2MB
        • SHA256 5d76da73d797988c31c6e35e53c0e802a7b34486a6505f4654353191e6506b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iGEk.ico

        • Path C:\Users\Admin\AppData\Local\Temp\iGEk.ico
        • Size 4KB
        • SHA256 684e75b6fdb9a7203e03c630a66a3710ace32aa78581311ba38e3f26737feae6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iYoC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iYoC.exe
        • Size 2.1MB
        • SHA256 83144d58b0395b23c923f5a2148d30f522815a97d3699f69b57becd85a3860c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ikMg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ikMg.exe
        • Size 1.6MB
        • SHA256 f5ed4673f0d2c163df7bee6c5ec8da1c0ff3c52e932afbd69bb0bbc83a7642c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ioEq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ioEq.exe
        • Size 1.6MB
        • SHA256 c13f30c057397e416e5d83d267718be50df0e553c98b09bde59c2d626d198471
        • MD5 SHA1 SHA512 SSDEEP TLSH

        isgo.exe

        • Path C:\Users\Admin\AppData\Local\Temp\isgo.exe
        • Size 2.0MB
        • SHA256 0579a77ddba0d6214ad0a5a78c574b409cab590ef77a9b5849aba55bdf2565e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iwcy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\iwcy.exe
        • Size 1.6MB
        • SHA256 b91f19083c0609287534edb1e644c4139ec8eda41fee1d8032bf368eda1c2595
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kAUM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kAUM.exe
        • Size 2.0MB
        • SHA256 478564034a2f4157cc9d41db9c7525773ba3475526efa293e58d6516dbe30dcc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kAYy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kAYy.exe
        • Size 1.7MB
        • SHA256 b89c1db9864e8311b903fadb5810913b3534f5e584ae733fe68767a0b23bec12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kkQk.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kkQk.exe
        • Size 1.8MB
        • SHA256 5eff46325fda209e75e07a8fc5c643b1096b920798423d1ee23b8d8c6643bed8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kssm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kssm.exe
        • Size 1.6MB
        • SHA256 d9449433f3e25171c7761612813074e881641608a6f8f13142a28ac2ff8b2f5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kwwG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\kwwG.exe
        • Size 3.7MB
        • SHA256 706deacff89984acef5994f3011fdc81cafc779706ecbf172af80ba76ca914f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mAQE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mAQE.exe
        • Size 1.6MB
        • SHA256 40118abba0e42a28ae1c48e1c163ce31247657f625bf6051dad01f42d215ca72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mEYw.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mEYw.exe
        • Size 1.6MB
        • SHA256 a67f8e495f814eefa6ef758e00df896265528a73d9b6477bbc1446eaee3e1641
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mMsW.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mMsW.exe
        • Size 3.9MB
        • SHA256 4fbede2a2d249133dbbf46cb88060896e959f45aa34d8a0032f56800e60cd8ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mQcQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mQcQ.exe
        • Size 1.6MB
        • SHA256 eed82a64f9c41144da92f30dd7b5c4821a4412d1dacf436060bd6e90e1b49f97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mksg.ico

        • Path C:\Users\Admin\AppData\Local\Temp\mksg.ico
        • Size 4KB
        • SHA256 399359dba1ae28474ffc3beef0e7b3b9fb76c64e7f1d2af8a925ee8ab6df167f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msAM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\msAM.exe
        • Size 1.7MB
        • SHA256 712bc287e8553ab38bac884936ad24152ed7a2c66ff68b594e253a9069fb9e50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mwAA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\mwAA.exe
        • Size 1.7MB
        • SHA256 ce29d74270a865dcdec736d9614ba0020a0f63a827d30dfe1845e70c647477c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oMAq.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oMAq.exe
        • Size 1.9MB
        • SHA256 9a7ef695edcf81615eff0cfffc6c031acf383aa7dad54d9391aeacc497760ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oUYC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oUYC.exe
        • Size 1.8MB
        • SHA256 702061aa2edd3cf488f90efef95dbe8caf13f4fd77806c84fbff8b98bf206fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oYog.exe

