Analysis
-
max time kernel
56s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2022 15:31
Static task
static1
Behavioral task
behavioral1
Sample
EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe
Resource
win7-20220812-en
General
-
Target
EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe
-
Size
2.9MB
-
MD5
37b7f135d14d9619b4ba8be4e70fb1da
-
SHA1
3c057bf6c77427a0858a0de811ddd85d7997e637
-
SHA256
ef0c34580084f9855c1e5c3fa9d902688d400baabc7366c8da9ba3d4b708da49
-
SHA512
e524fe6e34ee565b72e3007e12b05bd18796b9d893bc09b491791f6685f76bc8c2ecbe2c6fe7db69392037677dbe341715ec67294e7f30318278a084dfb9ae9d
Malware Config
Extracted
vidar
39.4
933
https://sergeevih43.tumblr.com/
-
profile_id
933
Extracted
redline
1111
185.106.92.228:24221
-
auth_value
2a33c2d7ead0c8a22693c06db06f29ee
Extracted
redline
ruzki
109.107.180.76:37989
-
auth_value
4f5e74d55dd9a2105dc2800dd63ef43d
Extracted
redline
top1
pemararslava.xyz:80
-
auth_value
e3ff30d1ffe0ffdb11211b351a0179a1
Extracted
redline
Lyla.04.08
185.215.113.216:21921
-
auth_value
7f2bf6f810414d0f2fc0b3b8d54a76ac
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
sahiba_7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" sahiba_7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection sahiba_7.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process 11 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXeschtasks.exeschtasks.exeschtasks.exeschtasks.exerundll32.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4324 884 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 143356 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 96468 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 154692 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 176076 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 185196 96528 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 185208 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 189876 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 199724 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 217776 96528 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 225924 96528 schtasks.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4132-321-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/1680-325-0x0000000000400000-0x0000000000ADA000-memory.dmp family_redline behavioral2/memory/19192-364-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/19192-365-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Processes:
resource yara_rule behavioral2/memory/22452-367-0x0000000000400000-0x00000000004C8000-memory.dmp dcrat behavioral2/memory/22452-366-0x0000000000000000-mapping.dmp dcrat -
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4156-233-0x0000000002060000-0x00000000020FD000-memory.dmp family_vidar behavioral2/memory/4156-243-0x0000000000400000-0x00000000004A4000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurlpp.dll aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 21 IoCs
Processes:
setup_install.exesahiba_2.exesahiba_1.exesahiba_5.exesahiba_8.exesahiba_4.exesahiba_6.exesahiba_7.exesahiba_3.exesahiba_9.exesahiba_10.exesahiba_1.exe1.exe2.exe3.exe4.exeVsxrh3VxUhXAR6xFeMAuhqEX.exe8V0z3IeH4ABCXrdYhTY3jXzu.exeFQ3LuJrcC9l2fFR20R2A27Y_.exelRv2c0JcGW1FKTtacBNET9Vg.exec3PHLcV_9gu7dv539J9kgODb.exepid process 4656 setup_install.exe 3412 sahiba_2.exe 3428 sahiba_1.exe 216 sahiba_5.exe 224 sahiba_8.exe 3648 sahiba_4.exe 5084 sahiba_6.exe 4128 sahiba_7.exe 4156 sahiba_3.exe 3952 sahiba_9.exe 4928 sahiba_10.exe 1524 sahiba_1.exe 5092 1.exe 4192 2.exe 1432 3.exe 688 4.exe 4304 Vsxrh3VxUhXAR6xFeMAuhqEX.exe 1856 8V0z3IeH4ABCXrdYhTY3jXzu.exe 1448 FQ3LuJrcC9l2fFR20R2A27Y_.exe 4920 lRv2c0JcGW1FKTtacBNET9Vg.exe 1680 c3PHLcV_9gu7dv539J9kgODb.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exesahiba_1.exesahiba_10.exesahiba_7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation sahiba_1.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation sahiba_10.exe Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation sahiba_7.exe -
Loads dropped DLL 7 IoCs
Processes:
setup_install.exesahiba_2.exerundll32.exepid process 4656 setup_install.exe 4656 setup_install.exe 4656 setup_install.exe 4656 setup_install.exe 4656 setup_install.exe 3412 sahiba_2.exe 4160 rundll32.exe -
Uses the VBS compiler for execution 1 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 ipinfo.io 25 ipinfo.io -
Drops file in Program Files directory 10 IoCs
Processes:
Vsxrh3VxUhXAR6xFeMAuhqEX.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\tag.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\WW1.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jshainx.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\rawxdev.exe Vsxrh3VxUhXAR6xFeMAuhqEX.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1448 4656 WerFault.exe setup_install.exe 3216 3648 WerFault.exe sahiba_4.exe 3780 4160 WerFault.exe rundll32.exe 632 4156 WerFault.exe sahiba_3.exe 24264 3392 WerFault.exe bO2VwqvRUK57QFu9IEjFkiPI.exe 94032 3392 WerFault.exe bO2VwqvRUK57QFu9IEjFkiPI.exe 157116 3392 WerFault.exe bO2VwqvRUK57QFu9IEjFkiPI.exe 222648 185272 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
FQ3LuJrcC9l2fFR20R2A27Y_.exesahiba_2.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI FQ3LuJrcC9l2fFR20R2A27Y_.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI FQ3LuJrcC9l2fFR20R2A27Y_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI FQ3LuJrcC9l2fFR20R2A27Y_.exe -
