Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 13:43
Static task
static1
General
-
Target
AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe
-
Size
2.6MB
-
MD5
b81a72714c586f9b634b059b73da8a3a
-
SHA1
2aad87da256f1b26c40e1243f4ec7ea15c2f4690
-
SHA256
ab479d019576efd4dd391e0bf3fc1bedb10367e1ece7157d609a283873a43645
-
SHA512
07f076ccf6b4174a4c9848795dcd86b59d4f2a6b7ab2827d25ac8b2808dad47c2ca20bf6d712c1b8c6fa17427fbf0648c5e24f13fc066d22c8e3f5752125c56c
Malware Config
Extracted
vidar
39.7
933
https://shpak125.tumblr.com/
-
profile_id
933
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1628 1732 rUNdlL32.eXe -
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4620-217-0x0000000002D60000-0x0000000002DFD000-memory.dmp family_vidar behavioral2/memory/4620-218-0x0000000000400000-0x0000000002BD7000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS4F229277\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4F229277\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurl.dll aspack_v212_v242 -
Executes dropped EXE 10 IoCs
Processes:
setup_installer.exesetup_install.exesahiba_1.exesahiba_4.exesahiba_7.exesahiba_5.exesahiba_6.exesahiba_3.exesahiba_2.exesahiba_1.exepid process 756 setup_installer.exe 4680 setup_install.exe 5112 sahiba_1.exe 2056 sahiba_4.exe 2308 sahiba_7.exe 1956 sahiba_5.exe 2892 sahiba_6.exe 4620 sahiba_3.exe 1972 sahiba_2.exe 3132 sahiba_1.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exesetup_installer.exesahiba_1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation sahiba_1.exe -
Loads dropped DLL 8 IoCs
Processes:
setup_install.exerundll32.exesahiba_2.exepid process 4680 setup_install.exe 4680 setup_install.exe 4680 setup_install.exe 4680 setup_install.exe 4680 setup_install.exe 4680 setup_install.exe 2032 rundll32.exe 1972 sahiba_2.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 ipinfo.io 20 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2728 4680 WerFault.exe setup_install.exe 3772 2032 WerFault.exe rundll32.exe 4492 1580 WerFault.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sahiba_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sahiba_2.exepid process 1972 sahiba_2.exe 1972 sahiba_2.exe 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 2928 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sahiba_2.exepid process 1972 sahiba_2.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
sahiba_4.exesahiba_5.exedescription pid process Token: SeDebugPrivilege 2056 sahiba_4.exe Token: SeDebugPrivilege 1956 sahiba_5.exe Token: SeShutdownPrivilege 2928 Token: SeCreatePagefilePrivilege 2928 Token: SeShutdownPrivilege 2928 Token: SeCreatePagefilePrivilege 2928 Token: SeShutdownPrivilege 2928 Token: SeCreatePagefilePrivilege 2928 Token: SeShutdownPrivilege 2928 Token: SeCreatePagefilePrivilege 2928 -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
pid process 2928 2928 2928 2928 2928 2928 2928 2928 2928 -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
pid process 2928 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 2928 -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_1.exerUNdlL32.eXedescription pid process target process PID 2328 wrote to memory of 756 2328 AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe setup_installer.exe PID 2328 wrote to memory of 756 2328 AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe setup_installer.exe PID 2328 wrote to memory of 756 2328 AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe setup_installer.exe PID 756 wrote to memory of 4680 756 setup_installer.exe setup_install.exe PID 756 wrote to memory of 4680 756 setup_installer.exe setup_install.exe PID 756 wrote to memory of 4680 756 setup_installer.exe setup_install.exe PID 4680 wrote to memory of 4616 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 4616 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 4616 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 2560 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 2560 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 2560 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3696 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3696 