        • Path C:\Users\Admin\AppData\Local\Temp\oYog.exe
        • Size 2.0MB
        • SHA256 d39bec355a5ec6b90abc92d3e423c68bb0790ccba8cd45eff32131afe6e24b97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ocso.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ocso.exe
        • Size 1.6MB
        • SHA256 fdbad27c7fbfc9808343fb67e660338b883c3f7dab2aae05880920525f6f9129
        • MD5 SHA1 SHA512 SSDEEP TLSH

        owES.exe

        • Path C:\Users\Admin\AppData\Local\Temp\owES.exe
        • Size 1.7MB
        • SHA256 0bb6e88543c3bf983ecb0010d965fea58f10667509af4b1daa221a67dc5a1b64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qAYO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qAYO.exe
        • Size 1.7MB
        • SHA256 cfd4d393fe3c4e512578a02d37784a513e34ce13de13333eb667fcf6d9009222
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qEAy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qEAy.exe
        • Size 1.7MB
        • SHA256 819863de0d60deff166e0a1d9401a4a603965349c6a18e890e2ae13b91fe43ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qEMm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qEMm.exe
        • Size 1.6MB
        • SHA256 ca6fc2031a51d3664b0f4d0bb09e4e5cd8e518241cb15411cee32c88b6bbf1da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qYEE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qYEE.exe
        • Size 1.7MB
        • SHA256 17993c46761acc3b76af7270a9127fc6b0a38973be0754f4a2f59caa8f263963
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qYIA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qYIA.exe
        • Size 1.6MB
        • SHA256 3da17ab84ef92746cb0094392848c7dff4d93a6328b5dfae10efdfcd52e40910
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qYMg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qYMg.exe
        • Size 2.1MB
        • SHA256 0d5a5b666ee10b9f8518d0c70bfee40a93d4d6cb60ae6328a859fd0266e71e99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qgIS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qgIS.exe
        • Size 1.7MB
        • SHA256 53bff6e6b09ad91da0e00776eee25c8f97b3232eb0fc7ef8667cce264a194556
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qkQQ.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qkQQ.exe
        • Size 1.6MB
        • SHA256 7e8c67b18e2ed761103f5dec6c3fb3a287da2ed4093a25360636523c159a9001
        • MD5 SHA1 SHA512 SSDEEP TLSH

        qsMc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\qsMc.exe
        • Size 1.6MB
        • SHA256 1129e60c4178987f78892628f719e3fe2c61c923748faff43319070b11cfeb75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sAQE.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sAQE.exe
        • Size 1.9MB
        • SHA256 737432a7d96d17602874a4bdec91f9a4432a64076b0122cf41a79d28c75639eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sIEy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sIEy.exe
        • Size 1.8MB
        • SHA256 1a5f44368d78a652379f749473afeb57915bbb68597fe77015cac9f6cba5dfbf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sUwy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\sUwy.exe
        • Size 2.1MB
        • SHA256 5f29f2b72078bec78597cd8e1fb5b5c6ddd6deb40ca443d9adc670fb687b1faf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uEwM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uEwM.exe
        • Size 1.8MB
        • SHA256 0ef7025954b112095abb44189617b3cd949c770bda63d1fa38b869f7426536f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uQwU.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uQwU.exe
        • Size 1.6MB
        • SHA256 b4536885aedae43050f4776d50c41bec70f8b32614dadf80fc22f780c9be9b50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uUsi.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uUsi.exe
        • Size 2.0MB
        • SHA256 2997df7ad0d4a8baea8bbbc45fa54cac927d3f91bd380e0c6fd0ee9653131fd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucES.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ucES.exe
        • Size 1.6MB
        • SHA256 a0d14c0ce9a5609106c1d2752c94676e1e55e237c0a958697a83589f4f13a290
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uccO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\uccO.exe
        • Size 1.9MB
        • SHA256 1864dc9c527956de0ae6bf48fbd73148438488b016809c763c2dbbdb161bb863
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ugUG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ugUG.exe
        • Size 1.6MB
        • SHA256 486b385faddc9524899c509242d3f5ce452524dc09bd23dad17c4abcea3646ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ukYC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ukYC.exe
        • Size 1.8MB
        • SHA256 8564da07f43c86904ebe1ce93d3deb1455114c5917de4a55d3a9249791e17d00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ukww.ico