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 154692 schtasks.exe 185208 schtasks.exe 189876 schtasks.exe 199724 schtasks.exe 143356 schtasks.exe 96468 schtasks.exe 176076 schtasks.exe 217776 schtasks.exe 225924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sahiba_2.exepid process 3412 sahiba_2.exe 3412 sahiba_2.exe 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 764 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sahiba_2.exepid process 3412 sahiba_2.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
sahiba_5.exesahiba_9.exesahiba_6.exe1.exe2.exe3.exe4.exesahiba_8.exedescription pid process Token: SeDebugPrivilege 216 sahiba_5.exe Token: SeDebugPrivilege 3952 sahiba_9.exe Token: SeDebugPrivilege 5084 sahiba_6.exe Token: SeDebugPrivilege 5092 1.exe Token: SeDebugPrivilege 4192 2.exe Token: SeDebugPrivilege 1432 3.exe Token: SeDebugPrivilege 688 4.exe Token: SeShutdownPrivilege 764 Token: SeCreatePagefilePrivilege 764 Token: SeDebugPrivilege 224 sahiba_8.exe Token: SeShutdownPrivilege 764 Token: SeCreatePagefilePrivilege 764 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_1.exesahiba_10.exedescription pid process target process PID 444 wrote to memory of 4656 444 EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe setup_install.exe PID 444 wrote to memory of 4656 444 EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe setup_install.exe PID 444 wrote to memory of 4656 444 EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe setup_install.exe PID 4656 wrote to memory of 1172 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1172 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1172 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3116 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3116 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3116 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1708 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1708 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1708 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4852 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4852 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4852 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 668 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 668 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 668 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 544 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 544 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 544 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1964 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1964 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 1964 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3448 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3448 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3448 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 264 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 264 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 264 4656 setup_install.exe cmd.exe PID 1172 wrote to memory of 3428 1172 cmd.exe sahiba_1.exe PID 1172 wrote to memory of 3428 1172 cmd.exe sahiba_1.exe PID 1172 wrote to memory of 3428 1172 cmd.exe sahiba_1.exe PID 3116 wrote to memory of 3412 3116 cmd.exe sahiba_2.exe PID 3116 wrote to memory of 3412 3116 cmd.exe sahiba_2.exe PID 3116 wrote to memory of 3412 3116 cmd.exe sahiba_2.exe PID 4656 wrote to memory of 3416 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3416 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3416 4656 setup_install.exe cmd.exe PID 668 wrote to memory of 216 668 cmd.exe sahiba_5.exe PID 668 wrote to memory of 216 668 cmd.exe sahiba_5.exe PID 3448 wrote to memory of 224 3448 cmd.exe sahiba_8.exe PID 3448 wrote to memory of 224 3448 cmd.exe sahiba_8.exe PID 3448 wrote to memory of 224 3448 cmd.exe sahiba_8.exe PID 4852 wrote to memory of 3648 4852 cmd.exe sahiba_4.exe PID 4852 wrote to memory of 3648 4852 cmd.exe sahiba_4.exe PID 544 wrote to memory of 5084 544 cmd.exe sahiba_6.exe PID 544 wrote to memory of 5084 544 cmd.exe sahiba_6.exe PID 1964 wrote to memory of 4128 1964 cmd.exe sahiba_7.exe PID 1964 wrote to memory of 4128 1964 cmd.exe sahiba_7.exe PID 1964 wrote to memory of 4128 1964 cmd.exe sahiba_7.exe PID 1708 wrote to memory of 4156 1708 cmd.exe sahiba_3.exe PID 1708 wrote to memory of 4156 1708 cmd.exe sahiba_3.exe PID 1708 wrote to memory of 4156 1708 cmd.exe sahiba_3.exe PID 264 wrote to memory of 3952 264 cmd.exe sahiba_9.exe PID 264 wrote to memory of 3952 264 cmd.exe sahiba_9.exe PID 3416 wrote to memory of 4928 3416 cmd.exe sahiba_10.exe PID 3416 wrote to memory of 4928 3416 cmd.exe sahiba_10.exe PID 3416 wrote to memory of 4928 3416 cmd.exe sahiba_10.exe PID 3428 wrote to memory of 1524 3428 sahiba_1.exe sahiba_1.exe PID 3428 wrote to memory of 1524 3428 sahiba_1.exe sahiba_1.exe PID 3428 wrote to memory of 1524 3428 sahiba_1.exe sahiba_1.exe PID 4928 wrote to memory of 5092 4928 sahiba_10.exe 1.exe PID 4928 wrote to memory of 5092 4928 sahiba_10.exe 1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe"C:\Users\Admin\AppData\Local\Temp\EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_1.exesahiba_1.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_1.exe" -a5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_2.exesahiba_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_3.exesahiba_3.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 16085⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_4.exesahiba_4.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3648 -s 11805⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_5.exesahiba_5.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_6.exesahiba_6.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_7.exesahiba_7.