Analysis

  • max time kernel
    80s
  • max time network
    166s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    08-07-2021 13:06

General

  • Target

    7BC7179DE05E8CF9D280ADDF85E172E7.exe

  • Size

    3.7MB

  • MD5

    7bc7179de05e8cf9d280addf85e172e7

  • SHA1

    e733fa5ce12fa0f13432106d95fa1f7ed4e6c70d

  • SHA256

    326c2c9f4f724fb74c0d826aaa93c3c86140a26bd2c0f27a37407ac1dbdc7c59

  • SHA512

    5f1f3dddd398579710f8617e2175679790e62d51abef419c4fc03fe14377e6d4587e9d90f681773c331323ab5cfeeca8bba7565ab269503b535e860b34c10ca1

Malware Config

Extracted

Family

redline

Botnet

Cana

C2

176.111.174.254:56328

Extracted

Family

vidar

Version

39.4

Botnet

933

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 54 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 21 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2760
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2688
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2408
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2400
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1944
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1412
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1332
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1240
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1108
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:412
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:68
                      • C:\Users\Admin\AppData\Local\Temp\7BC7179DE05E8CF9D280ADDF85E172E7.exe
                        "C:\Users\Admin\AppData\Local\Temp\7BC7179DE05E8CF9D280ADDF85E172E7.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3876
                        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:2156
                          • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\setup_install.exe
                            "C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\setup_install.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:2784
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sahiba_1.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3892
                              • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_1.exe
                                sahiba_1.exe
                                5⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Modifies registry class
                                PID:772
                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                  6⤵
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4224
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sahiba_2.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2212
                              • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_2.exe
                                sahiba_2.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1588
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sahiba_3.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2776
                              • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_3.exe
                                sahiba_3.exe
                                5⤵
                                • Executes dropped EXE
                                PID:2616
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 904
                                  6⤵
                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                  • Program crash
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4328
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sahiba_5.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3952
                              • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_5.exe
                                sahiba_5.exe
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2744
                                • C:\Users\Admin\AppData\Local\Temp\is-SD5JV.tmp\sahiba_5.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\is-SD5JV.tmp\sahiba_5.tmp" /SL5="$60054,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_5.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:3784
                                  • C:\Users\Admin\AppData\Local\Temp\is-R3NBQ.tmp\JFHGSFGSIUGFSUIG.exe
                                    "C:\Users\Admin\AppData\Local\Temp\is-R3NBQ.tmp\JFHGSFGSIUGFSUIG.exe" /S /UID=burnerch2
                                    7⤵
                                    • Drops file in Drivers directory
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4320
                                    • C:\Program Files\Common Files\CMEBQERTXY\ultramediaburner.exe
                                      "C:\Program Files\Common Files\CMEBQERTXY\ultramediaburner.exe" /VERYSILENT
                                      8⤵
                                      • Executes dropped EXE
                                      PID:808
                                      • C:\Users\Admin\AppData\Local\Temp\is-ADUAT.tmp\ultramediaburner.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-ADUAT.tmp\ultramediaburner.tmp" /SL5="$301FE,281924,62464,C:\Program Files\Common Files\CMEBQERTXY\ultramediaburner.exe" /VERYSILENT
                                        9⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of FindShellTrayWindow
                                        PID:2436
                                        • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                          "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                          10⤵
                                          • Executes dropped EXE
                                          PID:4844
                                    • C:\Users\Admin\AppData\Local\Temp\47-9d264-43e-7b5a3-70baf0817b86d\Tyraebehaxae.exe
                                      "C:\Users\Admin\AppData\Local\Temp\47-9d264-43e-7b5a3-70baf0817b86d\Tyraebehaxae.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      PID:3540
                                    • C:\Users\Admin\AppData\Local\Temp\b7-40dab-08c-e17b9-85ff8f7c67b0b\Gyrolehufae.exe
                                      "C:\Users\Admin\AppData\Local\Temp\b7-40dab-08c-e17b9-85ff8f7c67b0b\Gyrolehufae.exe"
                                      8⤵
                                      • Executes dropped EXE
                                      PID:2316
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iscdlpnu.v0s\GcleanerEU.exe /eufive & exit
                                        9⤵
                                          PID:6076
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oobm5saj.rbd\installer.exe /qn CAMPAIGN="654" & exit
                                          9⤵
                                            PID:5588
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f10hzwd5.mhh\Setup3310.exe /Verysilent /subid=623 & exit
                                            9⤵
                                              PID:3972
                                              • C:\Users\Admin\AppData\Local\Temp\f10hzwd5.mhh\Setup3310.exe
                                                C:\Users\Admin\AppData\Local\Temp\f10hzwd5.mhh\Setup3310.exe /Verysilent /subid=623
                                                10⤵
                                                  PID:6368
                                                  • C:\Users\Admin\AppData\Local\Temp\is-KUFQJ.tmp\Setup3310.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-KUFQJ.tmp\Setup3310.tmp" /SL5="$20450,138429,56832,C:\Users\Admin\AppData\Local\Temp\f10hzwd5.mhh\Setup3310.exe" /Verysilent /subid=623
                                                    11⤵
                                                      PID:6416
                                                      • C:\Users\Admin\AppData\Local\Temp\is-TE8CP.tmp\Setup.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\is-TE8CP.tmp\Setup.exe" /Verysilent
                                                        12⤵
                                                        • Suspicious behavior: MapViewOfSection
                                                        PID:1588
                                                        • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                          "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                          13⤵
                                                            PID:4232
                                                            • C:\Users\Admin\AppData\Local\Temp\is-0E4EJ.tmp\lylal220.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-0E4EJ.tmp\lylal220.tmp" /SL5="$30526,172303,88576,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                              14⤵
                                                                PID:6928
                                                                • C:\Users\Admin\AppData\Local\Temp\is-496VQ.tmp\èeèrgegdè_éçè_)))_.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-496VQ.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=lylal220
                                                                  15⤵
                                                                    PID:7872
                                                                    • C:\Program Files\VideoLAN\PIXCAYEUOU\irecord.exe
                                                                      "C:\Program Files\VideoLAN\PIXCAYEUOU\irecord.exe" /VERYSILENT
                                                                      16⤵
                                                                        PID:7392
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-7Q4SH.tmp\irecord.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-7Q4SH.tmp\irecord.tmp" /SL5="$801DA,5808768,66560,C:\Program Files\VideoLAN\PIXCAYEUOU\irecord.exe" /VERYSILENT
                                                                          17⤵
                                                                            PID:6300
                                                                            • C:\Program Files (x86)\i-record\I-Record.exe
                                                                              "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                              18⤵
                                                                                PID:6468
                                                                          • C:\Users\Admin\AppData\Local\Temp\31-e452e-c01-f119f-464ca32e01376\Tupytahaepi.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\31-e452e-c01-f119f-464ca32e01376\Tupytahaepi.exe"
                                                                            16⤵
                                                                              PID:7352
                                                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                dw20.exe -x -s 1332
                                                                                17⤵
                                                                                  PID:3688
                                                                              • C:\Users\Admin\AppData\Local\Temp\e6-6f67c-ce6-dcfa5-6bacdc5b30028\Dysidupewo.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\e6-6f67c-ce6-dcfa5-6bacdc5b30028\Dysidupewo.exe"
                                                                                16⤵
                                                                                  PID:7708
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3urtp3xb.50r\GcleanerEU.exe /eufive & exit
                                                                                    17⤵
                                                                                      PID:4160
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\30gjyk52.ex2\installer.exe /qn CAMPAIGN="654" & exit
                                                                                      17⤵
                                                                                        PID:4600
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\se3b5nyr.jn2\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                        17⤵
                                                                                          PID:5388
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vyeem5uk.vlr\google-game.exe & exit
                                                                                          17⤵
                                                                                            PID:6744
