Analysis
-
max time kernel
82s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2022 15:34
Static task
static1
Behavioral task
behavioral1
Sample
EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe
Resource
win7-20220812-en
General
-
Target
EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe
-
Size
2.9MB
-
MD5
37b7f135d14d9619b4ba8be4e70fb1da
-
SHA1
3c057bf6c77427a0858a0de811ddd85d7997e637
-
SHA256
ef0c34580084f9855c1e5c3fa9d902688d400baabc7366c8da9ba3d4b708da49
-
SHA512
e524fe6e34ee565b72e3007e12b05bd18796b9d893bc09b491791f6685f76bc8c2ecbe2c6fe7db69392037677dbe341715ec67294e7f30318278a084dfb9ae9d
Malware Config
Extracted
vidar
39.4
933
https://sergeevih43.tumblr.com/
-
profile_id
933
Extracted
redline
ruzki
109.107.180.76:37989
-
auth_value
4f5e74d55dd9a2105dc2800dd63ef43d
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Processes:
sahiba_7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" sahiba_7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sahiba_7.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 376 2132 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2656-345-0x0000000000400000-0x0000000000ADA000-memory.dmp family_redline behavioral2/memory/14524-404-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/14524-407-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Processes:
resource yara_rule behavioral2/memory/36332-411-0x0000000000000000-mapping.dmp dcrat behavioral2/memory/36332-413-0x0000000000400000-0x00000000004C8000-memory.dmp dcrat -
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3516-218-0x0000000002150000-0x00000000021ED000-memory.dmp family_vidar behavioral2/memory/3516-226-0x0000000000400000-0x00000000004A4000-memory.dmp family_vidar behavioral2/memory/3516-265-0x0000000002150000-0x00000000021ED000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0913B558\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libstdc++-6.dll aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 17 IoCs
Processes:
setup_install.exesahiba_1.exesahiba_5.exesahiba_3.exesahiba_8.exesahiba_6.exesahiba_10.exesahiba_2.exesahiba_9.exesahiba_7.exesahiba_4.exesahiba_1.exe1.exe2.exe3.exe4.exeBewl1SStti7hLe8BI9j1064h.exepid process 1796 setup_install.exe 540 sahiba_1.exe 3692 sahiba_5.exe 3516 sahiba_3.exe 2892 sahiba_8.exe 3624 sahiba_6.exe 3628 sahiba_10.exe 2220 sahiba_2.exe 2412 sahiba_9.exe 3688 sahiba_7.exe 3620 sahiba_4.exe 4812 sahiba_1.exe 1972 1.exe 1732 2.exe 4752 3.exe 2256 4.exe 3148 Bewl1SStti7hLe8BI9j1064h.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sahiba_10.exesahiba_7.exeEF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exesahiba_1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation sahiba_10.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation sahiba_7.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation sahiba_1.exe -
Loads dropped DLL 9 IoCs
Processes:
setup_install.exesahiba_2.exerundll32.exepid process 1796 setup_install.exe 1796 setup_install.exe 1796 setup_install.exe 1796 setup_install.exe 1796 setup_install.exe 1796 setup_install.exe 1796 setup_install.exe 2220 sahiba_2.exe 1244 rundll32.exe -
Uses the VBS compiler for execution 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ipinfo.io 16 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3396 1796 WerFault.exe setup_install.exe 220 3620 WerFault.exe sahiba_4.exe 4204 1244 WerFault.exe rundll32.exe 1060 3516 WerFault.exe sahiba_3.exe 1400 2680 WerFault.exe pDisoKZNsDRBQG5LRIUshCwd.exe 38724 2680 WerFault.exe pDisoKZNsDRBQG5LRIUshCwd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sahiba_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sahiba_2.exepid process 2220 sahiba_2.exe 2220 sahiba_2.exe 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 2060 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sahiba_2.exepid process 2220 sahiba_2.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