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\Vsxrh3VxUhXAR6xFeMAuhqEX.exe"C:\Users\Admin\Documents\Vsxrh3VxUhXAR6xFeMAuhqEX.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AbtZ46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647187⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:87⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4004166867629044111,6779714181442203617,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647187⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2239590628459552488,16984652002205040515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2239590628459552488,16984652002205040515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647187⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647187⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nhGL46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A3AZ46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647187⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1ALSZ46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647187⤵
-
C:\Program Files (x86)\Company\NewProduct\F0geI.exe"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\real.exe"C:\Program Files (x86)\Company\NewProduct\real.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\safert44.exe"C:\Program Files (x86)\Company\NewProduct\safert44.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\jshainx.exe"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\WW1.exe"C:\Program Files (x86)\Company\NewProduct\WW1.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\tag.exe"C:\Program Files (x86)\Company\NewProduct\tag.exe"6⤵
-
C:\Users\Admin\Documents\8V0z3IeH4ABCXrdYhTY3jXzu.exe"C:\Users\Admin\Documents\8V0z3IeH4ABCXrdYhTY3jXzu.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\FQ3LuJrcC9l2fFR20R2A27Y_.exe"C:\Users\Admin\Documents\FQ3LuJrcC9l2fFR20R2A27Y_.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\Documents\lRv2c0JcGW1FKTtacBNET9Vg.exe"C:\Users\Admin\Documents\lRv2c0JcGW1FKTtacBNET9Vg.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" LFh69P7.ZC6 /u -S6⤵
-
C:\Users\Admin\Documents\c3PHLcV_9gu7dv539J9kgODb.exe"C:\Users\Admin\Documents\c3PHLcV_9gu7dv539J9kgODb.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\SwbkbIPIJjrj6uTz71lnr7Et.exe"C:\Users\Admin\Documents\SwbkbIPIJjrj6uTz71lnr7Et.exe"5⤵
-
C:\Users\Admin\Documents\oK_42S1ZkaBoC1UsUKXDPROR.exe"C:\Users\Admin\Documents\oK_42S1ZkaBoC1UsUKXDPROR.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==7⤵
-
C:\Users\Admin\Documents\FVBT0LEyrlPDWWqqbEPlaCcl.exe"C:\Users\Admin\Documents\FVBT0LEyrlPDWWqqbEPlaCcl.exe"5⤵
-
C:\Users\Admin\Documents\5QhiXTRu6v2yml_MK5LvnNCq.exe"C:\Users\Admin\Documents\5QhiXTRu6v2yml_MK5LvnNCq.exe"5⤵
-
C:\Users\Admin\Documents\A63LsDz2pUx0WwYClPniMOyv.exe"C:\Users\Admin\Documents\A63LsDz2pUx0WwYClPniMOyv.exe"5⤵
-
C:\Users\Admin\Documents\A63LsDz2pUx0WwYClPniMOyv.exeC:\Users\Admin\Documents\A63LsDz2pUx0WwYClPniMOyv.exe6⤵
-
C:\Users\Admin\Documents\CE5Qwr7ODsGQX47eXFxrWoFp.exe"C:\Users\Admin\Documents\CE5Qwr7ODsGQX47eXFxrWoFp.exe"5⤵
-
C:\Users\Admin\Documents\CE5Qwr7ODsGQX47eXFxrWoFp.exeC:\Users\Admin\Documents\CE5Qwr7ODsGQX47eXFxrWoFp.exe6⤵
-
C:\Users\Admin\Documents\xHWxDTfUtr_yzbNHEXD1DASo.exe"C:\Users\Admin\Documents\xHWxDTfUtr_yzbNHEXD1DASo.exe"5⤵
-
C:\Users\Admin\Documents\xHWxDTfUtr_yzbNHEXD1DASo.exe"C:\Users\Admin\Documents\xHWxDTfUtr_yzbNHEXD1DASo.exe"6⤵
-
C:\Users\Admin\Documents\VyHSkvWv4bIXs2dh1ebzh1bw.exe"C:\Users\Admin\Documents\VyHSkvWv4bIXs2dh1ebzh1bw.exe"5⤵
-
C:\Users\Admin\Documents\VyHSkvWv4bIXs2dh1ebzh1bw.exe"C:\Users\Admin\Documents\VyHSkvWv4bIXs2dh1ebzh1bw.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\BHFH22BBL6KLIHK.exe"C:\Users\Admin\AppData\Local\Temp\BHFH22BBL6KLIHK.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\BHFH22BBL6KLIHK.exe"C:\Users\Admin\AppData\Local\Temp\BHFH22BBL6KLIHK.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\CH05BA4IDJ1J2F0.exe"C:\Users\Admin\AppData\Local\Temp\CH05BA4IDJ1J2F0.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\CH05BA4IDJ1J2F0.exe"C:\Users\Admin\AppData\Local\Temp\CH05BA4IDJ1J2F0.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\C6BEFE8687FIDE5.exe"C:\Users\Admin\AppData\Local\Temp\C6BEFE8687FIDE5.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\C6BEFE8687FIDE5.exe"C:\Users\Admin\AppData\Local\Temp\C6BEFE8687FIDE5.exe"8⤵
-
C:\Users\Admin\Documents\WVXCR7sdXxRgr6_ufNc9_7mX.exe"C:\Users\Admin\Documents\WVXCR7sdXxRgr6_ufNc9_7mX.exe"5⤵
-
C:\Users\Admin\Documents\WVXCR7sdXxRgr6_ufNc9_7mX.exe"C:\Users\Admin\Documents\WVXCR7sdXxRgr6_ufNc9_7mX.exe" -hq6⤵
-
C:\Users\Admin\Documents\D1i23teNRilI8z71WmVgorGt.exe"C:\Users\Admin\Documents\D1i23teNRilI8z71WmVgorGt.exe"5⤵
-
C:\Users\Admin\Documents\D1i23teNRilI8z71WmVgorGt.exe"C:\Users\Admin\Documents\D1i23teNRilI8z71WmVgorGt.exe"6⤵
-
C:\Users\Admin\Documents\bO2VwqvRUK57QFu9IEjFkiPI.exe"C:\Users\Admin\Documents\bO2VwqvRUK57QFu9IEjFkiPI.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 4526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 7646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 7726⤵
- Program crash
-
C:\Users\Admin\Documents\5bN1KdmvYePFabaAra3qVcJN.exe"C:\Users\Admin\Documents\5bN1KdmvYePFabaAra3qVcJN.exe"5⤵
-
C:\Users\Admin\Documents\cNla9dhZap2aW1lMuZBqK8wm.exe"C:\Users\Admin\Documents\cNla9dhZap2aW1lMuZBqK8wm.exe"5⤵
-
C:\Users\Admin\Documents\xaS7zjtA8F11Pou0Num_GEPb.exe"C:\Users\Admin\Documents\xaS7zjtA8F11Pou0Num_GEPb.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"6⤵
-