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3696 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3412 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3412 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3412 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 616 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 616 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 616 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 4268 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 4268 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 4268 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3668 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3668 4680 setup_install.exe cmd.exe PID 4680 wrote to memory of 3668 4680 setup_install.exe cmd.exe PID 4616 wrote to memory of 5112 4616 cmd.exe sahiba_1.exe PID 4616 wrote to memory of 5112 4616 cmd.exe sahiba_1.exe PID 4616 wrote to memory of 5112 4616 cmd.exe sahiba_1.exe PID 3412 wrote to memory of 2056 3412 cmd.exe sahiba_4.exe PID 3412 wrote to memory of 2056 3412 cmd.exe sahiba_4.exe PID 616 wrote to memory of 1956 616 cmd.exe sahiba_5.exe PID 616 wrote to memory of 1956 616 cmd.exe sahiba_5.exe PID 3668 wrote to memory of 2308 3668 cmd.exe sahiba_7.exe PID 3668 wrote to memory of 2308 3668 cmd.exe sahiba_7.exe PID 4268 wrote to memory of 2892 4268 cmd.exe sahiba_6.exe PID 4268 wrote to memory of 2892 4268 cmd.exe sahiba_6.exe PID 4268 wrote to memory of 2892 4268 cmd.exe sahiba_6.exe PID 2560 wrote to memory of 1972 2560 cmd.exe sahiba_2.exe PID 2560 wrote to memory of 1972 2560 cmd.exe sahiba_2.exe PID 2560 wrote to memory of 1972 2560 cmd.exe sahiba_2.exe PID 3696 wrote to memory of 4620 3696 cmd.exe sahiba_3.exe PID 3696 wrote to memory of 4620 3696 cmd.exe sahiba_3.exe PID 3696 wrote to memory of 4620 3696 cmd.exe sahiba_3.exe PID 5112 wrote to memory of 3132 5112 sahiba_1.exe sahiba_1.exe PID 5112 wrote to memory of 3132 5112 sahiba_1.exe sahiba_1.exe PID 5112 wrote to memory of 3132 5112 sahiba_1.exe sahiba_1.exe PID 1628 wrote to memory of 2032 1628 rUNdlL32.eXe rundll32.exe PID 1628 wrote to memory of 2032 1628 rUNdlL32.eXe rundll32.exe PID 1628 wrote to memory of 2032 1628 rUNdlL32.eXe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe"C:\Users\Admin\AppData\Local\Temp\AB479D019576EFD4DD391E0BF3FC1BEDB10367E1ECE71.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4F229277\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_1.exesahiba_1.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_7.exesahiba_7.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 5404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_6.exesahiba_6.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4680 -ip 46801⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_3.exesahiba_3.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_2.exesahiba_2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_5.exesahiba_5.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_4.exesahiba_4.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2032 -ip 20321⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 516 -p 1580 -ip 15801⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1580 -s 6201⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_1.txtFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_2.exeFilesize
222KB
MD5bab311e39c6dc75106c93e7d9571d7f1
SHA1d6fb876a06eb79281c21df7894fd957747c7c83b
SHA256e27c4b45b60d39cc2c66ca3e5fe2c095e8fc6bc6fcdeac26758f3cbb5f604821
SHA512f8076fc400d0c9f91e63041c3e7aaad0b19c29643f6201acae8998fcca2579df6e494f5212273eea16c13685cf774e69dda06fad78fd5210563df6a0d6b18ba1
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_2.txtFilesize
222KB
MD5bab311e39c6dc75106c93e7d9571d7f1
SHA1d6fb876a06eb79281c21df7894fd957747c7c83b
SHA256e27c4b45b60d39cc2c66ca3e5fe2c095e8fc6bc6fcdeac26758f3cbb5f604821
SHA512f8076fc400d0c9f91e63041c3e7aaad0b19c29643f6201acae8998fcca2579df6e494f5212273eea16c13685cf774e69dda06fad78fd5210563df6a0d6b18ba1
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_3.exeFilesize
588KB
MD56535e592ad1f85965569a8a19a45d842
SHA145fec86cc8bf1b64425d8ad4c1d12f16e8306bfd
