Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-08-2021 06:46

General

  • Target

    a447d89f3c72c8f5c81e9cac1b3eeb53.exe

  • Size

    3.2MB

  • MD5

    a447d89f3c72c8f5c81e9cac1b3eeb53

  • SHA1

    e5693ec6ef7d5b5d872130d33c05a10160a127c9

  • SHA256

    7ca942cc19eb3d9f6bd2e5947eb77af104948ccea1f4b96c87270e91065650c7

  • SHA512

    dc4ee7dcec578bc38caccdcebdbf4ee13c4dd2b10fb2538f164e92f2216c359184022b30a8aaa5c6f1a6b2dd360ae7f75d0005be26efdadb0e9f04a890741d4b

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

706

C2

https://prophefliloc.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 3 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata: ET MALWARE GCleaner Downloader Activity M1

  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Nirsoft 2 IoCs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 1 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 50 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
      PID:1088
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2440
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2840
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2696
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
            PID:2680
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2432
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1952
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1376
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1332
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1184
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1028
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:340
                      • C:\Users\Admin\AppData\Local\Temp\a447d89f3c72c8f5c81e9cac1b3eeb53.exe
                        "C:\Users\Admin\AppData\Local\Temp\a447d89f3c72c8f5c81e9cac1b3eeb53.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:804
                        • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\setup_install.exe
                          "C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\setup_install.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:3184
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sahiba_1.exe
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3620
                            • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_1.exe
                              sahiba_1.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3976
                              • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_1.exe
                                "C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_1.exe" -a
                                5⤵
                                • Executes dropped EXE
                                PID:4164
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sahiba_2.exe
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1272
                            • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_2.exe
                              sahiba_2.exe
                              4⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: MapViewOfSection
                              PID:4032
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sahiba_3.exe
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2224
                            • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_3.exe
                              sahiba_3.exe
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks processor information in registry
                              PID:3864
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c taskkill /im sahiba_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_3.exe" & del C:\ProgramData\*.dll & exit
                                5⤵
                                  PID:5236
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /im sahiba_3.exe /f
                                    6⤵
                                    • Kills process with taskkill
                                    PID:5388
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /t 6
                                    6⤵
                                    • Delays execution with timeout.exe
                                    PID:5472
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sahiba_4.exe
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2152
                              • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_4.exe
                                sahiba_4.exe
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:68
                                • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                  "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4292
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                    6⤵
                                      PID:2380
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                        7⤵
                                        • Creates scheduled task(s)
                                        PID:5712
                                    • C:\Users\Admin\AppData\Roaming\services64.exe
                                      "C:\Users\Admin\AppData\Roaming\services64.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:6116
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                        7⤵
                                          PID:4256
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                            8⤵
                                            • Creates scheduled task(s)
                                            PID:3700
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:6036
                                        • C:\Windows\explorer.exe
                                          C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                          7⤵
                                            PID:4100
                                      • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:4352
                                        • C:\Windows\winnetdriv.exe
                                          "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1628499002 0
                                          6⤵
                                          • Executes dropped EXE
                                          PID:4672
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sahiba_5.exe
                                    3⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2220
                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_5.exe
                                      sahiba_5.exe
                                      4⤵
                                      • Executes dropped EXE
                                      PID:184
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        5⤵
                                        • Executes dropped EXE
                                        PID:4192
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2152
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        5⤵
                                          PID:5628
                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          5⤵
                                          • Executes dropped EXE
                                          PID:6084
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sahiba_6.exe
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2176
                                      • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_6.exe
                                        sahiba_6.exe
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4048
                                        • C:\Users\Admin\AppData\Roaming\5708999.exe
                                          "C:\Users\Admin\AppData\Roaming\5708999.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4476
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 4476 -s 2064
                                            6⤵
                                            • Program crash
                                            PID:2264
                                        • C:\Users\Admin\AppData\Roaming\4427079.exe
                                          "C:\Users\Admin\AppData\Roaming\4427079.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4688
                                        • C:\Users\Admin\AppData\Roaming\8274092.exe
                                          "C:\Users\Admin\AppData\Roaming\8274092.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4596
                                        • C:\Users\Admin\AppData\Roaming\7855382.exe
                                          "C:\Users\Admin\AppData\Roaming\7855382.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          PID:4520
                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2240
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sahiba_7.exe
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2208
                                      • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_7.exe
                                        sahiba_7.exe
                                        4⤵
                                        • Executes dropped EXE
                                        • Checks computer location settings
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3180
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1208
                                          5⤵
                                          • Program crash
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4800
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sahiba_8.exe
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2144
                                      • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_8.exe
                                        sahiba_8.exe
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:940
                                        • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                          "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          PID:4432
                                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                            "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4988
                                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                              "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                              7⤵
                                              • Executes dropped EXE
                                              PID:4396
                                          • C:\Users\Admin\AppData\Local\Temp\2no.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2no.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4916
                                            • C:\Windows\system32\WerFault.exe
                                              C:\Windows\system32\WerFault.exe -u -p 4916 -s 1208
                                              7⤵
                                              • Program crash
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4924
                                          • C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
                                            "C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3332
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c taskkill /f /im chrome.exe
                                              7⤵
                                                PID:5708
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /f /im chrome.exe
                                                  8⤵
                                                  • Kills process with taskkill
                                                  PID:5920
                                            • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:3192
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                7⤵
                                                  PID:4536
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                    8⤵
                                                    • Creates scheduled task(s)
                                                    PID:5384
                                              • C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
                                                "C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4120
                                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:4812
                                                  • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Modifies data under HKEY_USERS
                                                    PID:5628
                                              • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:3132
                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:800
                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:5584
                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:6100
                                              • C:\Users\Admin\AppData\Local\Temp\mysetnew.exe
                                                "C:\Users\Admin\AppData\Local\Temp\mysetnew.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:1116
                                              • C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe
                                                "C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4556
                                                • C:\Users\Admin\AppData\Roaming\4828952.exe
                                                  "C:\Users\Admin\AppData\Roaming\4828952.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4416
                                                • C:\Users\Admin\AppData\Roaming\2517001.exe
                                                  "C:\Users\Admin\AppData\Roaming\2517001.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:4508
                                                • C:\Users\Admin\AppData\Roaming\2098291.exe
                                                  "C:\Users\Admin\AppData\Roaming\2098291.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: SetClipboardViewer
                                                  PID:4776
                                                • C:\Users\Admin\AppData\Roaming\8231466.exe
                                                  "C:\Users\Admin\AppData\Roaming\8231466.exe"
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5008
                                              • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:4704
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 800
                                                  7⤵
                                                  • Program crash
                                                  PID:4356
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 832
                                                  7⤵
                                                  • Program crash
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4356
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 880
                                                  7⤵
                                                  • Program crash
                                                  PID:5364
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 884
                                                  7⤵
                                                  • Program crash
                                                  PID:5460
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 952
                                                  7⤵
                                                  • Program crash
                                                  PID:5544
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1136
                                                  7⤵
                                                  • Program crash
                                                  PID:5872
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1224
                                                  7⤵
                                                  • Program crash
                                                  PID:5972
                                              • C:\Users\Admin\AppData\Local\Temp\setup329.exe
                                                "C:\Users\Admin\AppData\Local\Temp\setup329.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:4572
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sahiba_9.exe
                                          3⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3584
                                          • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_9.exe
                                            sahiba_9.exe
                                            4⤵
                                            • Executes dropped EXE
                                            PID:768
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              5⤵
                                              • Executes dropped EXE
                                              PID:2012
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              5⤵
                                              • Executes dropped EXE
                                              PID:4344
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              5⤵
                                              • Executes dropped EXE
                                              PID:5512
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              5⤵
                                              • Executes dropped EXE
                                              PID:6112
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                      1⤵
                                      • Suspicious use of SetThreadContext
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1224
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                        • Drops file in System32 directory
                                        • Checks processor information in registry
                                        • Modifies data under HKEY_USERS
                                        • Modifies registry class
                                        PID:4244
                                    • C:\Windows\system32\rundll32.exe
                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                      1⤵
                                      • Process spawned unexpected child process
                                      PID:3860
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                        2⤵
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4592
                                    • C:\Windows\system32\rundll32.exe
                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                      1⤵
                                      • Process spawned unexpected child process
                                      PID:5656
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                        2⤵
                                        • Loads dropped DLL
                                        PID:5672
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 620
                                          3⤵
                                          • Program crash
                                          PID:5732
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                      1⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      PID:5560