        • Path C:\Users\Admin\AppData\Local\Temp\ukww.ico
        • Size 4KB
        • SHA256 135efe6cdc9df0beb185988bd2d639db8a293dd89dcb7fc900e5ac839629c715
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usIY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\usIY.exe
        • Size 1.6MB
        • SHA256 7a406d25583d2d7355a731501893cbb79db114ef7c64e25026a652b3f2d1d063
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usQy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\usQy.exe
        • Size 1.6MB
        • SHA256 57c3c5c77c2801f9d63f63aceaf0798955a8dbbb3e47e86b48596229c69c1557
        • MD5 SHA1 SHA512 SSDEEP TLSH

        usws.ico

        • Path C:\Users\Admin\AppData\Local\Temp\usws.ico
        • Size 4KB
        • SHA256 6b1018b4e474afacb1c54331284d85fdbc2bb5e945466dcbda91231feeac5fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wAwY.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wAwY.exe
        • Size 1.6MB
        • SHA256 ca3f36b16ffb74a60e7b3821b66ef76f99796ee896ca857df0c60360a15addaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wIMC.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wIMC.exe
        • Size 1.6MB
        • SHA256 92ca72cd707290d59c586971737c9d8b601971376dcb2b57f76bc49ab737441e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wIos.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wIos.exe
        • Size 1.6MB
        • SHA256 4284f263b56ce7d480fc477112fe66f4a8535e1710fcacb9703f75091b77baa1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wQYg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wQYg.exe
        • Size 2.2MB
        • SHA256 b6a8aa357f438daf54d506936e8d9ae0c77c1f8de8d173cbc57a6586e0e5e128
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wUYm.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wUYm.exe
        • Size 1.7MB
        • SHA256 ac50cd215a311651f2765830dd97c2eb5eaf7ca42146fc09a64ba7604856e6a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wkQA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wkQA.exe
        • Size 1.6MB
        • SHA256 c51a4973c5d97cd9d9dbf1f05ef566d2e93bd4979c4db94197026675372cee18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wksS.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wksS.exe
        • Size 1.6MB
        • SHA256 154ac0218e9531d94d1792997b9d762d61ef633206ea873cc9a3311f8ac2e087
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsEI.exe

        • Path C:\Users\Admin\AppData\Local\Temp\wsEI.exe
        • Size 1.8MB
        • SHA256 52f9b82a7190beeb3749af33e7a2b3a69168ee936461103986a581e3af106f63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yAcA.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yAcA.exe
        • Size 1.6MB
        • SHA256 1f9e6e86117a87e482ee8854350adcc538118b53cc8043d7dfde4892c3bf889e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yAwu.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yAwu.exe
        • Size 1.7MB
        • SHA256 76c900cf42b121f7b616f2da3ccf66e77fc579f9a7a31397c49d722a8be2e809
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yIoG.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yIoG.exe
        • Size 1.6MB
        • SHA256 37d0727c300494a074369017b72409c41aa153d7b613bb43d95ce6543cd88c59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yIwY.ico

        • Path C:\Users\Admin\AppData\Local\Temp\yIwY.ico
        • Size 4KB
        • SHA256 5963420fd9ba8c8248e3f50d179dfa21caca8538ad1482a03f260b27cf218043
        • MD5 SHA1 SHA512 SSDEEP TLSH

        yYwM.exe

        • Path C:\Users\Admin\AppData\Local\Temp\yYwM.exe
        • Size 2.1MB
        • SHA256 21aafc51b5f28dbd17468ffbe1d46fd610579b951213f0a9f60e64c5deb6035a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ygIy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ygIy.exe
        • Size 1.8MB
        • SHA256 af4ce7a1649b372b906ce6b88f74fbd23c079bfbcd00dc633c066b269cb20bc1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ykwO.exe