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ujfxk1pw.vct\GcleanerWW.exe /mixone & exit
                                                                                            17⤵
                                                                                              PID:8184
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tmwuel1.r5p\toolspab1.exe & exit
                                                                                              17⤵
                                                                                                PID:6248
                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\updatetes.exe
                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\updatetes.exe"
                                                                                        13⤵
                                                                                          PID:5644
                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                          13⤵
                                                                                            PID:5932
                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe" -a
                                                                                              14⤵
                                                                                                PID:7688
                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                              13⤵
                                                                                                PID:5776
                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-VI8EC.tmp\LabPicV3.tmp
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-VI8EC.tmp\LabPicV3.tmp" /SL5="$2050E,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                  14⤵
                                                                                                    PID:6536
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-RPEDK.tmp\12(((((.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-RPEDK.tmp\12(((((.exe" /S /UID=lab214
                                                                                                      15⤵
                                                                                                        PID:7764
                                                                                                        • C:\Program Files\MSBuild\RJHFSWBMVG\prolab.exe
                                                                                                          "C:\Program Files\MSBuild\RJHFSWBMVG\prolab.exe" /VERYSILENT
                                                                                                          16⤵
                                                                                                            PID:5980
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-34EIC.tmp\prolab.tmp
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-34EIC.tmp\prolab.tmp" /SL5="$203D2,575243,216576,C:\Program Files\MSBuild\RJHFSWBMVG\prolab.exe" /VERYSILENT
                                                                                                              17⤵
                                                                                                                PID:6136
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\01-32f6c-f29-237ba-1ae9c31eeea45\Tuhaxajyxe.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\01-32f6c-f29-237ba-1ae9c31eeea45\Tuhaxajyxe.exe"
                                                                                                              16⤵
                                                                                                                PID:7084
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                  dw20.exe -x -s 2448
                                                                                                                  17⤵
                                                                                                                    PID:5740
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4c-46d37-9a1-a5b8c-6f1092853230e\Lyfaecaedalu.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4c-46d37-9a1-a5b8c-6f1092853230e\Lyfaecaedalu.exe"
                                                                                                                  16⤵
                                                                                                                    PID:7544
                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe
                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                                                              13⤵
                                                                                                                PID:7124
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-2TG76.tmp\MediaBurner.tmp
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-2TG76.tmp\MediaBurner.tmp" /SL5="$20550,303887,220160,C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                                                                  14⤵
                                                                                                                    PID:6932
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-ARE9C.tmp\_____________bob.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-ARE9C.tmp\_____________bob.exe" /S /UID=burnerch1
                                                                                                                      15⤵
                                                                                                                        PID:8032
                                                                                                                        • C:\Program Files\Java\SLIYGKNVUR\ultramediaburner.exe
                                                                                                                          "C:\Program Files\Java\SLIYGKNVUR\ultramediaburner.exe" /VERYSILENT
                                                                                                                          16⤵
                                                                                                                            PID:6820
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-N5TFL.tmp\ultramediaburner.tmp
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-N5TFL.tmp\ultramediaburner.tmp" /SL5="$50430,281924,62464,C:\Program Files\Java\SLIYGKNVUR\ultramediaburner.exe" /VERYSILENT
                                                                                                                              17⤵
                                                                                                                                PID:6304
                                                                                                                                • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                  18⤵
                                                                                                                                    PID:7320
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\e9-2a77f-193-6918d-25633149563f9\Gymaerefiga.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\e9-2a77f-193-6918d-25633149563f9\Gymaerefiga.exe"
                                                                                                                                16⤵
                                                                                                                                  PID:1512
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\05-9b270-8df-cf7a3-8636a52083654\Nequtijise.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\05-9b270-8df-cf7a3-8636a52083654\Nequtijise.exe"
                                                                                                                                  16⤵
                                                                                                                                    PID:7724
                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                                                                                              13⤵
                                                                                                                                PID:7108
                                                                                                                                • C:\Users\Admin\AppData\Roaming\7124211.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\7124211.exe"
                                                                                                                                  14⤵
                                                                                                                                    PID:7040
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\5091191.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\5091191.exe"
                                                                                                                                    14⤵
                                                                                                                                      PID:7572
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\1968235.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\1968235.exe"
                                                                                                                                      14⤵
                                                                                                                                        PID:7100
                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                      13⤵
                                                                                                                                        PID:6880
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                          14⤵
                                                                                                                                            PID:6436
                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                              taskkill /im RunWW.exe /f
                                                                                                                                              15⤵
                                                                                                                                              • Kills process with taskkill
                                                                                                                                              PID:4252
                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                              timeout /t 6
                                                                                                                                              15⤵
                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                              PID:8056
                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                          13⤵
                                                                                                                                            PID:7056
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                              14⤵
                                                                                                                                                PID:5864
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                14⤵
                                                                                                                                                  PID:4104
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vwui0e4j.sq3\google-game.exe & exit
                                                                                                                                        9⤵
                                                                                                                                          PID:6744
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vwui0e4j.sq3\google-game.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\vwui0e4j.sq3\google-game.exe
                                                                                                                                            10⤵