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                      MD5

                                      f7dcb24540769805e5bb30d193944dce

                                      SHA1

                                      e26c583c562293356794937d9e2e6155d15449ee

                                      SHA256

                                      6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

                                      SHA512

                                      cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                      MD5

                                      e7cbeac864a5ffd3b412211765912b5b

                                      SHA1

                                      c5684f3cfbbaefbaf37ff1834645d1d202d4b1f1

                                      SHA256

                                      2581c007cdf598ee689be74144d5e0baac8998fc2ec873c1a258d67f3f2aa59a

                                      SHA512

                                      ca44ea5fc0c0263efa7a05e615c8fa9236ce6a2cdb571bd04b54a4c1ec3d49599cd4388654e364a6a16421908145b12308394d40acff518bbc468bdb4ee495da

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                      MD5

                                      71b2d61aaaf91b42785e7f4898c5e023

                                      SHA1

                                      35fcbf1efaf0933c497b9e8eea80c2b8ae68b339

                                      SHA256

                                      495bea31a30f7229eba6827119bc4bb72fa12e9a5f208de86efb5a4c01a685a4

                                      SHA512

                                      c72c77141a0c91ef071901229e9d2b2ff81f7c3fde28b261af34738248557023827c5926d4c46901cfc7701e256bb34ef911129d8fb473a6f77bfbe67017f2a7

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                      MD5

                                      3581575bc707a7d642fe68f61b27aaf7

                                      SHA1

                                      e14a52d8d04e7bcf73dd5936172055cecedef645

                                      SHA256

                                      0b713a72bbd00daab8dddbccf3231380608064161b40a130d4f3fcf34691348a

                                      SHA512

                                      ad5329abc33b88e1e6104bf44eec5db52216df195db13ea8b4376961126862e2410b655301a50ba0c1bc4951a3859ec7a4a27c47a040dbfaba16fc4b2b36fb26

                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      MD5

                                      cc0d6b6813f92dbf5be3ecacf44d662a

                                      SHA1

                                      b968c57a14ddada4128356f6e39fb66c6d864d3f

                                      SHA256

                                      0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                      SHA512

                                      4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                    • C:\Users\Admin\AppData\Local\Temp\2no.exe
                                      MD5

                                      a184fb9439436d65ee5879b3ab511828

                                      SHA1

                                      db6e07aafefbc89a0b3a51c0b4768f5a33d74f34

                                      SHA256

                                      4e5a49a02dd6c3d9c08f782ebab2fd56c1296ab20149a36f340fd24404140a26

                                      SHA512

                                      8683de03dc56c26656129b35f9dbbfbd8f4a3f9bac7900273171bcb1267828d28f0f1c4d31a99859f8ae85d38cc9741c49ad3e5396dc1ef4cc863ddaa6d6d468

                                    • C:\Users\Admin\AppData\Local\Temp\2no.exe
                                      MD5

                                      a184fb9439436d65ee5879b3ab511828

                                      SHA1

                                      db6e07aafefbc89a0b3a51c0b4768f5a33d74f34

                                      SHA256

                                      4e5a49a02dd6c3d9c08f782ebab2fd56c1296ab20149a36f340fd24404140a26

                                      SHA512

                                      8683de03dc56c26656129b35f9dbbfbd8f4a3f9bac7900273171bcb1267828d28f0f1c4d31a99859f8ae85d38cc9741c49ad3e5396dc1ef4cc863ddaa6d6d468

                                    • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                      MD5

                                      e511bb4cf31a2307b6f3445a869bcf31

                                      SHA1

                                      76f5c6e8df733ac13d205d426831ed7672a05349

                                      SHA256

                                      56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137

                                      SHA512

                                      9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

                                    • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                      MD5

                                      e511bb4cf31a2307b6f3445a869bcf31

                                      SHA1

                                      76f5c6e8df733ac13d205d426831ed7672a05349

                                      SHA256

                                      56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137

                                      SHA512

                                      9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\libcurl.dll
                                      MD5

                                      d09be1f47fd6b827c81a4812b4f7296f

                                      SHA1

                                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                      SHA256

                                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                      SHA512

