Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
31-05-2022 11:17
Static task
static1
Behavioral task
behavioral1
Sample
DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe
Resource
win7-20220414-en
General
-
Target
DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe
-
Size
2.5MB
-
MD5
e0fe9226cd6652b14cc47ee7f35ae1d6
-
SHA1
b3de7a40c3586fe45ba1cd4e8929760d8a697250
-
SHA256
df26b54b984ae1b94fecde99e7b0513a305164f9000929d3467a95d16e33667d
-
SHA512
205e7a5f16c7b3caa4111e2949e703638655fbd2d4893932f83666da6ff247d23af72bf5953270377a59845e09104357133be76cda287808a7611421fd020de2
Malware Config
Extracted
vidar
39.7
933
https://shpak125.tumblr.com/
-
profile_id
933
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2496 4740 rUNdlL32.eXe -
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2032-222-0x0000000000400000-0x00000000008EA000-memory.dmp family_vidar behavioral2/memory/2032-219-0x0000000000B50000-0x0000000000BED000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurlpp.dll aspack_v212_v242 -
Executes dropped EXE 10 IoCs
Processes:
setup_installer.exesetup_install.exesahiba_1.exesahiba_2.exesahiba_4.exesahiba_3.exesahiba_7.exesahiba_6.exesahiba_5.exesahiba_1.exepid process 3616 setup_installer.exe 4216 setup_install.exe 1828 sahiba_1.exe 4112 sahiba_2.exe 3716 sahiba_4.exe 2032 sahiba_3.exe 1648 sahiba_7.exe 4436 sahiba_6.exe 4656 sahiba_5.exe 3192 sahiba_1.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exesetup_installer.exesahiba_1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation sahiba_1.exe -
Loads dropped DLL 10 IoCs
Processes:
setup_install.exesahiba_2.exerundll32.exepid process 4216 setup_install.exe 4216 setup_install.exe 4216 setup_install.exe 4216 setup_install.exe 4216 setup_install.exe 4216 setup_install.exe 4216 setup_install.exe 4216 setup_install.exe 4112 sahiba_2.exe 4920 rundll32.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 ipinfo.io 17 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2016 4920 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sahiba_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe -
Processes:
sahiba_3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sahiba_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sahiba_3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sahiba_2.exepid process 4112 sahiba_2.exe 4112 sahiba_2.exe 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3152 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sahiba_2.exepid process 4112 sahiba_2.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
sahiba_4.exesahiba_5.exedescription pid process Token: SeDebugPrivilege 3716 sahiba_4.exe Token: SeDebugPrivilege 4656 sahiba_5.exe Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
pid process 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 -
Suspicious use of SendNotifyMessage 16 IoCs
Processes:
pid process 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_1.exerUNdlL32.eXedescription pid process target process PID 3116 wrote to memory of 3616 3116 DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe setup_installer.exe PID 3116 wrote to memory of 3616 3116 DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe setup_installer.exe PID 3116 wrote to memory of 3616 3116 DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe setup_installer.exe PID 3616 wrote to memory of 4216 3616 setup_installer.exe setup_install.exe PID 3616 wrote to memory of 4216 3616 setup_installer.exe setup_install.exe PID 3616 wrote to memory of 4216 3616 setup_installer.exe setup_install.exe PID 4216 wrote to memory of 4428 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4428 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4428 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4500 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4500 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4500 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 1528 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 1528 