                                                                                                                                              PID:7128
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vwui0e4j.sq3\google-game.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vwui0e4j.sq3\google-game.exe" -a
                                                                                                                                                11⤵
                                                                                                                                                  PID:6184
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hmvpowsh.21u\GcleanerWW.exe /mixone & exit
                                                                                                                                              9⤵
                                                                                                                                                PID:7164
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\omlakg0d.ln2\toolspab1.exe & exit
                                                                                                                                                9⤵
                                                                                                                                                  PID:2684
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\omlakg0d.ln2\toolspab1.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\omlakg0d.ln2\toolspab1.exe
                                                                                                                                                    10⤵
                                                                                                                                                      PID:7608
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\omlakg0d.ln2\toolspab1.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\omlakg0d.ln2\toolspab1.exe
                                                                                                                                                        11⤵
                                                                                                                                                          PID:4392
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nbsdiery.pst\SunLabsPlayer.exe /S & exit
                                                                                                                                                      9⤵
                                                                                                                                                        PID:8156
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nbsdiery.pst\SunLabsPlayer.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\nbsdiery.pst\SunLabsPlayer.exe /S
                                                                                                                                                          10⤵
                                                                                                                                                            PID:7884
                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst18E5.tmp\tempfile.ps1"
                                                                                                                                                              11⤵
                                                                                                                                                                PID:7532
                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst18E5.tmp\tempfile.ps1"
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:7848
                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst18E5.tmp\tempfile.ps1"
                                                                                                                                                                  11⤵
                                                                                                                                                                    PID:5220
                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nst18E5.tmp\tempfile.ps1"
                                                                                                                                                                    11⤵
                                                                                                                                                                      PID:4860
                                                                                                                                                                    • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                                                                                                      "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                                                                                                      11⤵
                                                                                                                                                                        PID:5952
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_7.exe
                                                                                                                                                          4⤵
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:1296
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_7.exe
                                                                                                                                                            sahiba_7.exe
                                                                                                                                                            5⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            PID:2084
                                                                                                                                                            • C:\Users\Admin\Documents\V6KM3DHzMD4LE7QfuNjM1TnT.exe
                                                                                                                                                              "C:\Users\Admin\Documents\V6KM3DHzMD4LE7QfuNjM1TnT.exe"
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                              PID:4872
                                                                                                                                                            • C:\Users\Admin\Documents\fAUUFnhEQqOhskx1TBY7SUHb.exe
                                                                                                                                                              "C:\Users\Admin\Documents\fAUUFnhEQqOhskx1TBY7SUHb.exe"
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1432
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "fAUUFnhEQqOhskx1TBY7SUHb.exe" /f & erase "C:\Users\Admin\Documents\fAUUFnhEQqOhskx1TBY7SUHb.exe" & exit
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:6016
                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                    taskkill /im "fAUUFnhEQqOhskx1TBY7SUHb.exe" /f
                                                                                                                                                                    8⤵
                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                    PID:5404
                                                                                                                                                              • C:\Users\Admin\Documents\HRYp5gArG1xqBnctoQ6TlAJk.exe
                                                                                                                                                                "C:\Users\Admin\Documents\HRYp5gArG1xqBnctoQ6TlAJk.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2196
                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:6628
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:6660
                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6660.0.14294252\938231707" -parentBuildID 20200403170909 -prefsHandle 1436 -prefMapHandle 1428 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6660 "\\.\pipe\gecko-crash-server-pipe.6660" 1532 gpu
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:6984
                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6660.3.332230796\265538653" -childID 1 -isForBrowser -prefsHandle 2168 -prefMapHandle 2136 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6660 "\\.\pipe\gecko-crash-server-pipe.6660" 2188 tab
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:6292
                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6660.13.940758611\1520338262" -childID 2 -isForBrowser -prefsHandle 3000 -prefMapHandle 2996 -prefsLen 1022 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6660 "\\.\pipe\gecko-crash-server-pipe.6660" 3016 tab
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:5588
                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6660.20.1216924818\2025412196" -childID 3 -isForBrowser -prefsHandle 1176 -prefMapHandle 3940 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6660 "\\.\pipe\gecko-crash-server-pipe.6660" 3784 tab
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:7644
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:8164
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffe007c4f50,0x7ffe007c4f60,0x7ffe007c4f70
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:4192
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "cmd.exe" /C taskkill /F /PID 2196 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\HRYp5gArG1xqBnctoQ6TlAJk.exe"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:8048
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "cmd.exe" /C taskkill /F /PID 2196 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\HRYp5gArG1xqBnctoQ6TlAJk.exe"
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:7484
                                                                                                                                                                                  • C:\Users\Admin\Documents\AQr0TxcJwN7lnztOR2DMhDiy.exe
                                                                                                                                                                                    "C:\Users\Admin\Documents\AQr0TxcJwN7lnztOR2DMhDiy.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                    PID:4348
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyE8A2.tmp\tempfile.ps1"
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:5072
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyE8A2.tmp\tempfile.ps1"
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:6716
                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyE8A2.tmp\tempfile.ps1"
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:8048
                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyE8A2.tmp\tempfile.ps1"
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:8076
                                                                                                                                                                                            • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                                                                                                                              "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:4820
                                                                                                                                                                                            • C:\Users\Admin\Documents\Rci5B5wWZIUsdzQejIC4g70H.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\Rci5B5wWZIUsdzQejIC4g70H.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3772
                                                                                                                                                                                              • C:\Users\Admin\Documents\Rci5B5wWZIUsdzQejIC4g70H.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\Rci5B5wWZIUsdzQejIC4g70H.exe" -a
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:2772
                                                                                                                                                                                            • C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4672