                                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\libcurlpp.dll
                                      MD5

                                      e6e578373c2e416289a8da55f1dc5e8e

                                      SHA1

                                      b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                      SHA256

                                      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                      SHA512

                                      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\libgcc_s_dw2-1.dll
                                      MD5

                                      9aec524b616618b0d3d00b27b6f51da1

                                      SHA1

                                      64264300801a353db324d11738ffed876550e1d3

                                      SHA256

                                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                      SHA512

                                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\libstdc++-6.dll
                                      MD5

                                      5e279950775baae5fea04d2cc4526bcc

                                      SHA1

                                      8aef1e10031c3629512c43dd8b0b5d9060878453

                                      SHA256

                                      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                      SHA512

                                      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\libwinpthread-1.dll
                                      MD5

                                      1e0d62c34ff2e649ebc5c372065732ee

                                      SHA1

                                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                      SHA256

                                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                      SHA512

                                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_1.exe
                                      MD5

                                      c0d18a829910babf695b4fdaea21a047

                                      SHA1

                                      236a19746fe1a1063ebe077c8a0553566f92ef0f

                                      SHA256

                                      78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

                                      SHA512

                                      cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_1.exe
                                      MD5

                                      c0d18a829910babf695b4fdaea21a047

                                      SHA1

                                      236a19746fe1a1063ebe077c8a0553566f92ef0f

                                      SHA256

                                      78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

                                      SHA512

                                      cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_1.txt
                                      MD5

                                      c0d18a829910babf695b4fdaea21a047

                                      SHA1

                                      236a19746fe1a1063ebe077c8a0553566f92ef0f

                                      SHA256

                                      78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

                                      SHA512

                                      cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_2.exe
                                      MD5

                                      13d4228eebba30a121c8544a5493b16a

                                      SHA1

                                      7dff5b6638e6e840e1b4ecaa83406f3173bbb0fd

                                      SHA256

                                      3ed9c981d1b1c61fc0de3e7973af1a6f9cad82f4509a01f51efb0ca29cd0e5ca

                                      SHA512

                                      b118e4305f72f2811f79dbda7b08c35b20b2ac44c4db34002c7735b1e9eb4f404fcdb6d785345c30f52ce05955b34d25cdfc192f2f56e1f3470e222ffbb1a996

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_2.txt
                                      MD5

                                      13d4228eebba30a121c8544a5493b16a

                                      SHA1

                                      7dff5b6638e6e840e1b4ecaa83406f3173bbb0fd

                                      SHA256

                                      3ed9c981d1b1c61fc0de3e7973af1a6f9cad82f4509a01f51efb0ca29cd0e5ca

                                      SHA512

                                      b118e4305f72f2811f79dbda7b08c35b20b2ac44c4db34002c7735b1e9eb4f404fcdb6d785345c30f52ce05955b34d25cdfc192f2f56e1f3470e222ffbb1a996

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_3.exe
                                      MD5

                                      fc1bf039d6e2275262ee314cb5dcdcb9

                                      SHA1

                                      596c821bf1be4690daec15c62cf6457b0b5de722

                                      SHA256

                                      12f2a4af5a7e54ff55a57549d351315ad3e1dac80aef43200f1abdd20b1a3f00

                                      SHA512

                                      4a0a8715913f6502eaa43767ee9a821457814329a16023192287a31bf2e5ff68a021dbcb858900160dcac03b901a4166fbf858d8f6f44af95f22f8627457a374

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_3.txt
                                      MD5

                                      fc1bf039d6e2275262ee314cb5dcdcb9

                                      SHA1

                                      596c821bf1be4690daec15c62cf6457b0b5de722

                                      SHA256

                                      12f2a4af5a7e54ff55a57549d351315ad3e1dac80aef43200f1abdd20b1a3f00

                                      SHA512

                                      4a0a8715913f6502eaa43767ee9a821457814329a16023192287a31bf2e5ff68a021dbcb858900160dcac03b901a4166fbf858d8f6f44af95f22f8627457a374

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_4.exe
                                      MD5

                                      13a289feeb15827860a55bbc5e5d498f

                                      SHA1

                                      e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad

                                      SHA256

                                      c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775

                                      SHA512

                                      00c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_4.txt
                                      MD5

                                      13a289feeb15827860a55bbc5e5d498f

                                      SHA1

                                      e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad

                                      SHA256

                                      c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775

                                      SHA512

                                      00c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_5.exe
                                      MD5

                                      8cad9c4c58553ec0ca5fd50aec791b8a

                                      SHA1

                                      a2a4385cb2df58455764eb879b5d6aaf5e3585ac

                                      SHA256

                                      f092024f873461b61234b97fcb07c8589dcc9a801cf8a0a6e302dbd746bab294

                                      SHA512

                                      1eeac808dd992a7b99448d8a1c5470a2964b14705b4e987d9cb2e227a8142122faa17bf8a9acba6db4e80a42b50b58536e748a3231736b9b705d630f941159a3

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_5.txt
                                      MD5

                                      8cad9c4c58553ec0ca5fd50aec791b8a

                                      SHA1

                                      a2a4385cb2df58455764eb879b5d6aaf5e3585ac

                                      SHA256

                                      f092024f873461b61234b97fcb07c8589dcc9a801cf8a0a6e302dbd746bab294

                                      SHA512

                                      1eeac808dd992a7b99448d8a1c5470a2964b14705b4e987d9cb2e227a8142122faa17bf8a9acba6db4e80a42b50b58536e748a3231736b9b705d630f941159a3

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_6.exe
                                      MD5

                                      c2fc45bff7f1962f4bf80d0400075760

                                      SHA1

                                      493ea1e415f8a733a1f78c5a72c9a2f28fd228c4

                                      SHA256

                                      bfaa3e81e84266f3c696578b4aedc023d98d2c1f0840e693cdf581f7a10c503d

                                      SHA512

                                      143db60d1676d90ecbfe2541d84ae77fed39b5a3f4ea8e9c64d1d3e25c0b9d5abd513dec6f2357a27a922016412572343675109a95f766ed640cc89ba8598def

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_6.txt
                                      MD5