sahiba_5.exesahiba_6.exesahiba_9.exe1.exe2.exe3.exe4.exesahiba_8.exedescription pid process Token: SeDebugPrivilege 3692 sahiba_5.exe Token: SeDebugPrivilege 3624 sahiba_6.exe Token: SeDebugPrivilege 2412 sahiba_9.exe Token: SeDebugPrivilege 1972 1.exe Token: SeDebugPrivilege 1732 2.exe Token: SeDebugPrivilege 4752 3.exe Token: SeDebugPrivilege 2256 4.exe Token: SeShutdownPrivilege 2060 Token: SeCreatePagefilePrivilege 2060 Token: SeShutdownPrivilege 2060 Token: SeCreatePagefilePrivilege 2060 Token: SeDebugPrivilege 2892 sahiba_8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_1.exerUNdlL32.eXedescription pid process target process PID 400 wrote to memory of 1796 400 EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe setup_install.exe PID 400 wrote to memory of 1796 400 EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe setup_install.exe PID 400 wrote to memory of 1796 400 EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe setup_install.exe PID 1796 wrote to memory of 3304 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 3304 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 3304 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1432 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1432 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1432 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 4092 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 4092 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 4092 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1456 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1456 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1456 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1976 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1976 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1976 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 2740 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 2740 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 2740 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 2300 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 2300 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 2300 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 4248 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 4248 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 4248 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 3408 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 3408 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 3408 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1112 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1112 1796 setup_install.exe cmd.exe PID 1796 wrote to memory of 1112 1796 setup_install.exe cmd.exe PID 3304 wrote to memory of 540 3304 cmd.exe sahiba_1.exe PID 3304 wrote to memory of 540 3304 cmd.exe sahiba_1.exe PID 3304 wrote to memory of 540 3304 cmd.exe sahiba_1.exe PID 1976 wrote to memory of 3692 1976 cmd.exe sahiba_5.exe PID 1976 wrote to memory of 3692 1976 cmd.exe sahiba_5.exe PID 4092 wrote to memory of 3516 4092 cmd.exe sahiba_3.exe PID 4092 wrote to memory of 3516 4092 cmd.exe sahiba_3.exe PID 4092 wrote to memory of 3516 4092 cmd.exe sahiba_3.exe PID 4248 wrote to memory of 2892 4248 cmd.exe sahiba_8.exe PID 4248 wrote to memory of 2892 4248 cmd.exe sahiba_8.exe PID 4248 wrote to memory of 2892 4248 cmd.exe sahiba_8.exe PID 2740 wrote to memory of 3624 2740 cmd.exe sahiba_6.exe PID 2740 wrote to memory of 3624 2740 cmd.exe sahiba_6.exe PID 1112 wrote to memory of 3628 1112 cmd.exe sahiba_10.exe PID 1112 wrote to memory of 3628 1112 cmd.exe sahiba_10.exe PID 1112 wrote to memory of 3628 1112 cmd.exe sahiba_10.exe PID 1432 wrote to memory of 2220 1432 cmd.exe sahiba_2.exe PID 1432 wrote to memory of 2220 1432 cmd.exe sahiba_2.exe PID 1432 wrote to memory of 2220 1432 cmd.exe sahiba_2.exe PID 3408 wrote to memory of 2412 3408 cmd.exe sahiba_9.exe PID 3408 wrote to memory of 2412 3408 