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 1528 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 2696 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 2696 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 2696 4216 setup_install.exe cmd.exe PID 4500 wrote to memory of 4112 4500 cmd.exe sahiba_2.exe PID 4500 wrote to memory of 4112 4500 cmd.exe sahiba_2.exe PID 4500 wrote to memory of 4112 4500 cmd.exe sahiba_2.exe PID 4428 wrote to memory of 1828 4428 cmd.exe sahiba_1.exe PID 4428 wrote to memory of 1828 4428 cmd.exe sahiba_1.exe PID 4428 wrote to memory of 1828 4428 cmd.exe sahiba_1.exe PID 4216 wrote to memory of 1576 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 1576 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 1576 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 5072 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 5072 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 5072 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4108 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4108 4216 setup_install.exe cmd.exe PID 4216 wrote to memory of 4108 4216 setup_install.exe cmd.exe PID 2696 wrote to memory of 3716 2696 cmd.exe sahiba_4.exe PID 2696 wrote to memory of 3716 2696 cmd.exe sahiba_4.exe PID 1528 wrote to memory of 2032 1528 cmd.exe sahiba_3.exe PID 1528 wrote to memory of 2032 1528 cmd.exe sahiba_3.exe PID 1528 wrote to memory of 2032 1528 cmd.exe sahiba_3.exe PID 4108 wrote to memory of 1648 4108 cmd.exe sahiba_7.exe PID 4108 wrote to memory of 1648 4108 cmd.exe sahiba_7.exe PID 5072 wrote to memory of 4436 5072 cmd.exe sahiba_6.exe PID 5072 wrote to memory of 4436 5072 cmd.exe sahiba_6.exe PID 5072 wrote to memory of 4436 5072 cmd.exe sahiba_6.exe PID 1576 wrote to memory of 4656 1576 cmd.exe sahiba_5.exe PID 1576 wrote to memory of 4656 1576 cmd.exe sahiba_5.exe PID 1828 wrote to memory of 3192 1828 sahiba_1.exe sahiba_1.exe PID 1828 wrote to memory of 3192 1828 sahiba_1.exe sahiba_1.exe PID 1828 wrote to memory of 3192 1828 sahiba_1.exe sahiba_1.exe PID 2496 wrote to memory of 4920 2496 rUNdlL32.eXe rundll32.exe PID 2496 wrote to memory of 4920 2496 rUNdlL32.eXe rundll32.exe PID 2496 wrote to memory of 4920 2496 rUNdlL32.eXe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe"C:\Users\Admin\AppData\Local\Temp\DF26B54B984AE1B94FECDE99E7B0513A305164F900092.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_2.exesahiba_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_1.exesahiba_1.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_3.exesahiba_3.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_5.exesahiba_5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_7.exesahiba_7.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_6.exesahiba_6.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_4.exesahiba_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4920 -ip 49201⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 516 -p 312 -ip 3121⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_1.txtFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_2.exeFilesize
149KB
MD5a237095a767ea5e743a00c3c81e620de
SHA11bd3d63415c55b0ba979c59577319266bf9e3913
SHA256d4050b4dc2921e350c3d214bfff08aa0b616cf26212cab2e63be05747aa6703f
SHA512aee84ca49bc29b416ade64ac7f95a4024e0ffae91d7142d4a87769f218b6de85fced0b7b81a2453e47666be096f6722c7c2315cddad54f94ccb4d8445d9290cd
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_2.txtFilesize
149KB
MD5a237095a767ea5e743a00c3c81e620de
SHA11bd3d63415c55b0ba979c59577319266bf9e3913
SHA256d4050b4dc2921e350c3d214bfff08aa0b616cf26212cab2e63be05747aa6703f
SHA512aee84ca49bc29b416ade64ac7f95a4024e0ffae91d7142d4a87769f218b6de85fced0b7b81a2453e47666be096f6722c7c2315cddad54f94ccb4d8445d9290cd
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_3.exeFilesize
515KB
MD5be37bdabe36f0a66e8b3081e8797218a
SHA1de93272dbca71c78d61ae131ee3dc97f7cd1ea7b
SHA256ab2ec9b130e539e68fdfb822f8c3fda9ba74560e7933210f47477e82bb08c4e5