                                      c2fc45bff7f1962f4bf80d0400075760

                                      SHA1

                                      493ea1e415f8a733a1f78c5a72c9a2f28fd228c4

                                      SHA256

                                      bfaa3e81e84266f3c696578b4aedc023d98d2c1f0840e693cdf581f7a10c503d

                                      SHA512

                                      143db60d1676d90ecbfe2541d84ae77fed39b5a3f4ea8e9c64d1d3e25c0b9d5abd513dec6f2357a27a922016412572343675109a95f766ed640cc89ba8598def

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_7.exe
                                      MD5

                                      62ca6931bc7a374f80ff8541138baa9e

                                      SHA1

                                      d36e63034bddf32d3c79106a75cfa679cfdd336a

                                      SHA256

                                      5dbe764c587a5a27b0daaa1b3a56a2ac4047cc78c2b878ae49589c2ec55c350a

                                      SHA512

                                      5e7e4edefa978e7e355ee9692ff925241c7d1e4f1aff0f3e4068685b6a3eb00638a2706cda0a0581e240dc31e18b96c41fbc7f9e42f30673a29b7c995ddd8952

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_7.txt
                                      MD5

                                      62ca6931bc7a374f80ff8541138baa9e

                                      SHA1

                                      d36e63034bddf32d3c79106a75cfa679cfdd336a

                                      SHA256

                                      5dbe764c587a5a27b0daaa1b3a56a2ac4047cc78c2b878ae49589c2ec55c350a

                                      SHA512

                                      5e7e4edefa978e7e355ee9692ff925241c7d1e4f1aff0f3e4068685b6a3eb00638a2706cda0a0581e240dc31e18b96c41fbc7f9e42f30673a29b7c995ddd8952

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_8.exe
                                      MD5

                                      c85639691074f9d98ec530901c153d2b

                                      SHA1

                                      cac948e5b1f9d7417e7c5ead543fda1108f0e9ed

                                      SHA256

                                      55701c6e51fb6a9820d8f9d2ae9db412b60f51c80d288e8baf0ea50e2d03cce4

                                      SHA512

                                      4911ce27e56bac29b247840e6c9de78e875210fd0588d11d9e3a3eae39764bfdd14b56de5de4cf535674a2ba0810c9d823f42b339f650dedb7af42f8b3fd4c6d

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_8.txt
                                      MD5

                                      c85639691074f9d98ec530901c153d2b

                                      SHA1

                                      cac948e5b1f9d7417e7c5ead543fda1108f0e9ed

                                      SHA256

                                      55701c6e51fb6a9820d8f9d2ae9db412b60f51c80d288e8baf0ea50e2d03cce4

                                      SHA512

                                      4911ce27e56bac29b247840e6c9de78e875210fd0588d11d9e3a3eae39764bfdd14b56de5de4cf535674a2ba0810c9d823f42b339f650dedb7af42f8b3fd4c6d

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_9.exe
                                      MD5

                                      5c2e28dedae0e088fc1f9b50d7d28c12

                                      SHA1

                                      f521d9d8ae7381e3953ae5cf33b4b1b37f67a193

                                      SHA256

                                      2261a3d740572f9d0ee42faad5b0d405df16506e104bd912e7c7b24d7fddcc5f

                                      SHA512

                                      f6f100508acb77af5b3442673c9d01a6a16cc39521b618eebccd482bf9f50b3991109f82b97e48e8c3cc0221f0be9e164867ba79ac2f2bc4e25cbdb5f7daa15f

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\sahiba_9.txt
                                      MD5

                                      5c2e28dedae0e088fc1f9b50d7d28c12

                                      SHA1

                                      f521d9d8ae7381e3953ae5cf33b4b1b37f67a193

                                      SHA256

                                      2261a3d740572f9d0ee42faad5b0d405df16506e104bd912e7c7b24d7fddcc5f

                                      SHA512

                                      f6f100508acb77af5b3442673c9d01a6a16cc39521b618eebccd482bf9f50b3991109f82b97e48e8c3cc0221f0be9e164867ba79ac2f2bc4e25cbdb5f7daa15f

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\setup_install.exe
                                      MD5

                                      ed3cf04a534ea39e173c7925f50204dc

                                      SHA1

                                      23251d98a9e3e9cd9d884d1c80e34880bd7a1200

                                      SHA256

                                      d231ebe7bd40f8b150822913bcd85139e0e4f015d4822eab61f45410ba6b977e

                                      SHA512

                                      e3085ad1567f8bc3f484303278b56896b999b2fdcf1b8346d73820d6b53223a63c649096e12d761b6a4bb36f4e581eb517b346fcc670393f4a6eba1809d5fd9a

                                    • C:\Users\Admin\AppData\Local\Temp\7zS423F5E94\setup_install.exe
                                      MD5

                                      ed3cf04a534ea39e173c7925f50204dc

                                      SHA1

                                      23251d98a9e3e9cd9d884d1c80e34880bd7a1200

                                      SHA256

                                      d231ebe7bd40f8b150822913bcd85139e0e4f015d4822eab61f45410ba6b977e

                                      SHA512

                                      e3085ad1567f8bc3f484303278b56896b999b2fdcf1b8346d73820d6b53223a63c649096e12d761b6a4bb36f4e581eb517b346fcc670393f4a6eba1809d5fd9a

                                    • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                      MD5

                                      93460c75de91c3601b4a47d2b99d8f94

                                      SHA1

                                      f2e959a3291ef579ae254953e62d098fe4557572

                                      SHA256

                                      0fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2

                                      SHA512

                                      4370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856

                                    • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                      MD5

                                      93460c75de91c3601b4a47d2b99d8f94

                                      SHA1

                                      f2e959a3291ef579ae254953e62d098fe4557572

                                      SHA256

                                      0fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2

                                      SHA512

                                      4370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856

                                    • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                      MD5

                                      6e60648013bfa07ef341fd8a1e8bd5b9

                                      SHA1

                                      9e2682c280492a24a5f1600b1d476ecdca64a037

                                      SHA256

                                      946340d77c3127b9aca79a59f3b8d50cea0b455240ced1e7b107a38d9606e4dc

                                      SHA512

                                      212eb18f743987b3e690d54559796069d074f5b9591228ec25bb2ecca352289970276b334088664329822f5a3793e2fd6daf61daec415b8ddf15c5a7bdb986bf