                                                                                                                                                                                              • C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:2504
                                                                                                                                                                                              • C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4972
                                                                                                                                                                                              • C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\MAI9_BRks1W9edEZFY0_l22C.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5076
                                                                                                                                                                                            • C:\Users\Admin\Documents\ChjxKqH2PryYfaT674XD16_h.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\ChjxKqH2PryYfaT674XD16_h.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                              PID:3724
                                                                                                                                                                                              • C:\Users\Admin\Documents\ChjxKqH2PryYfaT674XD16_h.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\ChjxKqH2PryYfaT674XD16_h.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4108
                                                                                                                                                                                            • C:\Users\Admin\Documents\Jn2wZUHvLJ1gFMvEbi2iDzoF.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\Jn2wZUHvLJ1gFMvEbi2iDzoF.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                              PID:4968
                                                                                                                                                                                              • C:\Users\Admin\Documents\Jn2wZUHvLJ1gFMvEbi2iDzoF.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\Jn2wZUHvLJ1gFMvEbi2iDzoF.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:5044
                                                                                                                                                                                            • C:\Users\Admin\Documents\SDSOkEYKikNI0003P7KtbcbH.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\SDSOkEYKikNI0003P7KtbcbH.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5024
                                                                                                                                                                                            • C:\Users\Admin\Documents\sqyu5yYyN9xne6K6KPw6rlgh.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\sqyu5yYyN9xne6K6KPw6rlgh.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5028
                                                                                                                                                                                              • C:\Users\Admin\Documents\sqyu5yYyN9xne6K6KPw6rlgh.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\sqyu5yYyN9xne6K6KPw6rlgh.exe"
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:5448
                                                                                                                                                                                              • C:\Users\Admin\Documents\Wr9q10WTZmtDlasjPncCu9yA.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\Wr9q10WTZmtDlasjPncCu9yA.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Checks BIOS information in registry
                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                PID:1428
                                                                                                                                                                                              • C:\Users\Admin\Documents\whgC14z7CLaDbdUoZJkn775R.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\whgC14z7CLaDbdUoZJkn775R.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im whgC14z7CLaDbdUoZJkn775R.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\whgC14z7CLaDbdUoZJkn775R.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:5536
                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                      taskkill /im whgC14z7CLaDbdUoZJkn775R.exe /f
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                      PID:6156
                                                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                      timeout /t 6
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                      PID:7972
                                                                                                                                                                                                • C:\Users\Admin\Documents\u6x7B8KmVq_jSNi1iPJZ1j5n.exe
                                                                                                                                                                                                  "C:\Users\Admin\Documents\u6x7B8KmVq_jSNi1iPJZ1j5n.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  PID:3348
                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:1564
                                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4220
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                        PID:5572
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:3656
                                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:744
                                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:5724
                                                                                                                                                                                                      • C:\Users\Admin\Documents\66rrNBFPvqJhnCnUspoNAhXI.exe
                                                                                                                                                                                                        "C:\Users\Admin\Documents\66rrNBFPvqJhnCnUspoNAhXI.exe"
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                      • C:\Users\Admin\Documents\RN1B0YK4iF4Q33qEPyHMXBD1.exe
                                                                                                                                                                                                        "C:\Users\Admin\Documents\RN1B0YK4iF4Q33qEPyHMXBD1.exe"
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                        • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                          • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                            • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:4856
                                                                                                                                                                                                            • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:4380
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 2704
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                          • C:\Users\Admin\Documents\ikGT4NbSRzOI22aoNIhinVIN.exe
                                                                                                                                                                                                            "C:\Users\Admin\Documents\ikGT4NbSRzOI22aoNIhinVIN.exe"
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:3484
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_6.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_6.exe
                                                                                                                                                                                                            sahiba_6.exe
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:3932
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\3256201.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\3256201.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\3814690.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\3814690.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\2087018.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\2087018.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:5056
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_9.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:2140
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_8.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:3776
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_8.exe
                                                                                                                                                                                                            sahiba_8.exe
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:1556
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_4.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                          PID:360
                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:720
                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6616
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_4.exe
                                                                                                                                                                                                      sahiba_4.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:1936
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        PID:4824
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_9.exe
                                                                                                                                                                                                      sahiba_9.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:204
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_9.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_9.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2208
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_9.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_9.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:1004
                                                                                                                                                                                                      • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5908
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 3344 -s 3232
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                              PID:6632
                                                                                                                                                                                                          • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:6224
                                                                                                                                                                                                            • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                              "LogonUI.exe" /flags:0x0 /state0:0xa3ad9055 /state1:0x41c64e6d
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:7476
                                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                  • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                                                    PID:5308
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6372
                                                                                                                                                                                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                          PID:7396
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6384
                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:1968
                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2208