        • Path C:\Users\Admin\AppData\Local\Temp\ykwO.exe
        • Size 1.6MB
        • SHA256 f689687e4a1e3795394feece12988e8ce5e8af504c764270dd5db9aa16ded58d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinWait.png.exe

        • Path C:\Users\Admin\Pictures\JoinWait.png.exe
        • Size 1.7MB
        • SHA256 2fec7f5fe3b8b33428825463194dedbc400de7e7f88928dcdaea4c7e78bb3c22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mWEQUAsA.exe

        • Path C:\Users\Admin\ZGosEssY\mWEQUAsA.exe
        • Size 1.6MB
        • SHA256 6b022b21e90a9fcff52bd0b6f46245dee85500b2d576eb0495475544293607ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mWEQUAsA.inf

        • Path C:\Users\Admin\ZGosEssY\mWEQUAsA.inf
        • Size 4B
        • SHA256 65d35417bc85659abb5848c4ea023f7901b32dd685f21b61b8d7b21f707a3846
        • MD5 SHA1 SHA512

        mWEQUAsA.inf

        • Path C:\Users\Admin\ZGosEssY\mWEQUAsA.inf
        • Size 4B
        • SHA256 4599be5ed04c00ef760bb5e6eed5aad7fc54b4b27e28ae66f61e39959ae731c3
        • MD5 SHA1 SHA512

        mWEQUAsA.inf

        • Path C:\Users\Admin\ZGosEssY\mWEQUAsA.inf
        • Size 4B
        • SHA256 82ba7fc490951d5fac284e45cbb65cbc8b47fc090d5ef7402cdb0bbb50b95cf4
        • MD5 SHA1 SHA512

        mWEQUAsA.inf

        • Path C:\Users\Admin\ZGosEssY\mWEQUAsA.inf
        • Size 4B
        • SHA256 f14f1a931b69fb5155d7d6682edea22e4f8f2a796479c4b84e3b311d7d96e3f4
        • MD5 SHA1 SHA512

        mWEQUAsA.inf

        • Path C:\Users\Admin\ZGosEssY\mWEQUAsA.inf
        • Size 4B
        • SHA256 c52eda4ce201b18e59a2cab1e6b723f495f0c3f5e6b841ce6a9a654f8be64621
        • MD5 SHA1 SHA512

        memory/1072-58-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/1072-2698-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/1152-2684-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/1152-19-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/1504-2444-0x00000000006D0000-0x00000000006F0000-memory.dmp

        memory/1504-7-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/1504-115-0x00000000006D0000-0x00000000006F0000-memory.dmp

        memory/1504-2674-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/1788-33-0x000002C881810000-0x000002C8818C2000-memory.dmp

        memory/1788-67-0x000002C8FFA20000-0x000002C8FFA3E000-memory.dmp

        memory/1788-59-0x000002C8FF9F0000-0x000002C8FFA12000-memory.dmp

        memory/1788-54-0x000002C8FFA40000-0x000002C8FFAB6000-memory.dmp

        memory/1788-31-0x000002C8FF410000-0x000002C8FF68A000-memory.dmp

        memory/3092-0-0x0000000000400000-0x0000000000806000-memory.dmp

        memory/3092-24-0x0000000000400000-0x0000000000806000-memory.dmp

        memory/3092-1-0x0000000000940000-0x0000000000960000-memory.dmp

        memory/3092-25-0x0000000000940000-0x0000000000960000-memory.dmp

        memory/3952-2679-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/3952-16-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/4184-2693-0x0000000000400000-0x0000000000590000-memory.dmp

        memory/4184-32-0x0000000000400000-0x0000000000590000-memory.dmp