                                    • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                      MD5

                                      67d494e74130b1a9c48a598ad8ed02f2

                                      SHA1

                                      c4d4025ae551292b80d066bda77dfe7f429283e7

                                      SHA256

                                      60e34c1306ab9d2633ab22eebe12b1b62d0015db0f4a6b8859b6318b6c2a2f39

                                      SHA512

                                      3b54755ff0b98f9dda46c3a1ca440c1ea9ac1ee6b9ee9a5f3f77ab6ee169d7660702eae4c9c0b48501bb0c21b28f94b0339d0a370639db7399a39a085fcec36a

                                    • C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
                                      MD5

                                      09bbb3e275b933030e970564ac22fe77

                                      SHA1

                                      a26b0b1fa8085aba01f4215af7c3347ae5ebd53c

                                      SHA256

                                      e5f67dca4decc6164f5fa50bb6343ee98ae743e6d04bfdb42d790feef2e4e565

                                      SHA512

                                      9d2300c8aebab886310e97916bfb07e1858151eb88910c7d892b7c5519aaec6a2027ee6b8f46e76b121254ac95591d98bc5b0995b99d28d2a622fcb860d19be7

                                    • C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
                                      MD5

                                      09bbb3e275b933030e970564ac22fe77

                                      SHA1

                                      a26b0b1fa8085aba01f4215af7c3347ae5ebd53c

                                      SHA256

                                      e5f67dca4decc6164f5fa50bb6343ee98ae743e6d04bfdb42d790feef2e4e565

                                      SHA512

                                      9d2300c8aebab886310e97916bfb07e1858151eb88910c7d892b7c5519aaec6a2027ee6b8f46e76b121254ac95591d98bc5b0995b99d28d2a622fcb860d19be7

                                    • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                      MD5

                                      ad0aca1934f02768fd5fedaf4d9762a3

                                      SHA1

                                      0e5b8372015d81200c4eff22823e854d0030f305

                                      SHA256

                                      dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

                                      SHA512

                                      2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

                                    • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                      MD5

                                      ad0aca1934f02768fd5fedaf4d9762a3

                                      SHA1

                                      0e5b8372015d81200c4eff22823e854d0030f305

                                      SHA256

                                      dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

                                      SHA512

                                      2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

                                    • C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
                                      MD5

                                      2994f333c257ef9f23b858efecf89b80

                                      SHA1

                                      9a1340db49bb76d5dd47dfc1f1dcc20c1358962c

                                      SHA256

                                      d9217ab0514407bb3d3cfa017662430af4b9f867235817d5bb59ec3ee369dfbe

                                      SHA512

                                      441222a769d606cdfc0ae59d3b7f49b2160e4a2c461f3af44fdf9e7f8f884051e2748e81e42600cf4626aaaa3bdde8a47d22543b27133fd6417996bd3f5a098c

                                    • C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
                                      MD5

                                      2994f333c257ef9f23b858efecf89b80

                                      SHA1

                                      9a1340db49bb76d5dd47dfc1f1dcc20c1358962c

                                      SHA256

                                      d9217ab0514407bb3d3cfa017662430af4b9f867235817d5bb59ec3ee369dfbe

                                      SHA512

                                      441222a769d606cdfc0ae59d3b7f49b2160e4a2c461f3af44fdf9e7f8f884051e2748e81e42600cf4626aaaa3bdde8a47d22543b27133fd6417996bd3f5a098c

                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                      MD5

                                      d146d791f01967ec4a035053c208c73c

                                      SHA1

                                      5df356136f98c6d6bfce8af9acacbdf0ea288286

                                      SHA256

                                      bbe295e4bb330d2e627c1af449ee3cb1ec44ec91ce10d12bd955d7c0e4920ad8

                                      SHA512

                                      ea3330aa00a7a6068300f158602bcc4cbc8ace04fb6bcead9b171e8bc562c2b6938942178034ab3fae67029b17e3514ec3b604416857bdd2351a0c70c6d4cbbb

                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                      MD5

                                      0bb8cacf3c046bec8b536c4c335f9479

                                      SHA1

                                      1b44dd2ab20f7f9aeaf0bfc8483dcd2957a9cc07

                                      SHA256

                                      373c4464d3e2f46958cdbae4e667f190313c6c6e890c730a93951af0a4a6f213

                                      SHA512

                                      4569ce84209113218948d711b86ea85aba55b34c531bd9e42059e7aafb753d5114327852fa053d843acaee752092ecd6bb2e5d28d83ff89739180675fd60ed8c

                                    • C:\Users\Admin\AppData\Roaming\4427079.exe
                                      MD5

                                      6437bafafc060dc4915b3d8db7352cdd

                                      SHA1

                                      f3f984d65447e305a045eb8daefa5d59e7e9c675

                                      SHA256

                                      3fccf12727e907eb8e03643fd8455496aed6cf27867ec8bae0a0a056ac00e907

                                      SHA512

                                      956ec0a91a7dd15f50ef31178c259b4a5b5c901cab96c38a347c093995589f215ef90234f67f5008107fd788467f9c6271d68606e096016b3adfb12e3d899301

                                    • C:\Users\Admin\AppData\Roaming\4427079.exe
                                      MD5

                                      6437bafafc060dc4915b3d8db7352cdd

                                      SHA1

                                      f3f984d65447e305a045eb8daefa5d59e7e9c675

                                      SHA256

                                      3fccf12727e907eb8e03643fd8455496aed6cf27867ec8bae0a0a056ac00e907

                                      SHA512

                                      956ec0a91a7dd15f50ef31178c259b4a5b5c901cab96c38a347c093995589f215ef90234f67f5008107fd788467f9c6271d68606e096016b3adfb12e3d899301

                                    • C:\Users\Admin\AppData\Roaming\5708999.exe
                                      MD5

                                      bba81621c4ece8633131e80cad9ddd2a

                                      SHA1

                                      ea80bbf10fd0db8ac4cd5a27e63fc1c442a4aabb

                                      SHA256

                                      06994ad4eab0c8121d8fdced16ff9a1601015b6ebebff9bda7a93abf01ab4723

                                      SHA512

                                      d8165909dbd3285e5fd500cd13cc7615fc87c8c9502f591922b5bcc604c259aba078a468033c441bcd45f9718fe9437033f252d601d6982a91bd1fd92bf6056e

                                    • C:\Users\Admin\AppData\Roaming\5708999.exe
                                      MD5