                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                Modify Existing Service

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1031

                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1060

                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                Disabling Security Tools

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1089

                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                Credentials in Files

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1081

                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                6
                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                6
                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                Web Service

                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                T1102

                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\libcurl.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\libcurlpp.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\libstdc++-6.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\libwinpthread-1.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_1.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  151ac4868889bf34489fec00289e2b68

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  2e7b27cf334c64b0b28c5ca5742b4d920fa0434b

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  0c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_1.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  151ac4868889bf34489fec00289e2b68

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  2e7b27cf334c64b0b28c5ca5742b4d920fa0434b

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  0c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_2.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  0b722fdf5af17af0a942c927db8145b4

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  95b11ae52972c1314f18c43f3e079f09155c1ec5

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  0a99f1c738387f482cd9c37b490a44290ee823a50f332296ef8618514580d7a8

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0bb6fcb85130fede076268eeaa0b48be1dbaa14e93dfcbe90768ca651f49c84446210e2670bae771234998469ef944eaa6c29d52cc9edf58422327ca76e2b5ff

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_2.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  0b722fdf5af17af0a942c927db8145b4

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  95b11ae52972c1314f18c43f3e079f09155c1ec5

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  0a99f1c738387f482cd9c37b490a44290ee823a50f332296ef8618514580d7a8

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0bb6fcb85130fede076268eeaa0b48be1dbaa14e93dfcbe90768ca651f49c84446210e2670bae771234998469ef944eaa6c29d52cc9edf58422327ca76e2b5ff

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_3.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a03ba209264db1a2c71322ea8df81835

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  c2341c4638d1edf0b33f5a03273f9e2c8b3d7907

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  4335641569c179d487673b810ca8301562ae4325b9ffaeaebf0367113243a6af

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  237f7d5f6e924e4be10f4ee4c96e9711bde4ee407872d1805f1bd4721f9a25e14bf20b4cf4ea2d22618ee0f3ed84e54afb654a049922828f5c8e1c6ca3cfa988

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_3.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a03ba209264db1a2c71322ea8df81835

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  c2341c4638d1edf0b33f5a03273f9e2c8b3d7907

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  4335641569c179d487673b810ca8301562ae4325b9ffaeaebf0367113243a6af

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  237f7d5f6e924e4be10f4ee4c96e9711bde4ee407872d1805f1bd4721f9a25e14bf20b4cf4ea2d22618ee0f3ed84e54afb654a049922828f5c8e1c6ca3cfa988

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_4.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_4.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_5.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8c4df9d37195987ede03bf8adb495686

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  010626025ca791720f85984a842c893b78f439d2

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_5.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8c4df9d37195987ede03bf8adb495686

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  010626025ca791720f85984a842c893b78f439d2

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_6.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  dae14fe61d968fb25b83887171b84238

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  67c256d1c51b6dba818d9a556c9ef374241a4450

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e47c276aa5227157fb2eddf4a8451d75ab0573d19c79a2f99c29c42509b366a1

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  4144f72c2e9cbc3eab0e7ad77f1dd167c56c21ed00740404bcba34caa7e17a832f30243601d456e5a7e1472aed8b15f939ad3fc3b635c6ea810bba1726edc155

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_6.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  dae14fe61d968fb25b83887171b84238

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  67c256d1c51b6dba818d9a556c9ef374241a4450

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  e47c276aa5227157fb2eddf4a8451d75ab0573d19c79a2f99c29c42509b366a1

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  4144f72c2e9cbc3eab0e7ad77f1dd167c56c21ed00740404bcba34caa7e17a832f30243601d456e5a7e1472aed8b15f939ad3fc3b635c6ea810bba1726edc155

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_7.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_7.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_8.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  75ab1409c95fe3c7cccc0bd6c6043397

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  6ac9fd227696db5e9b1b98cbdaa5fe224dbea8a5

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  b7bca02f33d2954f4f29203a77c2746f193116630bfbce316666a81c9a04f1ab

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  78b1ca13f02bac57eb36a831178f647bb41f0223aaddd9f78ca9500b959d336ad9e838361c1fef67507f2adcf74a68b4fa31e36ca360e31ded8d8a8efe0c31f7

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_8.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  75ab1409c95fe3c7cccc0bd6c6043397

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  6ac9fd227696db5e9b1b98cbdaa5fe224dbea8a5

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  b7bca02f33d2954f4f29203a77c2746f193116630bfbce316666a81c9a04f1ab

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  78b1ca13f02bac57eb36a831178f647bb41f0223aaddd9f78ca9500b959d336ad9e838361c1fef67507f2adcf74a68b4fa31e36ca360e31ded8d8a8efe0c31f7

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_9.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  3e2c8ab8ed50cf8e9a4fe433965e8f60

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\sahiba_9.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  3e2c8ab8ed50cf8e9a4fe433965e8f60

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\setup_install.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8b241eb4c18e7d35685bd62185490d75

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  38522ba7dc5b1822203c296f24742a574115c5b9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  c58202010548d30e9d7134babdf57cefd8d7befaad7438f694dd8204da1b89b8

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  f57879c12dad0311cecfe0d1c6303b5f8aaef9bbb89426d7c44a455f8ddbb3dbbe030ce867c91071d7c99dfd65e69f72d1a36fd78430556a2d79259de48d5388

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC68F9B74\setup_install.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8b241eb4c18e7d35685bd62185490d75

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  38522ba7dc5b1822203c296f24742a574115c5b9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  c58202010548d30e9d7134babdf57cefd8d7befaad7438f694dd8204da1b89b8