cmd.exe sahiba_9.exe PID 2300 wrote to memory of 3688 2300 cmd.exe sahiba_7.exe PID 2300 wrote to memory of 3688 2300 cmd.exe sahiba_7.exe PID 2300 wrote to memory of 3688 2300 cmd.exe sahiba_7.exe PID 1456 wrote to memory of 3620 1456 cmd.exe sahiba_4.exe PID 1456 wrote to memory of 3620 1456 cmd.exe sahiba_4.exe PID 540 wrote to memory of 4812 540 sahiba_1.exe sahiba_1.exe PID 540 wrote to memory of 4812 540 sahiba_1.exe sahiba_1.exe PID 540 wrote to memory of 4812 540 sahiba_1.exe sahiba_1.exe PID 376 wrote to memory of 1244 376 rUNdlL32.eXe rundll32.exe PID 376 wrote to memory of 1244 376 rUNdlL32.eXe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe"C:\Users\Admin\AppData\Local\Temp\EF0C34580084F9855C1E5C3FA9D902688D400BAABC736.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0913B558\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_1.exesahiba_1.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_1.exe" -a5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_4.exesahiba_4.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3620 -s 12125⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_5.exesahiba_5.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_7.exesahiba_7.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\Ct5ZeQEjzK_leNBC9VpIhFv4.exe"C:\Users\Admin\Documents\Ct5ZeQEjzK_leNBC9VpIhFv4.exe"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" LFh69P7.ZC6 /u -S6⤵
-
C:\Users\Admin\Documents\y8ig3dLKJ8QKLHJEUsSeg0Lk.exe"C:\Users\Admin\Documents\y8ig3dLKJ8QKLHJEUsSeg0Lk.exe"5⤵
-
C:\Users\Admin\Documents\H65992wLOu3WGoN4ryV8F9An.exe"C:\Users\Admin\Documents\H65992wLOu3WGoN4ryV8F9An.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"6⤵
-
C:\Users\Admin\Documents\pDisoKZNsDRBQG5LRIUshCwd.exe"C:\Users\Admin\Documents\pDisoKZNsDRBQG5LRIUshCwd.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 4526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 7646⤵
- Program crash
-
C:\Users\Admin\Documents\Bewl1SStti7hLe8BI9j1064h.exe"C:\Users\Admin\Documents\Bewl1SStti7hLe8BI9j1064h.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Bewl1SStti7hLe8BI9j1064h.exeC:\Users\Admin\Documents\Bewl1SStti7hLe8BI9j1064h.exe6⤵
-
C:\Users\Admin\Documents\a4AM0eoSmjtut4ZFLwhmsaN3.exe"C:\Users\Admin\Documents\a4AM0eoSmjtut4ZFLwhmsaN3.exe"5⤵
-
C:\Users\Admin\Documents\a4AM0eoSmjtut4ZFLwhmsaN3.exe"C:\Users\Admin\Documents\a4AM0eoSmjtut4ZFLwhmsaN3.exe" -hq6⤵
-
C:\Users\Admin\Documents\zD58ShiFeGHV7lEYj2IIM1gC.exe"C:\Users\Admin\Documents\zD58ShiFeGHV7lEYj2IIM1gC.exe"5⤵
-
C:\Users\Admin\Documents\MurtkqHdAzyKX7Yc2iyN9ws6.exe"C:\Users\Admin\Documents\MurtkqHdAzyKX7Yc2iyN9ws6.exe"5⤵
-
C:\Users\Admin\Documents\fGd39vQ0MUSO7P937RV2gqmT.exe"C:\Users\Admin\Documents\fGd39vQ0MUSO7P937RV2gqmT.exe"5⤵
-
C:\Users\Admin\Documents\vKfjIIxZh3OAZJhngUSRZ79r.exe"C:\Users\Admin\Documents\vKfjIIxZh3OAZJhngUSRZ79r.exe"5⤵
-
C:\Users\Admin\Documents\IDyEIzQ8ZhS72AA9i0SoZ8Ah.exe"C:\Users\Admin\Documents\IDyEIzQ8ZhS72AA9i0SoZ8Ah.exe"5⤵
-
C:\Users\Admin\Documents\M7SMLD0vH2epSEkQutX9TPWB.exe"C:\Users\Admin\Documents\M7SMLD0vH2epSEkQutX9TPWB.exe"5⤵
-
C:\Users\Admin\Documents\zWfayiUooxBFqddIUxA4buco.exe"C:\Users\Admin\Documents\zWfayiUooxBFqddIUxA4buco.exe"5⤵
-
C:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exe"C:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exe"5⤵
-
C:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exeC:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exe6⤵
-
C:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exeC:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exe6⤵
-
C:\Users\Admin\Documents\kRhXRpZ5SnQviPMpOeGSHEEU.exe"C:\Users\Admin\Documents\kRhXRpZ5SnQviPMpOeGSHEEU.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~2.EXE6⤵
-