                                      bba81621c4ece8633131e80cad9ddd2a

                                      SHA1

                                      ea80bbf10fd0db8ac4cd5a27e63fc1c442a4aabb

                                      SHA256

                                      06994ad4eab0c8121d8fdced16ff9a1601015b6ebebff9bda7a93abf01ab4723

                                      SHA512

                                      d8165909dbd3285e5fd500cd13cc7615fc87c8c9502f591922b5bcc604c259aba078a468033c441bcd45f9718fe9437033f252d601d6982a91bd1fd92bf6056e

                                    • C:\Users\Admin\AppData\Roaming\7855382.exe
                                      MD5

                                      1d095bc417db73c6bc6e4c4e7b43106f

                                      SHA1

                                      db7e49df1fb5a0a665976f98ff7128aeba40c5f3

                                      SHA256

                                      b529e11f2a855b7e7bca65ac994be9dc81191c7fe1b720addb90b98da33e7fee

                                      SHA512

                                      3d255ee420aa7eb0f5f28e060d968bf4369f4be3fc8f07bd32c5482fea055e8103347440d41d17d847c5b2b2d3fb2e3a40356db1a33911c0b25828739a88a097

                                    • C:\Users\Admin\AppData\Roaming\7855382.exe
                                      MD5

                                      1d095bc417db73c6bc6e4c4e7b43106f

                                      SHA1

                                      db7e49df1fb5a0a665976f98ff7128aeba40c5f3

                                      SHA256

                                      b529e11f2a855b7e7bca65ac994be9dc81191c7fe1b720addb90b98da33e7fee

                                      SHA512

                                      3d255ee420aa7eb0f5f28e060d968bf4369f4be3fc8f07bd32c5482fea055e8103347440d41d17d847c5b2b2d3fb2e3a40356db1a33911c0b25828739a88a097

                                    • C:\Users\Admin\AppData\Roaming\8274092.exe
                                      MD5

                                      237a01f4ef3fd3cb900f6d90d151e358

                                      SHA1

                                      71c120fcc89de9353335ad739f4be3bd4adacda3

                                      SHA256

                                      fb88585498d6248539afed1619c9c004dc979c5daf98093602fe9b0ea28efd27

                                      SHA512

                                      2c5fa2f7bacf927cd04740ac8206bf886af329dfa64b0a5fd543ef235aa240483f6016d933a0c9aee14928383894452ee61decf802f672fe4815b74c42906e45

                                    • C:\Users\Admin\AppData\Roaming\8274092.exe
                                      MD5

                                      237a01f4ef3fd3cb900f6d90d151e358

                                      SHA1

                                      71c120fcc89de9353335ad739f4be3bd4adacda3

                                      SHA256

                                      fb88585498d6248539afed1619c9c004dc979c5daf98093602fe9b0ea28efd27

                                      SHA512

                                      2c5fa2f7bacf927cd04740ac8206bf886af329dfa64b0a5fd543ef235aa240483f6016d933a0c9aee14928383894452ee61decf802f672fe4815b74c42906e45

                                    • C:\Windows\winnetdriv.exe
                                      MD5

                                      01ad10e59fa396af2d5443c5a14c1b21

                                      SHA1

                                      f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

                                      SHA256

                                      bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

                                      SHA512

                                      1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

                                    • C:\Windows\winnetdriv.exe
                                      MD5

                                      01ad10e59fa396af2d5443c5a14c1b21

                                      SHA1

                                      f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

                                      SHA256

                                      bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

                                      SHA512

                                      1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

                                    • \Users\Admin\AppData\Local\Temp\7zS423F5E94\libcurl.dll
                                      MD5

                                      d09be1f47fd6b827c81a4812b4f7296f

                                      SHA1

                                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                      SHA256

                                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                      SHA512

                                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                    • \Users\Admin\AppData\Local\Temp\7zS423F5E94\libcurl.dll
                                      MD5

                                      d09be1f47fd6b827c81a4812b4f7296f

                                      SHA1

                                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                      SHA256

                                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                      SHA512

                                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                    • \Users\Admin\AppData\Local\Temp\7zS423F5E94\libcurlpp.dll
                                      MD5

                                      e6e578373c2e416289a8da55f1dc5e8e

                                      SHA1

                                      b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                      SHA256

                                      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                      SHA512

                                      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                    • \Users\Admin\AppData\Local\Temp\7zS423F5E94\libgcc_s_dw2-1.dll
                                      MD5

                                      9aec524b616618b0d3d00b27b6f51da1

                                      SHA1

                                      64264300801a353db324d11738ffed876550e1d3

                                      SHA256

                                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                      SHA512

                                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                    • \Users\Admin\AppData\Local\Temp\7zS423F5E94\libgcc_s_dw2-1.dll
                                      MD5

                                      9aec524b616618b0d3d00b27b6f51da1

                                      SHA1

                                      64264300801a353db324d11738ffed876550e1d3

                                      SHA256

                                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                      SHA512

                                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                    • \Users\Admin\AppData\Local\Temp\7zS423F5E94\libstdc++-6.dll
                                      MD5

                                      5e279950775baae5fea04d2cc4526bcc

                                      SHA1

                                      8aef1e10031c3629512c43dd8b0b5d9060878453

                                      SHA256

                                      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                      SHA512

                                      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                    • \Users\Admin\AppData\Local\Temp\7zS423F5E94\libwinpthread-1.dll
                                      MD5

                                      1e0d62c34ff2e649ebc5c372065732ee

                                      SHA1

                                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                      SHA256

                                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                      SHA512

                                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                    • memory/68-156-0x0000000000000000-mapping.dmp
                                    • memory/68-178-0x0000000000700000-0x0000000000701000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/184-245-0x000001BFE3F10000-0x000001BFE3FDF000-memory.dmp
                                      Filesize

                                      828KB

                                    • memory/184-167-0x0000000000000000-mapping.dmp
                                    • memory/340-342-0x0000022506460000-0x00000225064D4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/768-235-0x00000158FC630000-0x00000158FC69F000-memory.dmp
                                      Filesize

                                      444KB

                                    • memory/768-170-0x0000000000000000-mapping.dmp
                                    • memory/768-240-0x00000158FC6A0000-0x00000158FC76F000-memory.dmp
                                      Filesize