C:\Users\Admin\Documents\mrPeoRqwZd_vGLFF53i7qW4d.exe"C:\Users\Admin\Documents\mrPeoRqwZd_vGLFF53i7qW4d.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_8.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_8.exesahiba_8.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_9.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_9.exesahiba_9.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_10.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_10.exesahiba_10.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 5043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 46561⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 3648 -ip 36481⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4160 -ip 41601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4156 -ip 41561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3392 -ip 33921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3392 -ip 33921⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647181⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8f2646f8,0x7ffa8f264708,0x7ffa8f2647181⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Desktop\msedge.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3392 -ip 33921⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Desktop\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 185272 -s 6003⤵
- Program crash
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 185272 -ip 1852721⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
110KB
MD5fe502e329a84d66bda799044590f25d3
SHA10514ceaf0fe4bb449a2ac8c58712295e3443a936
SHA2565e87ad15af3701aa5a39091280fe01799b064ef4087d9364dfd5ac6449346e03
SHA512423a20b93683977e24cf69e61c71c26abdefa126350f92991a9c67e154154bf22a22b2d082c441be1c8731fb9168d3f18ae2428d4b8953b2b6951cc7608a37b3
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
110KB
MD5fe502e329a84d66bda799044590f25d3
SHA10514ceaf0fe4bb449a2ac8c58712295e3443a936
SHA2565e87ad15af3701aa5a39091280fe01799b064ef4087d9364dfd5ac6449346e03
SHA512423a20b93683977e24cf69e61c71c26abdefa126350f92991a9c67e154154bf22a22b2d082c441be1c8731fb9168d3f18ae2428d4b8953b2b6951cc7608a37b3
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
110KB
MD5f877fb92d1f28a8644ac61fb6172a929
SHA1f121559b38f54956c937183f7c272b396faf271e
SHA2568173f4c89e3e5bbd179326d196499ecdde3beba7d138424c2e746dffe83621b1
SHA512f4080a43ecc2986ad52b3c9fc4e435e9ea2c49c0adccc8b93f4c8f82ce16657c924d7e08f432efaa6cbe347e21cd72ba8b54a1449ffa779604ab88a23814d48a
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
110KB
MD5f877fb92d1f28a8644ac61fb6172a929
SHA1f121559b38f54956c937183f7c272b396faf271e
SHA2568173f4c89e3e5bbd179326d196499ecdde3beba7d138424c2e746dffe83621b1
SHA512f4080a43ecc2986ad52b3c9fc4e435e9ea2c49c0adccc8b93f4c8f82ce16657c924d7e08f432efaa6cbe347e21cd72ba8b54a1449ffa779604ab88a23814d48a
-
C:\Users\Admin\AppData\Local\Temp\3.exeFilesize
110KB
MD54b6c32863af87213475d0b6182cfd387
SHA100a4e483bd89db5a36be867764efcd6871fb659f
SHA256f46cd9ffa766f1ee1f68405d607d655fe5a655e1f9b3a33716b5713d56d0a853
SHA51263810ab5ec325dcf7eb31c18899a869b33f9757937b2edff436debe72a64e687b4d9c8664eedadf75e16450676953ae6b37b43c921bb8022b879da153d3f69d0
-
C:\Users\Admin\AppData\Local\Temp\3.exeFilesize
110KB
MD54b6c32863af87213475d0b6182cfd387
SHA100a4e483bd89db5a36be867764efcd6871fb659f
SHA256f46cd9ffa766f1ee1f68405d607d655fe5a655e1f9b3a33716b5713d56d0a853
SHA51263810ab5ec325dcf7eb31c18899a869b33f9757937b2edff436debe72a64e687b4d9c8664eedadf75e16450676953ae6b37b43c921bb8022b879da153d3f69d0
-
C:\Users\Admin\AppData\Local\Temp\4.exeFilesize
110KB
MD583b06b32fe0110f9f36a960adc82f443
SHA1ef9cb14c6c15c9ea322c94bb13435dd59b7abbb5
SHA2561c0667901a1814a155d900e7eb0dbd427e2c9a469b0963fddf3b9531a6b1232f
SHA51220a6cad8c13f0377637cbaa59168c30899b15d2512a62edd3471482037ccea35d9e2b2fdb0ba3d03d93f77cb1339bc98479a46adfcbc71a8fe2d55f37b219109
-
C:\Users\Admin\AppData\Local\Temp\4.exeFilesize
110KB
MD583b06b32fe0110f9f36a960adc82f443
SHA1ef9cb14c6c15c9ea322c94bb13435dd59b7abbb5
SHA2561c0667901a1814a155d900e7eb0dbd427e2c9a469b0963fddf3b9531a6b1232f
SHA51220a6cad8c13f0377637cbaa59168c30899b15d2512a62edd3471482037ccea35d9e2b2fdb0ba3d03d93f77cb1339bc98479a46adfcbc71a8fe2d55f37b219109
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_1.txtFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_10.exeFilesize
566KB
MD54957c80dd29b5528759cb5c81c212aac
SHA1bc48e8009ecd94af887e4a598566010dccd567ad
SHA2565486fc48a976f958a9d1ab48305365dc26b28df3958b1be7e1994522df44c820
SHA5125ebe35ac1d6a512f18fb8e1aff33cfb17836580ee41dacd0bc35f6c441de8d764667c1e1d1036601ae004c866c524e69b305d7e8e1cb651d1a71c23490fc2c3f
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_10.txtFilesize
566KB
MD54957c80dd29b5528759cb5c81c212aac
SHA1bc48e8009ecd94af887e4a598566010dccd567ad
SHA2565486fc48a976f958a9d1ab48305365dc26b28df3958b1be7e1994522df44c820
SHA5125ebe35ac1d6a512f18fb8e1aff33cfb17836580ee41dacd0bc35f6c441de8d764667c1e1d1036601ae004c866c524e69b305d7e8e1cb651d1a71c23490fc2c3f
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_2.exeFilesize
286KB
MD57673460dffe0cbeb8447f395ee489fde
SHA1d2e110969d8a40a069e0568020066836c66fac24
SHA256451f378c29a038c08641c24b07f478098e95b70d18310d3207e29bcf42e2a58c
SHA512cc2f5fe4723a8a6337be098e36538661e6836ac0222de82b46cc9ab5ac0410146fce60453c00ff33567aba1bbde7b4a0c31a4960eef5db8912c5be28d37295c9
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_2.txtFilesize
286KB
MD57673460dffe0cbeb8447f395ee489fde
SHA1d2e110969d8a40a069e0568020066836c66fac24
SHA256451f378c29a038c08641c24b07f478098e95b70d18310d3207e29bcf42e2a58c
SHA512cc2f5fe4723a8a6337be098e36538661e6836ac0222de82b46cc9ab5ac0410146fce60453c00ff33567aba1bbde7b4a0c31a4960eef5db8912c5be28d37295c9
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_3.exeFilesize
623KB
MD50049dc5ee3390c472e2da280b92e2c26
SHA192aaede97adc658417b021cf9ed607784b62e503