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  f57879c12dad0311cecfe0d1c6303b5f8aaef9bbb89426d7c44a455f8ddbb3dbbe030ce867c91071d7c99dfd65e69f72d1a36fd78430556a2d79259de48d5388

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  13abe7637d904829fbb37ecda44a1670

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  7a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  6e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  7d50e41fedea9c1b46139b98629b5ba9

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  f395975657a459c3e07b18b8a7f7dbd515cb3334

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  07a6792d711d3fbea313b9c8273e49dc46d864a053bef0bf0368969560bb7dec

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  76d92cb15da9c8ef5200cfe3cc1c96cac7699af2ae930e0cb34fb75ecca54186e1290f7a47bf1ff03b65f630fe32d09d2f97794b2ab072ea96dc608a6a7065ec

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-R3NBQ.tmp\JFHGSFGSIUGFSUIG.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9aa6ae4c97ad138d7c7eac7cb98f1dec

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  6b6772c8af5ccbd0e1d133780e9965885d7ce72c

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9bf9a7108b9fc87cd68f2b0c856194b7f55e2272e6850b4988de24e1ce697ca5

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  a6a8542561aa33f30d10fea8b74c65c19bdb57c231f44930196da4b37c3b090aa2025e0f0c81b165ca4f60775b6857c620f244a189dc5b0f537d5efc99d614f7

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-R3NBQ.tmp\JFHGSFGSIUGFSUIG.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9aa6ae4c97ad138d7c7eac7cb98f1dec

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  6b6772c8af5ccbd0e1d133780e9965885d7ce72c

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9bf9a7108b9fc87cd68f2b0c856194b7f55e2272e6850b4988de24e1ce697ca5

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  a6a8542561aa33f30d10fea8b74c65c19bdb57c231f44930196da4b37c3b090aa2025e0f0c81b165ca4f60775b6857c620f244a189dc5b0f537d5efc99d614f7

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-SD5JV.tmp\sahiba_5.tmp
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  ace50bc58251a21ff708c2a45b166905

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  3acac0fbed800fe76722b781b7add2cbb7510849

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  af5dd65e23533ed506a34f3a98f1255fccb480c88615ed7cfd0c157fb3f21f9d

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  b484af4387dc5f149b785db515521e10f6a9047cd838130f45745dac000c822766a163c8e988d3763a1a79e93b7436c8cb0ba5cb38e175b8e49b523677746514

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a6279ec92ff948760ce53bba817d6a77

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  a6279ec92ff948760ce53bba817d6a77

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  4d24aa49afc8352934aa94f11bc74b4f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  f0ca806a70fc5ce42c1803a549ee624559effbf0

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  3557b514f9eada3659219bc4c1401d074f814ba82bf137ba0671fec66078d534

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8004d80d858c10dccbb3b4ff33f8bb7ef4747dc9ad0b4bcde213da0adf65c9116753d70b4b72fd6b806cbe3b5f5f2b78fdda9ef64444c80d148329e075afe02b

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  4d24aa49afc8352934aa94f11bc74b4f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  f0ca806a70fc5ce42c1803a549ee624559effbf0

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  3557b514f9eada3659219bc4c1401d074f814ba82bf137ba0671fec66078d534

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8004d80d858c10dccbb3b4ff33f8bb7ef4747dc9ad0b4bcde213da0adf65c9116753d70b4b72fd6b806cbe3b5f5f2b78fdda9ef64444c80d148329e075afe02b

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2087018.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2087018.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\3256201.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8e1e11bba9787b31d4e17c72cfd78e67

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  00a49bf8a404dd1fc84363bbcd8be046808cbfbb

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9e55faf1ac1fd4de98a4c4bf022404507946b23ff14b4653b89c73c7c3d053e6

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  2d006885addd024614182f61887491c4a95f1ae18e1ed44e0bb3b20911cd2970b8c4f850cacb75cd6eba30f66e055b4703be1c4d9cd9ddd29e33f00c7b60d098

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\3256201.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8e1e11bba9787b31d4e17c72cfd78e67

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  00a49bf8a404dd1fc84363bbcd8be046808cbfbb

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  9e55faf1ac1fd4de98a4c4bf022404507946b23ff14b4653b89c73c7c3d053e6

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  2d006885addd024614182f61887491c4a95f1ae18e1ed44e0bb3b20911cd2970b8c4f850cacb75cd6eba30f66e055b4703be1c4d9cd9ddd29e33f00c7b60d098

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\3814690.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  7a5fd8765197791a050e59113aa75e52

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  435502b0f205e9443ac982573a4c171c6e931d52

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  5cf63bd260f54148aa3dae2f312ddbd975e1d6753309aaaa2dd2b4cb8cb1c4f5

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8e1535306b145da46b95ff4e00e233ea87e7c3d3ab3bdd3328c5c1291fca1c3ee2a6ee6fe4736fb7a1f45651371d51281d080efaf621139ca520fba68a779e38

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\3814690.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  7a5fd8765197791a050e59113aa75e52

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  435502b0f205e9443ac982573a4c171c6e931d52

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  5cf63bd260f54148aa3dae2f312ddbd975e1d6753309aaaa2dd2b4cb8cb1c4f5

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  8e1535306b145da46b95ff4e00e233ea87e7c3d3ab3bdd3328c5c1291fca1c3ee2a6ee6fe4736fb7a1f45651371d51281d080efaf621139ca520fba68a779e38

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                                                • C:\Users\Admin\Documents\AQr0TxcJwN7lnztOR2DMhDiy.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  3e3efc3660a22a4ca575db0e8242616f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  e3331db23cacd34eaf96650d2c79c3ce80cc923d

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  08eafd7591e29d9382ba6a8d145923a219d87a530a3dad725c2e02577a9145b8