                                      828KB

                                    • memory/800-361-0x0000000000000000-mapping.dmp
                                    • memory/940-184-0x00000000014E0000-0x00000000014E2000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/940-172-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/940-168-0x0000000000000000-mapping.dmp
                                    • memory/1028-388-0x000001AC37540000-0x000001AC375B4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/1088-382-0x00000209B2EA0000-0x00000209B2F14000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/1116-282-0x0000000000000000-mapping.dmp
                                    • memory/1184-389-0x0000017215F60000-0x0000017215FD4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/1224-362-0x000001FEB78B0000-0x000001FEB7924000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/1224-353-0x000001FEB77F0000-0x000001FEB783D000-memory.dmp
                                      Filesize

                                      308KB

                                    • memory/1272-147-0x0000000000000000-mapping.dmp
                                    • memory/1332-396-0x000001B9AF370000-0x000001B9AF3E4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/1376-395-0x00000221099D0000-0x0000022109A44000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/1952-383-0x000002C721B40000-0x000002C721BB4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/2012-294-0x0000000000000000-mapping.dmp
                                    • memory/2012-296-0x0000000000400000-0x0000000000455000-memory.dmp
                                      Filesize

                                      340KB

                                    • memory/2144-153-0x0000000000000000-mapping.dmp
                                    • memory/2152-350-0x0000000000000000-mapping.dmp
                                    • memory/2152-149-0x0000000000000000-mapping.dmp
                                    • memory/2176-151-0x0000000000000000-mapping.dmp
                                    • memory/2208-152-0x0000000000000000-mapping.dmp
                                    • memory/2220-150-0x0000000000000000-mapping.dmp
                                    • memory/2224-148-0x0000000000000000-mapping.dmp
                                    • memory/2240-277-0x0000000000000000-mapping.dmp
                                    • memory/2240-311-0x0000000005250000-0x0000000005251000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/2432-356-0x0000019A1AA60000-0x0000019A1AAD4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/2440-367-0x000001D4A3FB0000-0x000001D4A4024000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/2680-403-0x000002C271C50000-0x000002C271CC4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/2696-404-0x000001F4C8F80000-0x000001F4C8FF4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/2840-329-0x000001C578550000-0x000001C5785C4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/3044-313-0x0000000002C70000-0x0000000002C86000-memory.dmp
                                      Filesize

                                      88KB

                                    • memory/3132-278-0x0000000000000000-mapping.dmp
                                    • memory/3132-326-0x000002C58B490000-0x000002C58B55F000-memory.dmp
                                      Filesize

                                      828KB

                                    • memory/3180-162-0x0000000000000000-mapping.dmp
                                    • memory/3184-130-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                      Filesize

                                      1.5MB

                                    • memory/3184-132-0x0000000000400000-0x000000000051E000-memory.dmp
                                      Filesize

                                      1.1MB

                                    • memory/3184-146-0x0000000064940000-0x0000000064959000-memory.dmp
                                      Filesize

                                      100KB

                                    • memory/3184-133-0x0000000064940000-0x0000000064959000-memory.dmp
                                      Filesize

                                      100KB

                                    • memory/3184-144-0x0000000064940000-0x0000000064959000-memory.dmp
                                      Filesize

                                      100KB

                                    • memory/3184-129-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                      Filesize

                                      572KB

                                    • memory/3184-143-0x0000000064940000-0x0000000064959000-memory.dmp
                                      Filesize

                                      100KB

                                    • memory/3184-114-0x0000000000000000-mapping.dmp
                                    • memory/3184-131-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                      Filesize

                                      152KB

                                    • memory/3192-263-0x0000000000000000-mapping.dmp
                                    • memory/3192-459-0x0000000002A50000-0x0000000002A52000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/3192-267-0x0000000000310000-0x0000000000311000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/3332-259-0x0000000000000000-mapping.dmp
                                    • memory/3584-154-0x0000000000000000-mapping.dmp
                                    • memory/3620-145-0x0000000000000000-mapping.dmp
                                    • memory/3864-195-0x00000000048F0000-0x000000000498D000-memory.dmp
                                      Filesize

                                      628KB

                                    • memory/3864-233-0x0000000000400000-0x0000000002CB2000-memory.dmp
                                      Filesize

                                      40.7MB

                                    • memory/3864-155-0x0000000000000000-mapping.dmp
                                    • memory/3976-159-0x0000000000000000-mapping.dmp
                                    • memory/4032-193-0x00000000001D0000-0x00000000001D9000-memory.dmp
                                      Filesize

                                      36KB

                                    • memory/4032-160-0x0000000000000000-mapping.dmp
                                    • memory/4032-225-0x0000000000400000-0x0000000002C56000-memory.dmp
                                      Filesize

                                      40.3MB

                                    • memory/4048-180-0x0000000001180000-0x00000000011A0000-memory.dmp
                                      Filesize

                                      128KB

                                    • memory/4048-185-0x000000001B3C0000-0x000000001B3C2000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/4048-161-0x0000000000000000-mapping.dmp
                                    • memory/4048-175-0x0000000000940000-0x0000000000941000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4048-182-0x00000000011A0000-0x00000000011A1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4048-177-0x0000000001060000-0x0000000001061000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4100-471-0x0000000000B50000-0x0000000000B70000-memory.dmp
                                      Filesize

                                      128KB

                                    • memory/4100-468-0x0000000140000000-0x0000000140763000-memory.dmp
                                      Filesize

                                      7.4MB

                                    • memory/4100-472-0x0000000000B70000-0x0000000000B90000-memory.dmp
                                      Filesize

                                      128KB

                                    • memory/4120-275-0x0000000000920000-0x0000000000921000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4120-270-0x0000000000000000-mapping.dmp
                                    • memory/4120-295-0x000000001B660000-0x000000001B662000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/4164-181-0x0000000000000000-mapping.dmp
                                    • memory/4192-299-0x0000000000000000-mapping.dmp
                                    • memory/4244-320-0x00007FF7D6A44060-mapping.dmp
                                    • memory/4244-339-0x000002584CF70000-0x000002584CFE4000-memory.dmp
                                      Filesize

                                      464KB

                                    • memory/4244-446-0x000002584E7B0000-0x000002584E7CB000-memory.dmp
                                      Filesize

                                      108KB

                                    • memory/4244-447-0x000002584F800000-0x000002584F906000-memory.dmp
                                      Filesize