SHA2568d5ee031b3069715a6f2920d9f82ad6844fc75980d211c5359d114e2582f386a
SHA51278b9a686ca2c6e0f25209b3e962659bef7ef45b3e2f27130c7fbf6c65283a433222c48001bfea31327404aef2ace0563b3bc278a8fc4e8d8b6e55d7e9800c765
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_3.txtFilesize
623KB
MD50049dc5ee3390c472e2da280b92e2c26
SHA192aaede97adc658417b021cf9ed607784b62e503
SHA2568d5ee031b3069715a6f2920d9f82ad6844fc75980d211c5359d114e2582f386a
SHA51278b9a686ca2c6e0f25209b3e962659bef7ef45b3e2f27130c7fbf6c65283a433222c48001bfea31327404aef2ace0563b3bc278a8fc4e8d8b6e55d7e9800c765
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_4.exeFilesize
246KB
MD51979a7b0970c99aa4eeccddd32175df0
SHA1d2fab2818f94d57273b2aed09f4ae38f28da13a7
SHA2567e3dd012bdc04bd04b0a06987ecba6bad7ce3fa7db26bf7866020954eaa0fc19
SHA512a0e738ed99003c53f59439ddcd5ca6f0bd8fb4e98156f726dbed2ec59d327e4c3e6c37be9f54039fdba4c370e9b563aca4e362049cd027c32130cb20678c4182
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_4.txtFilesize
246KB
MD51979a7b0970c99aa4eeccddd32175df0
SHA1d2fab2818f94d57273b2aed09f4ae38f28da13a7
SHA2567e3dd012bdc04bd04b0a06987ecba6bad7ce3fa7db26bf7866020954eaa0fc19
SHA512a0e738ed99003c53f59439ddcd5ca6f0bd8fb4e98156f726dbed2ec59d327e4c3e6c37be9f54039fdba4c370e9b563aca4e362049cd027c32130cb20678c4182
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_5.exeFilesize
156KB
MD59c18a24236bb56e9f69ad1488f5d64ff
SHA12cf7f8ac503949da3a8e7ef5245b9cfbfb6a3498
SHA25670b71de5159cc877c54fb792ec132e2ee741ed052e7803f9ccde5b503f0be91d
SHA5129f8c53fb8b36a2098f73471b945cf434bec534b10ba5748045ad0fb6034ec71d61ca53522e9b951e26b8aedc768ac73764176da65a505f8eb8804a2b37058e38
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_5.txtFilesize
156KB
MD59c18a24236bb56e9f69ad1488f5d64ff
SHA12cf7f8ac503949da3a8e7ef5245b9cfbfb6a3498
SHA25670b71de5159cc877c54fb792ec132e2ee741ed052e7803f9ccde5b503f0be91d
SHA5129f8c53fb8b36a2098f73471b945cf434bec534b10ba5748045ad0fb6034ec71d61ca53522e9b951e26b8aedc768ac73764176da65a505f8eb8804a2b37058e38
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_6.exeFilesize
152KB
MD588505063bfe174330a0b64921ae996b2
SHA1822ee3826ec4864a3799d88c8c44e720a821ca9f
SHA256118bd4bc740ceb90ee746885aa223d084df5ea457db13a826ed426fc9bf3add8
SHA51259c8732370a884a81896eb2c8e2da1c33bb901521f61440f6496589c95e5f23c3ce8a75de4d62512e49471990dfde08d6de97923019a9290c58a5029c24525b9
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_6.txtFilesize
152KB
MD588505063bfe174330a0b64921ae996b2
SHA1822ee3826ec4864a3799d88c8c44e720a821ca9f
SHA256118bd4bc740ceb90ee746885aa223d084df5ea457db13a826ed426fc9bf3add8
SHA51259c8732370a884a81896eb2c8e2da1c33bb901521f61440f6496589c95e5f23c3ce8a75de4d62512e49471990dfde08d6de97923019a9290c58a5029c24525b9
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_7.exeFilesize
812KB
MD5f8fdccdc4cc17f6781497d69742aeb58
SHA1026edf00ad6a4f77a99a8100060184caeb9a58ba
SHA25697f751d8e067a8ff661e6f4cb0eb7cd3033abdb89d5e87e50581e011ff4f4144
SHA512ee4969810435ab43fd7fe1cfc42667544cdb9766dacca2258cc4a860983b6477a9c8c74e6e41ef6230a89fd016f8f044eb83ca5e96796a6375dacd28e7254ac1
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_7.txtFilesize
812KB
MD5f8fdccdc4cc17f6781497d69742aeb58
SHA1026edf00ad6a4f77a99a8100060184caeb9a58ba
SHA25697f751d8e067a8ff661e6f4cb0eb7cd3033abdb89d5e87e50581e011ff4f4144
SHA512ee4969810435ab43fd7fe1cfc42667544cdb9766dacca2258cc4a860983b6477a9c8c74e6e41ef6230a89fd016f8f044eb83ca5e96796a6375dacd28e7254ac1
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_8.exeFilesize
354KB
MD56b4ac0ee3d52ba9636ae9ebe431fbd3c
SHA1b2c57b93ed94801d16c996059663ee7f252b29c6
SHA2562d82a6d61b624173e1492efa0eb272cd0ba50b950c3390d5aa4f8ca4f5141dfd
SHA512c3a75c8dda2ecb1fdd11bcf398036c9e28d4504c589d8b720fa398b03bebb101c752b0ff200b6977883015583fa8653624d6debbe10457f864f43b3c40dcc89c
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_8.txtFilesize
354KB
MD56b4ac0ee3d52ba9636ae9ebe431fbd3c
SHA1b2c57b93ed94801d16c996059663ee7f252b29c6
SHA2562d82a6d61b624173e1492efa0eb272cd0ba50b950c3390d5aa4f8ca4f5141dfd
SHA512c3a75c8dda2ecb1fdd11bcf398036c9e28d4504c589d8b720fa398b03bebb101c752b0ff200b6977883015583fa8653624d6debbe10457f864f43b3c40dcc89c
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_9.exeFilesize
159KB
MD5ca379d9f27877f8cd46f40663d6310a0
SHA1b987d948282b9ac460bddb667c673a289dfd1f17
SHA2568325fd805649d3037ccf0fb384876c211a5a8f78fd43275815aaa4211c0673e8
SHA512889ce30d0c36698dbe9347b076a4ccc2411a8ff13b4f28d5a465ebcab4954d63cd282f2a097d424286ed0c58b7ead9a2a63ed876728d1a7efe5cb747ffd828f8
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\sahiba_9.txtFilesize
159KB
MD5ca379d9f27877f8cd46f40663d6310a0
SHA1b987d948282b9ac460bddb667c673a289dfd1f17
SHA2568325fd805649d3037ccf0fb384876c211a5a8f78fd43275815aaa4211c0673e8
SHA512889ce30d0c36698dbe9347b076a4ccc2411a8ff13b4f28d5a465ebcab4954d63cd282f2a097d424286ed0c58b7ead9a2a63ed876728d1a7efe5cb747ffd828f8
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\setup_install.exeFilesize
287KB
MD591bb1a6c1cf044d60a57f3cf6a3d0b17
SHA1df5d1eeaf9abc0870c9b2a0a45856211bddabf7a
SHA25613e77e12451713bfb5c3ebe71a070d6486f029b679793565d0da40b7744421a0
SHA51238cfe7e012c4f3c4641a0d156b971982bf8d04f6e861793b356483ba9497bc7275d27cb6e4ad7979133e12850c4b79d3b257c07b2a8f839a54c43b3f4709716d
-
C:\Users\Admin\AppData\Local\Temp\7zSCB17BF46\setup_install.exeFilesize
287KB
MD591bb1a6c1cf044d60a57f3cf6a3d0b17
SHA1df5d1eeaf9abc0870c9b2a0a45856211bddabf7a
SHA25613e77e12451713bfb5c3ebe71a070d6486f029b679793565d0da40b7744421a0
SHA51238cfe7e012c4f3c4641a0d156b971982bf8d04f6e861793b356483ba9497bc7275d27cb6e4ad7979133e12850c4b79d3b257c07b2a8f839a54c43b3f4709716d
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Users\Admin\AppData\Local\Temp\axhub.datFilesize