SHA25617353e7514997fb0dd0e5f93aa34950ba17c26f650b38cbaf0c83cc093de941a
SHA51276d83e203c9b3ae865ce5125de98c85c27472b3c96baa8c84a9c573bcc8d4254ee1d4aaab175b6c11b5c869f7b97496b2ac8cbe244310bec6d304b78e354567c
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_3.txtFilesize
588KB
MD56535e592ad1f85965569a8a19a45d842
SHA145fec86cc8bf1b64425d8ad4c1d12f16e8306bfd
SHA25617353e7514997fb0dd0e5f93aa34950ba17c26f650b38cbaf0c83cc093de941a
SHA51276d83e203c9b3ae865ce5125de98c85c27472b3c96baa8c84a9c573bcc8d4254ee1d4aaab175b6c11b5c869f7b97496b2ac8cbe244310bec6d304b78e354567c
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_4.exeFilesize
8KB
MD5aa76e329fd4fc560c0f8f6b2f224d3da
SHA1bbbd3c4843bed7d90d7d3c5ce62c6e47639f8a14
SHA256dd5ac4469562c4d32e10983c14285e3c33849267cbf4c198d0427b21c56c49b2
SHA512d79753c703dc0bc34c56e1d9afcf47c5bbaad37527339b95c7e9d7f7ab17ee67320f254575049b622bc4a8ef572d526b13f01a8a707d4c57da3599c548c83934
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_4.txtFilesize
8KB
MD5aa76e329fd4fc560c0f8f6b2f224d3da
SHA1bbbd3c4843bed7d90d7d3c5ce62c6e47639f8a14
SHA256dd5ac4469562c4d32e10983c14285e3c33849267cbf4c198d0427b21c56c49b2
SHA512d79753c703dc0bc34c56e1d9afcf47c5bbaad37527339b95c7e9d7f7ab17ee67320f254575049b622bc4a8ef572d526b13f01a8a707d4c57da3599c548c83934
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_5.exeFilesize
213KB
MD51cc35bf07b551ce45921ae41602ec87d
SHA15eca79da173ad9912d669d85133561501976c12c
SHA2561371046b187faec8708e3732fc760515a7b96236c62094598340b1dc6331ac05
SHA512852134d0f6e4bbb2930225655068a468d49c7b980f604ef31ce308abc4534c3fed4086adf93e8df9287de6ec9f3734c7468ef5c6f436f08cc7112a30e816afc9
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_5.txtFilesize
213KB
MD51cc35bf07b551ce45921ae41602ec87d
SHA15eca79da173ad9912d669d85133561501976c12c
SHA2561371046b187faec8708e3732fc760515a7b96236c62094598340b1dc6331ac05
SHA512852134d0f6e4bbb2930225655068a468d49c7b980f604ef31ce308abc4534c3fed4086adf93e8df9287de6ec9f3734c7468ef5c6f436f08cc7112a30e816afc9
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_6.exeFilesize
1.0MB
MD5e44b6cb9e7111de178fbabf3ac1cba76
SHA1b15d8d52864a548c42a331a574828824a65763ff
SHA256c74894fe98864ade516c9e54f2258a23ed451feadfa2de53a7c626385b549b22
SHA51224129e1de024d61bcc23654450f416307be3e7911de2baced47476e02cd7df737ce012f379eb0ea5d84367113619f53d6a80971ccc652a569d6b494150bbb6bf
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_6.txtFilesize
1.0MB
MD5e44b6cb9e7111de178fbabf3ac1cba76
SHA1b15d8d52864a548c42a331a574828824a65763ff
SHA256c74894fe98864ade516c9e54f2258a23ed451feadfa2de53a7c626385b549b22
SHA51224129e1de024d61bcc23654450f416307be3e7911de2baced47476e02cd7df737ce012f379eb0ea5d84367113619f53d6a80971ccc652a569d6b494150bbb6bf
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_7.exeFilesize
244KB
MD50bc56e17cb974ddd06782939dcee2606
SHA1459f61b929c5925327eaa8495bf401cac9e2814f
SHA25676ef9d99c7e37d132f6803ec46f8e2663b1cc282a5d2022946f1598965673fa1
SHA512d260597ac09d2e6109fdbf7e5ca5817b73f3ed690529da067d2dbcde8d35959018837beb3ea7183f6f4ce52b911996d07f0b9712274021cc20bfbcc2c5e7fc1e
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\sahiba_7.txtFilesize
244KB
MD50bc56e17cb974ddd06782939dcee2606
SHA1459f61b929c5925327eaa8495bf401cac9e2814f
SHA25676ef9d99c7e37d132f6803ec46f8e2663b1cc282a5d2022946f1598965673fa1
SHA512d260597ac09d2e6109fdbf7e5ca5817b73f3ed690529da067d2dbcde8d35959018837beb3ea7183f6f4ce52b911996d07f0b9712274021cc20bfbcc2c5e7fc1e
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\setup_install.exeFilesize
287KB
MD5b9165f937e3873eb97693ab2c201ffbd
SHA1beb46f3fd71a24a74d9f29647ce2cdacf74060e7
SHA2568c926f7a08b94ddae207573185c512685c2a0c84ec2ee8a086baa51a508a9c74
SHA5127564293a6e609d8ac2c1782790b45441ce5da52260762ae2d5c794836c20aa521facae87f61b50bc98290b177bfed0567b97a83e9519806017a9ee575a2c216b
-
C:\Users\Admin\AppData\Local\Temp\7zS4F229277\setup_install.exeFilesize
287KB
MD5b9165f937e3873eb97693ab2c201ffbd
SHA1beb46f3fd71a24a74d9f29647ce2cdacf74060e7
SHA2568c926f7a08b94ddae207573185c512685c2a0c84ec2ee8a086baa51a508a9c74
SHA5127564293a6e609d8ac2c1782790b45441ce5da52260762ae2d5c794836c20aa521facae87f61b50bc98290b177bfed0567b97a83e9519806017a9ee575a2c216b