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  a691183f41aaa26c0af20fc9f2f5f2585b81476195b4758f63b27bf2d17b6480acf042e5afff85a2705fa6e93d7b9d3974ef50eb04234ef12417530ac5e24cd4

                                                                                                                                                                                                                                • C:\Users\Admin\Documents\AQr0TxcJwN7lnztOR2DMhDiy.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  3e3efc3660a22a4ca575db0e8242616f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  e3331db23cacd34eaf96650d2c79c3ce80cc923d

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  08eafd7591e29d9382ba6a8d145923a219d87a530a3dad725c2e02577a9145b8

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  a691183f41aaa26c0af20fc9f2f5f2585b81476195b4758f63b27bf2d17b6480acf042e5afff85a2705fa6e93d7b9d3974ef50eb04234ef12417530ac5e24cd4

                                                                                                                                                                                                                                • C:\Users\Admin\Documents\Rci5B5wWZIUsdzQejIC4g70H.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  c9fa1e8906a247f5bea95fe6851a8628

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  fe9c10cabd3b0ed8c57327da1b4824b5399a8655

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  673453fec6e11175bf0a749c94594c22a886d2f287e9648b51aa305b17109ffd

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  04549c40afcfd66762a7fb7f7b34bd2a9f91c75cf53552b5a51ab9d92071d6c0bdb17c21866dff4205414cdf86548f1eb4b9a4f9170ac162a3ff898d9636b318

                                                                                                                                                                                                                                • C:\Users\Admin\Documents\V6KM3DHzMD4LE7QfuNjM1TnT.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  f334deeca46d3b5349d9ad820df1a8ab

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  9a47f83f159c80b7e157d2e51b2bc0d9a1d31701

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  46b808244406eaac6aaaec7440ee63fba5e0c7b51bc40a49e0db3f17586d0c34

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  a472a98cfeb6af5a48915ab954cae9c44c7eddbc2cc79b1f9ae2bfff09911e352ae1af07bf7cf9b71583e8b520ec874d5510e2560b129faa2385f4d0c79160ee

                                                                                                                                                                                                                                • C:\Users\Admin\Documents\V6KM3DHzMD4LE7QfuNjM1TnT.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  f334deeca46d3b5349d9ad820df1a8ab

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  9a47f83f159c80b7e157d2e51b2bc0d9a1d31701

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  46b808244406eaac6aaaec7440ee63fba5e0c7b51bc40a49e0db3f17586d0c34

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  a472a98cfeb6af5a48915ab954cae9c44c7eddbc2cc79b1f9ae2bfff09911e352ae1af07bf7cf9b71583e8b520ec874d5510e2560b129faa2385f4d0c79160ee

                                                                                                                                                                                                                                • C:\Users\Admin\Documents\fAUUFnhEQqOhskx1TBY7SUHb.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  52729184e252c179cd4b3a53fb470916

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  28b6d60e4bf956ea55dba65721eee1dc1c602fd6

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a8b45657c9b8cadf75f059af37a10c665ad16d5e336d26431416c0599dbc2322

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  951e766ba2a9aa568d904090332c3e66ec428b95463ff49c5a0689d056703a64dc03da1dde084fe68a32ea788942d5c921e4f5774bb622d01fd516c15776d2eb

                                                                                                                                                                                                                                • C:\Users\Admin\Documents\fAUUFnhEQqOhskx1TBY7SUHb.exe
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  52729184e252c179cd4b3a53fb470916

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  28b6d60e4bf956ea55dba65721eee1dc1c602fd6

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  a8b45657c9b8cadf75f059af37a10c665ad16d5e336d26431416c0599dbc2322

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  951e766ba2a9aa568d904090332c3e66ec428b95463ff49c5a0689d056703a64dc03da1dde084fe68a32ea788942d5c921e4f5774bb622d01fd516c15776d2eb

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libcurl.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libcurl.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libcurlpp.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libstdc++-6.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zSC68F9B74\libwinpthread-1.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  50741b3f2d7debf5d2bed63d88404029

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  56210388a627b926162b36967045be06ffb1aad3

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  7d50e41fedea9c1b46139b98629b5ba9

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  f395975657a459c3e07b18b8a7f7dbd515cb3334

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  07a6792d711d3fbea313b9c8273e49dc46d864a053bef0bf0368969560bb7dec

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  76d92cb15da9c8ef5200cfe3cc1c96cac7699af2ae930e0cb34fb75ecca54186e1290f7a47bf1ff03b65f630fe32d09d2f97794b2ab072ea96dc608a6a7065ec

                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\is-R3NBQ.tmp\idp.dll
                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                  8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                  5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                  203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                  043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                                                                                                • memory/68-233-0x000001B8B2440000-0x000001B8B24B1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/204-185-0x0000000004E20000-0x0000000004E21000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/204-172-0x0000000000410000-0x0000000000411000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/204-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/360-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/412-273-0x0000023E837D0000-0x0000023E83841000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/720-226-0x0000018F76D70000-0x0000018F76DE1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/744-364-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/772-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/808-352-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1108-258-0x000001C3CD930000-0x000001C3CD9A1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/1240-295-0x00000216E8060000-0x00000216E80D1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/1296-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1332-298-0x000002186E600000-0x000002186E671000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/1412-282-0x0000026D4D870000-0x0000026D4D8E1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/1428-334-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1428-347-0x0000000005B70000-0x0000000005B71000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1428-339-0x0000000077C50000-0x0000000077DDE000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                • memory/1432-317-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1556-206-0x0000000004D80000-0x0000000004D99000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                • memory/1556-223-0x0000000004DE4000-0x0000000004DE6000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                • memory/1556-205-0x0000000004DE2000-0x0000000004DE3000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-204-0x0000000007290000-0x0000000007291000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-296-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-214-0x0000000007DB0000-0x0000000007DB1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-211-0x0000000007790000-0x0000000007791000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-217-0x0000000007DE0000-0x0000000007DE1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-228-0x0000000003110000-0x000000000313F000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  188KB