552KB
MD599ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\Documents\5QhiXTRu6v2yml_MK5LvnNCq.exeFilesize
2.3MB
MD52f0c92fc69cc4dcc6e084870761467d7
SHA1e7f161250a42a406a905569b9ee5fdf6c7a6e2e1
SHA256c988f8334a6bc85e29e82aab21afc3ec524a81ad0c47d1b0f68b2681f7dbb8a8
SHA51200a1817d55685e3045a645532984ca18e7d37efe26a1c021c57ed85649909c76f13c5c6334404cc2d36e502944e47e61648218f62b3b77d89c0d643a9daeb70e
-
C:\Users\Admin\Documents\5QhiXTRu6v2yml_MK5LvnNCq.exeFilesize
2.3MB
MD52f0c92fc69cc4dcc6e084870761467d7
SHA1e7f161250a42a406a905569b9ee5fdf6c7a6e2e1
SHA256c988f8334a6bc85e29e82aab21afc3ec524a81ad0c47d1b0f68b2681f7dbb8a8
SHA51200a1817d55685e3045a645532984ca18e7d37efe26a1c021c57ed85649909c76f13c5c6334404cc2d36e502944e47e61648218f62b3b77d89c0d643a9daeb70e
-
C:\Users\Admin\Documents\5bN1KdmvYePFabaAra3qVcJN.exeFilesize
430KB
MD58fb12764b698724e91b224f8fbbb2d4d
SHA1a8760b6d46ae9fb83babcb2f73c98ebeff273475
SHA25617aea4f46b9b206e8df239707988a9520f1058a8c08d127d5b1f17dbd830cb1c
SHA5123d209d94062e6e4a3407aace31055bf600d7dbb342943209bad87d8a4028915529ff433e8239d6bacd9fad3bb4ab057ffe11b90d4cf211dc4a7a7131a41e8f70
-
C:\Users\Admin\Documents\8V0z3IeH4ABCXrdYhTY3jXzu.exeFilesize
1.4MB
MD55bf0b18c04ea51f8f0e1e30632067e46
SHA1c469a84de747ffad7133bdaea38222d28c54f574
SHA256dab6ddccb6147c17b517862ec18fe697867c11f237ceaccf794187d71476bc4b
SHA51267b313e1a121c71d98ca0e603039bb0c2159cd5140c5f0e3e63156ebd12072b2de7c93d8886ba49dc1da7888b13f396a56fa8924e62e473f070d3d51a920eade
-
C:\Users\Admin\Documents\8V0z3IeH4ABCXrdYhTY3jXzu.exeFilesize
1.4MB
MD55bf0b18c04ea51f8f0e1e30632067e46
SHA1c469a84de747ffad7133bdaea38222d28c54f574
SHA256dab6ddccb6147c17b517862ec18fe697867c11f237ceaccf794187d71476bc4b
SHA51267b313e1a121c71d98ca0e603039bb0c2159cd5140c5f0e3e63156ebd12072b2de7c93d8886ba49dc1da7888b13f396a56fa8924e62e473f070d3d51a920eade
-
C:\Users\Admin\Documents\A63LsDz2pUx0WwYClPniMOyv.exeFilesize
1.2MB
MD5c6a52c382a68643bc538132ab22c7ff5
SHA14191b9c6b01b0425514a611e9e6f2b0e7949a27b
SHA2569103fa2a21c6764da58c6a3b2884c50fc575d5fccd976b6194369275006778c5
SHA512630a387570b148a3e57b98eb068c793cef7a512ef4de343a0914b3882341c45737be9b21c8f89f6dfb69403542db660ce5903429b5f596a459b97ee88d34f6f8
-
C:\Users\Admin\Documents\A63LsDz2pUx0WwYClPniMOyv.exeFilesize
1.2MB
MD5c6a52c382a68643bc538132ab22c7ff5
SHA14191b9c6b01b0425514a611e9e6f2b0e7949a27b
SHA2569103fa2a21c6764da58c6a3b2884c50fc575d5fccd976b6194369275006778c5
SHA512630a387570b148a3e57b98eb068c793cef7a512ef4de343a0914b3882341c45737be9b21c8f89f6dfb69403542db660ce5903429b5f596a459b97ee88d34f6f8
-
C:\Users\Admin\Documents\FQ3LuJrcC9l2fFR20R2A27Y_.exeFilesize
233KB
MD5fc84941dcb911afdf47eebb86adcbb70
SHA10526744bc2739e575e6ca424e4020ade2dc5f078
SHA2567e4d1755200d5737bcc0eb3b13dafc8f0e4ec70112fa3cc8464e76713fd4157f
SHA512d449a518ce2f1833ca1732de50b57418c1caeebf11bf0b62bf78ae827818c3cd3b4338482731349ee1b1875f875742be0cd8eceb73ff8c4db7e6a043f8ad4604
-
C:\Users\Admin\Documents\FQ3LuJrcC9l2fFR20R2A27Y_.exeFilesize
233KB
MD5fc84941dcb911afdf47eebb86adcbb70
SHA10526744bc2739e575e6ca424e4020ade2dc5f078
SHA2567e4d1755200d5737bcc0eb3b13dafc8f0e4ec70112fa3cc8464e76713fd4157f
SHA512d449a518ce2f1833ca1732de50b57418c1caeebf11bf0b62bf78ae827818c3cd3b4338482731349ee1b1875f875742be0cd8eceb73ff8c4db7e6a043f8ad4604
-
C:\Users\Admin\Documents\FVBT0LEyrlPDWWqqbEPlaCcl.exeFilesize
2.4MB
MD52cda96207c561c95221d4f3d4f450ac5
SHA1a76129cc4273d1a0a6be61a0f6d7bbb5f36b93f0
SHA25662a4b4e7d99022ac4095b48f4fdcaa7e593591e2df28a1266c1ed0f6dff81974
SHA512f2974c903ac02f6f66ed6111a74e5ec696681672bff41a09071ff7b269207e47b467d7343eb7ba460ab3a475e0ef27ee0609b3cedcfdf40b5368d39b1b2e57fa
-
C:\Users\Admin\Documents\SwbkbIPIJjrj6uTz71lnr7Et.exeFilesize
4.0MB
MD5a836713beb54e5c692ea0d24c4176bb4
SHA1e06bb317e86a06dc7d933f909dd4e87cfdc47559
SHA2569ca0d26581d4ac8cd240ee07c051064aabcb7c6d054a147ceda0578a7e225510
SHA51289ee6803488212e7f66043bd7c19f63a3c2135918313e0519db6a1ba7cc6aa4894afac4b2f9c9e1732184bdd2db253bfea18848190226097f0084b95cfb5842a
-
C:\Users\Admin\Documents\Vsxrh3VxUhXAR6xFeMAuhqEX.exeFilesize
907KB
MD5b35d335e9261e963bca114d269140695
SHA18f2b1ead99ae43690ecd29e6f16022d53d91d280
SHA256e450f635c564bda4d1c22e0d9d4763f582c70a3806d54a3733a0bcc12edb3884
SHA512eca4c239e588103243d2ee9f6d5958a81665c48594d96446dfd91202b90c3a83dd45da0c03350f2fd5b3388ec67eb6d6217e4781ee3d9a638599cbc2842166df
-
C:\Users\Admin\Documents\Vsxrh3VxUhXAR6xFeMAuhqEX.exeFilesize
907KB
MD5b35d335e9261e963bca114d269140695
SHA18f2b1ead99ae43690ecd29e6f16022d53d91d280
SHA256e450f635c564bda4d1c22e0d9d4763f582c70a3806d54a3733a0bcc12edb3884
SHA512eca4c239e588103243d2ee9f6d5958a81665c48594d96446dfd91202b90c3a83dd45da0c03350f2fd5b3388ec67eb6d6217e4781ee3d9a638599cbc2842166df
-
C:\Users\Admin\Documents\WVXCR7sdXxRgr6_ufNc9_7mX.exeFilesize
76KB
MD50fa8b5af44c7bc0a44fae529acab3233
SHA1ec7d13a9e33cf4b4ede260c58a36f685b780ba00
SHA2562e10931eaa1c392d2b410e1676e6da9e2e8adb8b959403771845f168119710de
SHA5122ac39c159cb71712e0c9367926666106288f9c0f318687c94e7efdd725ec4b5465099be1a0e2dcd236778243da24bab814463bc8653bbd4b1ebc7c0dc0497128
-
C:\Users\Admin\Documents\c3PHLcV_9gu7dv539J9kgODb.exeFilesize
3.9MB
MD5c0f61e507c9fc499254e4b6bbaf3e0e0
SHA1e670f6b31c957e9d3eb7baaee63d6871ffbbcb05
SHA256c515bbd3acf1074ad8583651f2f089f0fc4b09173170cec9bb3b5ac87868e18c
SHA51210a4fa69e902b16521adefb14c4bbc864c3b6cf8efa95f500e08791327a7ff6b749bde0cd17fb926a44a9003b324188e0ae20602af4cf9d0b84034d211460a40
-
C:\Users\Admin\Documents\lRv2c0JcGW1FKTtacBNET9Vg.exeFilesize
1.7MB
MD51910c2b166ddbe21891499d9acdd8df3
SHA1b7b8268c3edb7d6f6024971173ab617f222336ef
SHA256cbbbecec4f7c97f85be78895d9bb590de0e631453ec873402d1cc97d9f61e446