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Users\Admin\AppData\Local\Temp\axhub.datFilesize
552KB
MD599ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
2.6MB
MD504e682e306c4a8720a7aba6ff54a991a
SHA130d43db52ea51648e37b736bcdf3f46099650b6d
SHA256a46ea98ad0ea5abc3bf267a93c0af04c785ffe3811154b1670b9661e264d8aa2
SHA5124def0bd15ddee8f1dc91e0fb3a76928325f29ed51711bec672d2dc1ada396b3c848cdc3b24bcdf620edf8dc8474b744c12362091425d70d0521ba934aaf69aae
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
2.6MB
MD504e682e306c4a8720a7aba6ff54a991a
SHA130d43db52ea51648e37b736bcdf3f46099650b6d
SHA256a46ea98ad0ea5abc3bf267a93c0af04c785ffe3811154b1670b9661e264d8aa2
SHA5124def0bd15ddee8f1dc91e0fb3a76928325f29ed51711bec672d2dc1ada396b3c848cdc3b24bcdf620edf8dc8474b744c12362091425d70d0521ba934aaf69aae
-
memory/616-180-0x0000000000000000-mapping.dmp
-
memory/756-132-0x0000000000000000-mapping.dmp
-
memory/1956-185-0x0000000000000000-mapping.dmp
-
memory/1956-219-0x00007FFFB20E0000-0x00007FFFB2BA1000-memory.dmpFilesize
10.8MB
-
memory/1956-200-0x00007FFFB20E0000-0x00007FFFB2BA1000-memory.dmpFilesize
10.8MB
-
memory/1956-198-0x0000000000B30000-0x0000000000B6E000-memory.dmpFilesize
248KB
-
memory/1972-213-0x0000000002DDD000-0x0000000002DE6000-memory.dmpFilesize
36KB
-
memory/1972-189-0x0000000000000000-mapping.dmp
-
memory/1972-214-0x0000000002CC0000-0x0000000002CC9000-memory.dmpFilesize
36KB
-
memory/1972-215-0x0000000000400000-0x0000000002B7B000-memory.dmpFilesize
39.5MB
-
memory/2032-209-0x0000000000000000-mapping.dmp
-
memory/2056-184-0x0000000000000000-mapping.dmp
-
memory/2056-199-0x00007FFFB20E0000-0x00007FFFB2BA1000-memory.dmpFilesize
10.8MB
-
memory/2056-194-0x0000000000200000-0x0000000000208000-memory.dmpFilesize
32KB
-
memory/2056-220-0x00007FFFB20E0000-0x00007FFFB2BA1000-memory.dmpFilesize
10.8MB
-
memory/2308-186-0x0000000000000000-mapping.dmp
-
memory/2560-177-0x0000000000000000-mapping.dmp
-
memory/2892-188-0x0000000000000000-mapping.dmp
-
memory/3132-201-0x0000000000000000-mapping.dmp
-
memory/3412-179-0x0000000000000000-mapping.dmp
-
memory/3668-182-0x0000000000000000-mapping.dmp
-
memory/3696-178-0x0000000000000000-mapping.dmp
-
memory/4268-181-0x0000000000000000-mapping.dmp
-
memory/4616-176-0x0000000000000000-mapping.dmp
-
memory/4620-218-0x0000000000400000-0x0000000002BD7000-memory.dmpFilesize
39.8MB
-
memory/4620-217-0x0000000002D60000-0x0000000002DFD000-memory.dmpFilesize
628KB
-
memory/4620-216-0x0000000002E2D000-0x0000000002E91000-memory.dmpFilesize
400KB
-
memory/4620-221-0x0000000002E2D000-0x0000000002E91000-memory.dmpFilesize
400KB
-
memory/4620-190-0x0000000000000000-mapping.dmp
-
memory/4680-154-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4680-166-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-162-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-159-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4680-156-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4680-135-0x0000000000000000-mapping.dmp
-
memory/4680-168-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-203-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-205-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4680-204-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4680-206-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4680-207-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4680-167-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-164-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4680-165-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-163-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-161-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4680-160-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4680-157-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4680-155-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4680-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4680-152-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4680-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4680-151-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4680-149-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/5112-183-0x0000000000000000-mapping.dmp