SHA512473982ea0612b37c3232b66d448484ec4aef27c35598c7e506f559dafb3bd50b034b9a5db7ba03efc6de0c1dd0e249c1660fbb253a36fb51b6bb212fd8ce3b99
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_3.txtFilesize
515KB
MD5be37bdabe36f0a66e8b3081e8797218a
SHA1de93272dbca71c78d61ae131ee3dc97f7cd1ea7b
SHA256ab2ec9b130e539e68fdfb822f8c3fda9ba74560e7933210f47477e82bb08c4e5
SHA512473982ea0612b37c3232b66d448484ec4aef27c35598c7e506f559dafb3bd50b034b9a5db7ba03efc6de0c1dd0e249c1660fbb253a36fb51b6bb212fd8ce3b99
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_4.exeFilesize
8KB
MD5aebba1a56e0d716d2e4b6676888084c8
SHA1fb0fc0de54c2f740deb8323272ff0180e4b89d99
SHA2566529c1eb48d6a4ffe24e91bb65cab349436408048d403edf9fcfa38ac617d38b
SHA512914fbff3f840d7dbde470514c9f8916112bbccce4f427b84c395c870b7194b3f6f453f583fc1081c6e896e3af3b89d5fdf0999a9a766e41a8f0448e6f06e6b62
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_4.txtFilesize
8KB
MD5aebba1a56e0d716d2e4b6676888084c8
SHA1fb0fc0de54c2f740deb8323272ff0180e4b89d99
SHA2566529c1eb48d6a4ffe24e91bb65cab349436408048d403edf9fcfa38ac617d38b
SHA512914fbff3f840d7dbde470514c9f8916112bbccce4f427b84c395c870b7194b3f6f453f583fc1081c6e896e3af3b89d5fdf0999a9a766e41a8f0448e6f06e6b62
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_5.exeFilesize
156KB
MD57ec7b612ff4f9771629ae397c77baf18
SHA10e10994968563b5f11dcbbb965023bc2404142e3
SHA256f64759837bbb18960f5acab25fb18404c7bdb46312676672134ac2c00454befb
SHA51207b5651fba5595456fe456c08783e613fe7c7c44805b910853a5c4d61fa2f25c6eb3bad39798c7459bc93b0805f2729b6f3200b635b88fac0d5afae23558ea67
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_5.txtFilesize
156KB
MD57ec7b612ff4f9771629ae397c77baf18
SHA10e10994968563b5f11dcbbb965023bc2404142e3
SHA256f64759837bbb18960f5acab25fb18404c7bdb46312676672134ac2c00454befb
SHA51207b5651fba5595456fe456c08783e613fe7c7c44805b910853a5c4d61fa2f25c6eb3bad39798c7459bc93b0805f2729b6f3200b635b88fac0d5afae23558ea67
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_6.exeFilesize
1014KB
MD50c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_6.txtFilesize
1014KB
MD50c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_7.exeFilesize
241KB
MD57eef13ea166d4795e7e2df97f6a97199
SHA1f80c5425a60534595c409842d37268213dcc1f92
SHA25622abf0e430b18088dcf4f889e33c8f1bdc9c918f908a2e450ab26a3db18d9d36
SHA5123bfb99aaad774079083e9575c0184760cba8e58c65979a90126d6d292696c4bb66604bb02f7e5b575628269c617a42d943129c1ef56a10dd0c7ba9cf2f79d12f
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\sahiba_7.txtFilesize
241KB
MD57eef13ea166d4795e7e2df97f6a97199
SHA1f80c5425a60534595c409842d37268213dcc1f92
SHA25622abf0e430b18088dcf4f889e33c8f1bdc9c918f908a2e450ab26a3db18d9d36
SHA5123bfb99aaad774079083e9575c0184760cba8e58c65979a90126d6d292696c4bb66604bb02f7e5b575628269c617a42d943129c1ef56a10dd0c7ba9cf2f79d12f
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\setup_install.exeFilesize
287KB
MD5818fea4c16c2eacc798b023af83f18e8
SHA116b45f30140809419f3ceb10cedbcd06f0ddb3b9
SHA25666277911334b5b34ad4e53e7a126ba0cb595044012b58af67475f963972620a7
SHA5126a4bf28868620caa7c9461ec00d495e8b34bfd75162c669983d0deab8cd9313dba4e6eb23b522e500e0cd20d551f368bcd674b1e88694f2b1be9bb40a58bbf32
-
C:\Users\Admin\AppData\Local\Temp\7zS02E15AB6\setup_install.exeFilesize
287KB
MD5818fea4c16c2eacc798b023af83f18e8
SHA116b45f30140809419f3ceb10cedbcd06f0ddb3b9
SHA25666277911334b5b34ad4e53e7a126ba0cb595044012b58af67475f963972620a7
SHA5126a4bf28868620caa7c9461ec00d495e8b34bfd75162c669983d0deab8cd9313dba4e6eb23b522e500e0cd20d551f368bcd674b1e88694f2b1be9bb40a58bbf32
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Users\Admin\AppData\Local\Temp\axhub.datFilesize
552KB
MD599ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
2.5MB
MD51f5f1949e3878d95c166a18cf1b441fc
SHA11204ae9bfa7d139bc54534950c6613a09369f1cf
SHA256a78fbc202626a9d38743f4f1e2f3813eccb5fe696d28ea11c947fc87025ab69b
SHA512c270137a63b65cfb198ef7d7d0619fce083066cd795d18136ac28e3c4980574b1d4ceb34d10b35d126e5350b64f1f83e23ff47464bce726b82d160e759fbdd9e
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