SHA512a9f2b4ab78f42b9ceb222dd3effe12a4a342bbd26c2f5b745a2f399acac5794aca1a2a32e8719fdf05dd2b63f1447ac8f627197f4d4e6d05dd4d45f633737e60
-
C:\Users\Admin\Documents\oK_42S1ZkaBoC1UsUKXDPROR.exeFilesize
541KB
MD5674f0afec455f170be2a7a404dca1fc5
SHA16673d2a51f75cdeac20a1c9d9cea05b25c521c0f
SHA256d01c325c824f4e8a962d3a153ff2492d7a7e3855d1782201d6c6f4799c93279d
SHA512871c3bc5ce637416fddd994c819fa9b082c1e0092d2f19696f7864cc7c3edfc26fab2ee931beac5ce408e486646b5374d98a28f5a7f4cbe2092afe9ee03b8b4b
-
C:\Users\Admin\Documents\xHWxDTfUtr_yzbNHEXD1DASo.exeFilesize
2.5MB
MD53d91733159c79464ec9a9d83b9d33cd0
SHA15fe20fb1c6dc351602231681d1ffb5a71c5aeb9d
SHA256d5eb255fcee9bfd87925d1595a954c702ba36b6e33752b33af3b0acd1cde8a9c
SHA512ab2ddb2434dda02de651f0090d5056e8bd73af48cbbad33bfe5abcd86725dec48cfdee85e7999ff0464ac5c59d38c6676b6d8a1d7fdcaa04c6df45681fc33cc7
-
C:\Users\Admin\Documents\xHWxDTfUtr_yzbNHEXD1DASo.exeFilesize
2.5MB
MD53d91733159c79464ec9a9d83b9d33cd0
SHA15fe20fb1c6dc351602231681d1ffb5a71c5aeb9d
SHA256d5eb255fcee9bfd87925d1595a954c702ba36b6e33752b33af3b0acd1cde8a9c
SHA512ab2ddb2434dda02de651f0090d5056e8bd73af48cbbad33bfe5abcd86725dec48cfdee85e7999ff0464ac5c59d38c6676b6d8a1d7fdcaa04c6df45681fc33cc7
-
memory/204-316-0x0000000000000000-mapping.dmp
-
memory/216-185-0x0000000000000000-mapping.dmp
-
memory/216-194-0x0000000000620000-0x0000000000650000-memory.dmpFilesize
192KB
-
memory/216-245-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/216-202-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/224-257-0x0000000005870000-0x000000000597A000-memory.dmpFilesize
1.0MB
-
memory/224-263-0x00000000007D8000-0x00000000007FA000-memory.dmpFilesize
136KB
-
memory/224-217-0x00000000007D8000-0x00000000007FA000-memory.dmpFilesize
136KB
-
memory/224-186-0x0000000000000000-mapping.dmp
-
memory/224-219-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/224-229-0x00000000051C0000-0x00000000057D8000-memory.dmpFilesize
6.1MB
-
memory/224-221-0x0000000004C10000-0x00000000051B4000-memory.dmpFilesize
5.6MB
-
memory/224-237-0x0000000004AB0000-0x0000000004AEC000-memory.dmpFilesize
240KB
-
memory/224-232-0x0000000004A90000-0x0000000004AA2000-memory.dmpFilesize
72KB
-
memory/224-218-0x0000000002060000-0x000000000208F000-memory.dmpFilesize
188KB
-
memory/264-402-0x00000000002E0000-0x0000000000923000-memory.dmpFilesize
6.3MB
-
memory/264-407-0x00000000002E0000-0x0000000000923000-memory.dmpFilesize
6.3MB
-
memory/264-401-0x00000000002E0000-0x0000000000923000-memory.dmpFilesize
6.3MB
-
memory/264-181-0x0000000000000000-mapping.dmp
-
memory/264-317-0x00000000002E0000-0x0000000000923000-memory.dmpFilesize
6.3MB
-
memory/264-282-0x0000000000000000-mapping.dmp
-
memory/264-404-0x00000000002E0000-0x0000000000923000-memory.dmpFilesize
6.3MB
-
memory/264-408-0x00000000002E0000-0x0000000000923000-memory.dmpFilesize
6.3MB
-
memory/264-409-0x00000000002E0000-0x0000000000923000-memory.dmpFilesize
6.3MB
-
memory/544-178-0x0000000000000000-mapping.dmp
-
memory/668-177-0x0000000000000000-mapping.dmp
-
memory/688-242-0x0000000000750000-0x0000000000770000-memory.dmpFilesize
128KB
-
memory/688-247-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/688-264-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/688-238-0x0000000000000000-mapping.dmp
-
memory/752-388-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/752-285-0x0000000000000000-mapping.dmp
-
memory/752-391-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/752-320-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/752-386-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/1172-173-0x0000000000000000-mapping.dmp
-
memory/1176-278-0x0000000000000000-mapping.dmp
-
memory/1176-324-0x0000000000400000-0x0000000000AEA000-memory.dmpFilesize
6.9MB
-
memory/1432-236-0x0000000000160000-0x0000000000180000-memory.dmpFilesize
128KB
-
memory/1432-230-0x0000000000000000-mapping.dmp
-
memory/1432-266-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/1432-256-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/1448-269-0x0000000000000000-mapping.dmp
-
memory/1448-284-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1448-281-0x0000000002882000-0x0000000002892000-memory.dmpFilesize
64KB
-
memory/1448-312-0x0000000000400000-0x00000000024BD000-memory.dmpFilesize
32.7MB
-
memory/1524-209-0x0000000000000000-mapping.dmp
-
memory/1528-308-0x0000000000000000-mapping.dmp
-
memory/1624-287-0x0000000000000000-mapping.dmp
-
memory/1624-311-0x0000000000230000-0x0000000000364000-memory.dmpFilesize
1.2MB
-
memory/1680-325-0x0000000000400000-0x0000000000ADA000-memory.dmpFilesize
6.9MB
-
memory/1680-277-0x0000000000000000-mapping.dmp
-
memory/1708-175-0x0000000000000000-mapping.dmp
-
memory/1756-286-0x0000000000000000-mapping.dmp
-
memory/1856-323-0x0000000000680000-0x0000000000692000-memory.dmpFilesize
72KB
-
memory/1856-327-0x0000000000400000-0x000000000056A000-memory.dmpFilesize
1.4MB
-
memory/1856-267-0x0000000000000000-mapping.dmp
-
memory/1964-179-0x0000000000000000-mapping.dmp
-
memory/2244-331-0x0000000000400000-0x0000000000D6E000-memory.dmpFilesize
9.4MB
-
memory/2244-297-0x0000000000000000-mapping.dmp
-
memory/2368-314-0x0000000000B50000-0x0000000000BC0000-memory.dmpFilesize
448KB
-
memory/2368-307-0x0000000000000000-mapping.dmp
-
memory/2632-293-0x0000000000000000-mapping.dmp
-
memory/2632-309-0x0000000000580000-0x0000000000717000-memory.dmpFilesize
1.6MB
-
memory/3116-174-0x0000000000000000-mapping.dmp
-
memory/3392-291-0x0000000000000000-mapping.dmp
-
memory/3408-347-0x0000000000000000-mapping.dmp
-
memory/3412-183-0x0000000000000000-mapping.dmp
-
memory/3412-258-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3412-223-0x0000000000480000-0x0000000000489000-memory.dmpFilesize