                                                                                                                                                                                                                                • memory/1556-301-0x0000000004DE3000-0x0000000004DE4000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-250-0x0000000007FC0000-0x0000000007FC1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1556-238-0x0000000000400000-0x0000000002CA6000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  40.6MB

                                                                                                                                                                                                                                • memory/1556-202-0x00000000049F0000-0x0000000004A0B000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  108KB

                                                                                                                                                                                                                                • memory/1556-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1556-221-0x0000000007E30000-0x0000000007E31000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/1564-361-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1588-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1588-193-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  36KB

                                                                                                                                                                                                                                • memory/1588-195-0x0000000000400000-0x0000000002C8D000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  40.6MB

                                                                                                                                                                                                                                • memory/1936-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/1944-291-0x000002222E140000-0x000002222E1B1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/2084-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2140-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2156-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2196-326-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2208-342-0x0000000000417E22-mapping.dmp
                                                                                                                                                                                                                                • memory/2208-345-0x0000000005290000-0x0000000005896000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                • memory/2212-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2256-338-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2316-360-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2400-256-0x0000029200130000-0x000002920017C000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                • memory/2400-260-0x00000292008D0000-0x0000029200941000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/2408-312-0x0000014B19780000-0x0000014B197F1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/2436-358-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2616-208-0x0000000000400000-0x0000000002CE9000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  40.9MB

                                                                                                                                                                                                                                • memory/2616-203-0x00000000031B0000-0x000000000324D000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  628KB

                                                                                                                                                                                                                                • memory/2616-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2672-300-0x000001A61FAD0000-0x000001A61FB41000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/2688-303-0x000001BF493D0000-0x000001BF49441000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/2744-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2744-170-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  436KB

                                                                                                                                                                                                                                • memory/2760-309-0x0000024F94360000-0x0000024F943D1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/2772-359-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2776-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2784-133-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  572KB

                                                                                                                                                                                                                                • memory/2784-148-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                • memory/2784-152-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                • memory/2784-154-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                • memory/2784-151-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                • memory/2784-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/2784-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                • memory/2784-136-0x0000000000400000-0x000000000051E000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                • memory/2784-135-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  152KB

                                                                                                                                                                                                                                • memory/3016-279-0x0000000002B30000-0x0000000002B45000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  84KB

                                                                                                                                                                                                                                • memory/3348-337-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3484-343-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3540-357-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3676-366-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3724-341-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/3724-333-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3772-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3772-319-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3776-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3784-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3784-191-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/3892-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3932-186-0x0000000000B30000-0x0000000000B31000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/3932-192-0x0000000000E90000-0x0000000000E92000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                • memory/3932-189-0x0000000000B40000-0x0000000000B41000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/3932-176-0x00000000006E0000-0x00000000006E1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/3932-188-0x0000000000E20000-0x0000000000E3D000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  116KB

                                                                                                                                                                                                                                • memory/3932-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/3952-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4108-348-0x0000000000417E9E-mapping.dmp
                                                                                                                                                                                                                                • memory/4108-350-0x0000000004F40000-0x0000000005546000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                • memory/4196-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4220-362-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4224-271-0x0000000004E82000-0x0000000004F83000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                • memory/4224-290-0x0000000004FF0000-0x000000000504D000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  372KB

                                                                                                                                                                                                                                • memory/4224-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4228-336-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4320-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4320-307-0x0000000002CA0000-0x0000000002CA2000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                • memory/4348-324-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4356-355-0x0000022008090000-0x0000022008196000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                • memory/4356-215-0x00007FF781A44060-mapping.dmp
                                                                                                                                                                                                                                • memory/4356-311-0x0000022005940000-0x00000220059B1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                • memory/4356-354-0x00000220056E0000-0x00000220056FB000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  108KB

                                                                                                                                                                                                                                • memory/4380-368-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4508-280-0x00000000010C0000-0x00000000010C1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4508-232-0x00000000007F0000-0x00000000007F1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4508-270-0x0000000001050000-0x0000000001081000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  196KB

                                                                                                                                                                                                                                • memory/4508-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4508-245-0x00000000010F0000-0x00000000010F1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4508-269-0x0000000005060000-0x0000000005061000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4548-254-0x00000000015A0000-0x00000000015AE000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                • memory/4548-251-0x0000000001540000-0x0000000001541000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4548-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4548-243-0x0000000000D70000-0x0000000000D71000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4548-263-0x0000000005570000-0x0000000005571000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4548-259-0x000000000AB20000-0x000000000AB21000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4620-284-0x0000000004D80000-0x0000000004D81000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4620-253-0x0000000002460000-0x0000000002461000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4620-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4620-265-0x0000000002520000-0x0000000002521000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4620-246-0x0000000000410000-0x0000000000411000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4620-261-0x0000000004D00000-0x0000000004D37000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  220KB

                                                                                                                                                                                                                                • memory/4636-367-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4672-344-0x0000000004B10000-0x0000000004B11000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/4672-331-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4824-314-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4844-363-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4852-340-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4872-318-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4968-332-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/4968-346-0x0000000004AC0000-0x0000000004B36000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                • memory/5024-330-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/5028-335-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/5044-351-0x0000000005270000-0x0000000005876000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                • memory/5044-349-0x0000000000417E8E-mapping.dmp
                                                                                                                                                                                                                                • memory/5056-304-0x00000000054C0000-0x00000000054C1000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                • memory/5056-283-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/5072-365-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                • memory/5076-356-0x0000000005060000-0x0000000005666000-memory.dmp
                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                • memory/5076-353-0x0000000000417E8A-mapping.dmp
                                                                                                                                                                                                                                • memory/5448-369-0x0000000000402F68-mapping.dmp