C:\Users\Admin\Documents\AoiuRFXzMZ1VTBK5S_7J2caf.exe"C:\Users\Admin\Documents\AoiuRFXzMZ1VTBK5S_7J2caf.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AbtZ46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa1b1446f8,0x7ffa1b144708,0x7ffa1b1447187⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xdc,0x124,0x7ffa1b1446f8,0x7ffa1b144708,0x7ffa1b1447187⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK46⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa1b1446f8,0x7ffa1b144708,0x7ffa1b1447187⤵
-
C:\Users\Admin\Documents\dX23LOePyKmKK5tFTmO2XalK.exe"C:\Users\Admin\Documents\dX23LOePyKmKK5tFTmO2XalK.exe"5⤵
-
C:\Users\Admin\Documents\oQVzxSzEwAxkfp2wPMq8ktzR.exe"C:\Users\Admin\Documents\oQVzxSzEwAxkfp2wPMq8ktzR.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_8.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_8.exesahiba_8.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_10.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_10.exesahiba_10.exe4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_9.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_9.exesahiba_9.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_6.exesahiba_6.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_3.exesahiba_3.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 10685⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_2.exesahiba_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 5843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1796 -ip 17961⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 488 -p 3620 -ip 36201⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1244 -ip 12441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3516 -ip 35161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2680 -ip 26801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2680 -ip 26801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
110KB
MD5fe502e329a84d66bda799044590f25d3
SHA10514ceaf0fe4bb449a2ac8c58712295e3443a936
SHA2565e87ad15af3701aa5a39091280fe01799b064ef4087d9364dfd5ac6449346e03
SHA512423a20b93683977e24cf69e61c71c26abdefa126350f92991a9c67e154154bf22a22b2d082c441be1c8731fb9168d3f18ae2428d4b8953b2b6951cc7608a37b3
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
110KB
MD5fe502e329a84d66bda799044590f25d3
SHA10514ceaf0fe4bb449a2ac8c58712295e3443a936
SHA2565e87ad15af3701aa5a39091280fe01799b064ef4087d9364dfd5ac6449346e03
SHA512423a20b93683977e24cf69e61c71c26abdefa126350f92991a9c67e154154bf22a22b2d082c441be1c8731fb9168d3f18ae2428d4b8953b2b6951cc7608a37b3
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
110KB
MD5f877fb92d1f28a8644ac61fb6172a929
SHA1f121559b38f54956c937183f7c272b396faf271e
SHA2568173f4c89e3e5bbd179326d196499ecdde3beba7d138424c2e746dffe83621b1
SHA512f4080a43ecc2986ad52b3c9fc4e435e9ea2c49c0adccc8b93f4c8f82ce16657c924d7e08f432efaa6cbe347e21cd72ba8b54a1449ffa779604ab88a23814d48a
-
C:\Users\Admin\AppData\Local\Temp\2.exeFilesize
110KB
MD5f877fb92d1f28a8644ac61fb6172a929
SHA1f121559b38f54956c937183f7c272b396faf271e
SHA2568173f4c89e3e5bbd179326d196499ecdde3beba7d138424c2e746dffe83621b1
SHA512f4080a43ecc2986ad52b3c9fc4e435e9ea2c49c0adccc8b93f4c8f82ce16657c924d7e08f432efaa6cbe347e21cd72ba8b54a1449ffa779604ab88a23814d48a
-
C:\Users\Admin\AppData\Local\Temp\3.exeFilesize
110KB
MD54b6c32863af87213475d0b6182cfd387
SHA100a4e483bd89db5a36be867764efcd6871fb659f
SHA256f46cd9ffa766f1ee1f68405d607d655fe5a655e1f9b3a33716b5713d56d0a853
SHA51263810ab5ec325dcf7eb31c18899a869b33f9757937b2edff436debe72a64e687b4d9c8664eedadf75e16450676953ae6b37b43c921bb8022b879da153d3f69d0
-
C:\Users\Admin\AppData\Local\Temp\3.exeFilesize
110KB
MD54b6c32863af87213475d0b6182cfd387
SHA100a4e483bd89db5a36be867764efcd6871fb659f
SHA256f46cd9ffa766f1ee1f68405d607d655fe5a655e1f9b3a33716b5713d56d0a853
SHA51263810ab5ec325dcf7eb31c18899a869b33f9757937b2edff436debe72a64e687b4d9c8664eedadf75e16450676953ae6b37b43c921bb8022b879da153d3f69d0
-
C:\Users\Admin\AppData\Local\Temp\4.exeFilesize
110KB
MD583b06b32fe0110f9f36a960adc82f443
SHA1ef9cb14c6c15c9ea322c94bb13435dd59b7abbb5
SHA2561c0667901a1814a155d900e7eb0dbd427e2c9a469b0963fddf3b9531a6b1232f