36KB
-
memory/3412-227-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3412-222-0x00000000004F8000-0x0000000000509000-memory.dmpFilesize
68KB
-
memory/3416-313-0x0000000000F40000-0x00000000011B6000-memory.dmpFilesize
2.5MB
-
memory/3416-184-0x0000000000000000-mapping.dmp
-
memory/3416-292-0x0000000000000000-mapping.dmp
-
memory/3428-182-0x0000000000000000-mapping.dmp
-
memory/3448-180-0x0000000000000000-mapping.dmp
-
memory/3648-190-0x0000000000000000-mapping.dmp
-
memory/3648-228-0x0000015BCBB40000-0x0000015BCBBAE000-memory.dmpFilesize
440KB
-
memory/3952-207-0x0000000000F20000-0x0000000000F52000-memory.dmpFilesize
200KB
-
memory/3952-211-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/3952-201-0x0000000000000000-mapping.dmp
-
memory/3952-246-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/4128-195-0x0000000000000000-mapping.dmp
-
memory/4132-318-0x0000000000000000-mapping.dmp
-
memory/4132-321-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4156-196-0x0000000000000000-mapping.dmp
-
memory/4156-243-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/4156-231-0x00000000007D8000-0x000000000083D000-memory.dmpFilesize
404KB
-
memory/4156-261-0x00000000007D8000-0x000000000083D000-memory.dmpFilesize
404KB
-
memory/4156-233-0x0000000002060000-0x00000000020FD000-memory.dmpFilesize
628KB
-
memory/4160-255-0x0000000000000000-mapping.dmp
-
memory/4192-252-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/4192-265-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/4192-220-0x0000000000000000-mapping.dmp
-
memory/4192-226-0x00000000000F0000-0x0000000000110000-memory.dmpFilesize
128KB
-
memory/4304-268-0x0000000000000000-mapping.dmp
-
memory/4376-289-0x0000000000000000-mapping.dmp
-
memory/4488-350-0x0000000000000000-mapping.dmp
-
memory/4496-322-0x0000000000000000-mapping.dmp
-
memory/4496-326-0x0000000000B00000-0x0000000000B33000-memory.dmpFilesize
204KB
-
memory/4496-344-0x0000000000B00000-0x0000000000B33000-memory.dmpFilesize
204KB
-
memory/4496-360-0x0000000000B00000-0x0000000000B33000-memory.dmpFilesize
204KB
-
memory/4540-306-0x0000000000000000-mapping.dmp
-
memory/4644-283-0x0000000000000000-mapping.dmp
-
memory/4656-143-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4656-147-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4656-155-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4656-130-0x0000000000000000-mapping.dmp
-
memory/4656-144-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4656-145-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4656-160-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4656-157-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-161-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-253-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4656-254-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4656-158-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-248-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-162-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-156-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4656-159-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-250-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4656-249-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4656-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4656-146-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4656-154-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4656-148-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4656-149-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4656-152-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4676-332-0x0000000000000000-mapping.dmp
-
memory/4760-288-0x0000000000000000-mapping.dmp
-
memory/4760-315-0x00000000006E0000-0x000000000095E000-memory.dmpFilesize
2.5MB
-
memory/4852-176-0x0000000000000000-mapping.dmp
-
memory/4920-276-0x0000000000000000-mapping.dmp
-
memory/4928-203-0x0000000000000000-mapping.dmp
-
memory/4928-208-0x0000000000460000-0x00000000004F2000-memory.dmpFilesize
584KB
-
memory/5044-310-0x00000000003F0000-0x0000000000464000-memory.dmpFilesize
464KB
-
memory/5044-290-0x0000000000000000-mapping.dmp
-
memory/5044-319-0x00000000072F0000-0x0000000007382000-memory.dmpFilesize
584KB
-
memory/5084-193-0x0000000000000000-mapping.dmp
-
memory/5084-206-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/5084-244-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/5084-200-0x0000000000F70000-0x0000000000FA0000-memory.dmpFilesize
192KB
-
memory/5092-212-0x0000000000000000-mapping.dmp
-
memory/5092-262-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/5092-239-0x00007FFA8D230000-0x00007FFA8DCF1000-memory.dmpFilesize
10.8MB
-
memory/5092-215-0x0000000000550000-0x0000000000570000-memory.dmpFilesize
128KB
-
memory/7732-355-0x0000000000000000-mapping.dmp
-
memory/19192-364-0x0000000000000000-mapping.dmp
-
memory/19192-365-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/22452-367-0x0000000000400000-0x00000000004C8000-memory.dmpFilesize
800KB
-
memory/22452-366-0x0000000000000000-mapping.dmp
-
memory/24316-359-0x0000000000000000-mapping.dmp
-
memory/37704-362-0x0000000000000000-mapping.dmp
-
memory/42856-363-0x0000000000000000-mapping.dmp
-
memory/66808-370-0x0000000000000000-mapping.dmp
-
memory/73756-372-0x0000000000000000-mapping.dmp
-
memory/76636-373-0x0000000000000000-mapping.dmp
-
memory/78956-376-0x0000000000000000-mapping.dmp
-
memory/91716-379-0x0000000000DE0000-0x0000000000DFE000-memory.dmpFilesize
120KB
-
memory/149784-397-0x00000000003A0000-0x00000000003BE000-memory.dmpFilesize
120KB
-
memory/193568-413-0x0000000000580000-0x000000000058A000-memory.dmpFilesize
40KB