                                      1.0MB

                                    • memory/4292-186-0x0000000000000000-mapping.dmp
                                    • memory/4292-189-0x0000000000610000-0x0000000000611000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4292-453-0x0000000001350000-0x0000000001352000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/4344-340-0x0000000000000000-mapping.dmp
                                    • memory/4352-194-0x0000000000000000-mapping.dmp
                                    • memory/4352-201-0x00000000006D0000-0x00000000007B4000-memory.dmp
                                      Filesize

                                      912KB

                                    • memory/4396-285-0x0000000000000000-mapping.dmp
                                    • memory/4416-346-0x000000001B4A0000-0x000000001B4A2000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/4416-317-0x0000000000000000-mapping.dmp
                                    • memory/4432-200-0x0000000000000000-mapping.dmp
                                    • memory/4432-207-0x0000000000750000-0x0000000000751000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4476-250-0x0000000001310000-0x0000000001311000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4476-223-0x0000000001300000-0x0000000001301000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4476-239-0x0000000001330000-0x0000000001361000-memory.dmp
                                      Filesize

                                      196KB

                                    • memory/4476-205-0x0000000000000000-mapping.dmp
                                    • memory/4476-216-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4476-229-0x0000000001320000-0x0000000001322000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/4508-386-0x0000000005290000-0x0000000005291000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4508-323-0x0000000000000000-mapping.dmp
                                    • memory/4520-220-0x0000000000730000-0x0000000000731000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4520-209-0x0000000000000000-mapping.dmp
                                    • memory/4520-238-0x00000000028E0000-0x00000000028E7000-memory.dmp
                                      Filesize

                                      28KB

                                    • memory/4520-256-0x0000000007490000-0x0000000007491000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4520-244-0x00000000078B0000-0x00000000078B1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4556-286-0x0000000000000000-mapping.dmp
                                    • memory/4556-288-0x0000000000750000-0x0000000000751000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4556-312-0x000000001B2F0000-0x000000001B2F2000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/4556-300-0x0000000001020000-0x0000000001021000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4572-298-0x0000000000000000-mapping.dmp
                                    • memory/4592-349-0x0000000000F80000-0x0000000000FDF000-memory.dmp
                                      Filesize

                                      380KB

                                    • memory/4592-315-0x0000000000000000-mapping.dmp
                                    • memory/4592-337-0x0000000004834000-0x0000000004935000-memory.dmp
                                      Filesize

                                      1.0MB

                                    • memory/4596-274-0x0000000008230000-0x0000000008231000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4596-287-0x0000000007D20000-0x0000000007D21000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4596-301-0x0000000007D60000-0x0000000007D61000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4596-217-0x0000000000000000-mapping.dmp
                                    • memory/4596-262-0x0000000005370000-0x000000000539B000-memory.dmp
                                      Filesize

                                      172KB

                                    • memory/4596-253-0x0000000000A10000-0x0000000000A11000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4596-281-0x0000000007CC0000-0x0000000007CC1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4596-271-0x00000000053E0000-0x00000000053E1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4672-222-0x0000000000000000-mapping.dmp
                                    • memory/4672-228-0x0000000000C30000-0x0000000000D14000-memory.dmp
                                      Filesize

                                      912KB

                                    • memory/4688-254-0x00000000031A0000-0x00000000031A1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4688-280-0x0000000005680000-0x0000000005681000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4688-236-0x0000000000E30000-0x0000000000E31000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4688-224-0x0000000000000000-mapping.dmp
                                    • memory/4688-297-0x0000000003150000-0x0000000003151000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4688-279-0x00000000031B0000-0x00000000031F4000-memory.dmp
                                      Filesize

                                      272KB

                                    • memory/4704-293-0x0000000000000000-mapping.dmp
                                    • memory/4704-359-0x0000000000400000-0x0000000002C73000-memory.dmp
                                      Filesize

                                      40.4MB

                                    • memory/4704-333-0x00000000001D0000-0x00000000001FE000-memory.dmp
                                      Filesize

                                      184KB

                                    • memory/4776-319-0x0000000000000000-mapping.dmp
                                    • memory/4776-364-0x00000000049E0000-0x00000000049E1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4812-324-0x0000000000000000-mapping.dmp
                                    • memory/4812-407-0x0000000005230000-0x0000000005B56000-memory.dmp
                                      Filesize

                                      9.1MB

                                    • memory/4812-408-0x0000000000400000-0x00000000030A1000-memory.dmp
                                      Filesize

                                      44.6MB

                                    • memory/4916-246-0x0000000000000000-mapping.dmp
                                    • memory/4916-249-0x00000000008C0000-0x00000000008C1000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/4916-268-0x000000001B4C0000-0x000000001B4C2000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/4988-252-0x0000000000000000-mapping.dmp
                                    • memory/5008-392-0x0000000005120000-0x0000000005121000-memory.dmp
                                      Filesize

                                      4KB

                                    • memory/5008-328-0x0000000000000000-mapping.dmp
                                    • memory/5236-437-0x0000000000000000-mapping.dmp
                                    • memory/5388-440-0x0000000000000000-mapping.dmp
                                    • memory/5472-443-0x0000000000000000-mapping.dmp
                                    • memory/5512-405-0x0000000000000000-mapping.dmp
                                    • memory/5584-409-0x0000000000000000-mapping.dmp
                                    • memory/5628-411-0x0000000000000000-mapping.dmp
                                    • memory/5628-454-0x0000000000400000-0x00000000030A1000-memory.dmp
                                      Filesize

                                      44.6MB

                                    • memory/5672-413-0x0000000000000000-mapping.dmp
                                    • memory/5672-416-0x0000000004CE2000-0x0000000004DE3000-memory.dmp
                                      Filesize

                                      1.0MB

                                    • memory/5708-414-0x0000000000000000-mapping.dmp
                                    • memory/5920-417-0x0000000000000000-mapping.dmp
                                    • memory/6036-465-0x000000001C460000-0x000000001C462000-memory.dmp
                                      Filesize

                                      8KB

                                    • memory/6084-420-0x0000000000000000-mapping.dmp
                                    • memory/6100-422-0x0000000000000000-mapping.dmp
                                    • memory/6112-423-0x0000000000000000-mapping.dmp
                                    • memory/6116-464-0x0000000001280000-0x0000000001282000-memory.dmp
                                      Filesize

                                      8KB