2.5MB
MD51f5f1949e3878d95c166a18cf1b441fc
SHA11204ae9bfa7d139bc54534950c6613a09369f1cf
SHA256a78fbc202626a9d38743f4f1e2f3813eccb5fe696d28ea11c947fc87025ab69b
SHA512c270137a63b65cfb198ef7d7d0619fce083066cd795d18136ac28e3c4980574b1d4ceb34d10b35d126e5350b64f1f83e23ff47464bce726b82d160e759fbdd9e
-
memory/1528-179-0x0000000000000000-mapping.dmp
-
memory/1576-184-0x0000000000000000-mapping.dmp
-
memory/1648-190-0x0000000000000000-mapping.dmp
-
memory/1828-182-0x0000000000000000-mapping.dmp
-
memory/2032-189-0x0000000000000000-mapping.dmp
-
memory/2032-218-0x0000000000C36000-0x0000000000C9A000-memory.dmpFilesize
400KB
-
memory/2032-222-0x0000000000400000-0x00000000008EA000-memory.dmpFilesize
4.9MB
-
memory/2032-219-0x0000000000B50000-0x0000000000BED000-memory.dmpFilesize
628KB
-
memory/2032-224-0x0000000000C36000-0x0000000000C9A000-memory.dmpFilesize
400KB
-
memory/2696-180-0x0000000000000000-mapping.dmp
-
memory/3192-203-0x0000000000000000-mapping.dmp
-
memory/3616-130-0x0000000000000000-mapping.dmp
-
memory/3716-193-0x00000000003F0000-0x00000000003F8000-memory.dmpFilesize
32KB
-
memory/3716-199-0x00007FFEBA360000-0x00007FFEBAE21000-memory.dmpFilesize
10.8MB
-
memory/3716-188-0x0000000000000000-mapping.dmp
-
memory/4108-187-0x0000000000000000-mapping.dmp
-
memory/4112-181-0x0000000000000000-mapping.dmp
-
memory/4112-216-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4112-215-0x0000000000986000-0x000000000098F000-memory.dmpFilesize
36KB
-
memory/4112-217-0x0000000000400000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/4112-223-0x0000000000400000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/4216-177-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4216-157-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4216-133-0x0000000000000000-mapping.dmp
-
memory/4216-164-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4216-166-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4216-151-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4216-176-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4216-152-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4216-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4216-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4216-139-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4216-167-0x00000000007A0000-0x000000000082F000-memory.dmpFilesize
572KB
-
memory/4216-165-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4216-154-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4216-155-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4216-202-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4216-204-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4216-205-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4216-207-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4216-208-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4216-162-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4216-161-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4216-156-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4216-163-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4216-160-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4216-158-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4216-159-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4428-175-0x0000000000000000-mapping.dmp
-
memory/4436-195-0x0000000000000000-mapping.dmp
-
memory/4500-178-0x0000000000000000-mapping.dmp
-
memory/4656-209-0x00000000002A0000-0x00000000002D0000-memory.dmpFilesize
192KB
-
memory/4656-200-0x00000000002A0000-0x00000000002D0000-memory.dmpFilesize
192KB
-
memory/4656-201-0x00007FFEBA360000-0x00007FFEBAE21000-memory.dmpFilesize
10.8MB
-
memory/4656-220-0x00007FFEBA360000-0x00007FFEBAE21000-memory.dmpFilesize
10.8MB
-
memory/4656-221-0x00000000002A0000-0x00000000002D0000-memory.dmpFilesize
192KB
-
memory/4656-196-0x0000000000000000-mapping.dmp
-
memory/4920-212-0x0000000000000000-mapping.dmp
-
memory/5072-186-0x0000000000000000-mapping.dmp