SHA51220a6cad8c13f0377637cbaa59168c30899b15d2512a62edd3471482037ccea35d9e2b2fdb0ba3d03d93f77cb1339bc98479a46adfcbc71a8fe2d55f37b219109
-
C:\Users\Admin\AppData\Local\Temp\4.exeFilesize
110KB
MD583b06b32fe0110f9f36a960adc82f443
SHA1ef9cb14c6c15c9ea322c94bb13435dd59b7abbb5
SHA2561c0667901a1814a155d900e7eb0dbd427e2c9a469b0963fddf3b9531a6b1232f
SHA51220a6cad8c13f0377637cbaa59168c30899b15d2512a62edd3471482037ccea35d9e2b2fdb0ba3d03d93f77cb1339bc98479a46adfcbc71a8fe2d55f37b219109
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_1.exeFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_1.txtFilesize
712KB
MD56e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_10.exeFilesize
566KB
MD54957c80dd29b5528759cb5c81c212aac
SHA1bc48e8009ecd94af887e4a598566010dccd567ad
SHA2565486fc48a976f958a9d1ab48305365dc26b28df3958b1be7e1994522df44c820
SHA5125ebe35ac1d6a512f18fb8e1aff33cfb17836580ee41dacd0bc35f6c441de8d764667c1e1d1036601ae004c866c524e69b305d7e8e1cb651d1a71c23490fc2c3f
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_10.txtFilesize
566KB
MD54957c80dd29b5528759cb5c81c212aac
SHA1bc48e8009ecd94af887e4a598566010dccd567ad
SHA2565486fc48a976f958a9d1ab48305365dc26b28df3958b1be7e1994522df44c820
SHA5125ebe35ac1d6a512f18fb8e1aff33cfb17836580ee41dacd0bc35f6c441de8d764667c1e1d1036601ae004c866c524e69b305d7e8e1cb651d1a71c23490fc2c3f
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_2.exeFilesize
286KB
MD57673460dffe0cbeb8447f395ee489fde
SHA1d2e110969d8a40a069e0568020066836c66fac24
SHA256451f378c29a038c08641c24b07f478098e95b70d18310d3207e29bcf42e2a58c
SHA512cc2f5fe4723a8a6337be098e36538661e6836ac0222de82b46cc9ab5ac0410146fce60453c00ff33567aba1bbde7b4a0c31a4960eef5db8912c5be28d37295c9
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_2.txtFilesize
286KB
MD57673460dffe0cbeb8447f395ee489fde
SHA1d2e110969d8a40a069e0568020066836c66fac24
SHA256451f378c29a038c08641c24b07f478098e95b70d18310d3207e29bcf42e2a58c
SHA512cc2f5fe4723a8a6337be098e36538661e6836ac0222de82b46cc9ab5ac0410146fce60453c00ff33567aba1bbde7b4a0c31a4960eef5db8912c5be28d37295c9
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_3.exeFilesize
623KB
MD50049dc5ee3390c472e2da280b92e2c26
SHA192aaede97adc658417b021cf9ed607784b62e503
SHA2568d5ee031b3069715a6f2920d9f82ad6844fc75980d211c5359d114e2582f386a
SHA51278b9a686ca2c6e0f25209b3e962659bef7ef45b3e2f27130c7fbf6c65283a433222c48001bfea31327404aef2ace0563b3bc278a8fc4e8d8b6e55d7e9800c765
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_3.txtFilesize
623KB
MD50049dc5ee3390c472e2da280b92e2c26
SHA192aaede97adc658417b021cf9ed607784b62e503
SHA2568d5ee031b3069715a6f2920d9f82ad6844fc75980d211c5359d114e2582f386a
SHA51278b9a686ca2c6e0f25209b3e962659bef7ef45b3e2f27130c7fbf6c65283a433222c48001bfea31327404aef2ace0563b3bc278a8fc4e8d8b6e55d7e9800c765
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_4.exeFilesize
246KB
MD51979a7b0970c99aa4eeccddd32175df0
SHA1d2fab2818f94d57273b2aed09f4ae38f28da13a7
SHA2567e3dd012bdc04bd04b0a06987ecba6bad7ce3fa7db26bf7866020954eaa0fc19
SHA512a0e738ed99003c53f59439ddcd5ca6f0bd8fb4e98156f726dbed2ec59d327e4c3e6c37be9f54039fdba4c370e9b563aca4e362049cd027c32130cb20678c4182
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_4.txtFilesize
246KB
MD51979a7b0970c99aa4eeccddd32175df0
SHA1d2fab2818f94d57273b2aed09f4ae38f28da13a7
SHA2567e3dd012bdc04bd04b0a06987ecba6bad7ce3fa7db26bf7866020954eaa0fc19
SHA512a0e738ed99003c53f59439ddcd5ca6f0bd8fb4e98156f726dbed2ec59d327e4c3e6c37be9f54039fdba4c370e9b563aca4e362049cd027c32130cb20678c4182
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_5.exeFilesize
156KB
MD59c18a24236bb56e9f69ad1488f5d64ff
SHA12cf7f8ac503949da3a8e7ef5245b9cfbfb6a3498
SHA25670b71de5159cc877c54fb792ec132e2ee741ed052e7803f9ccde5b503f0be91d
SHA5129f8c53fb8b36a2098f73471b945cf434bec534b10ba5748045ad0fb6034ec71d61ca53522e9b951e26b8aedc768ac73764176da65a505f8eb8804a2b37058e38
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_5.txtFilesize
156KB
MD59c18a24236bb56e9f69ad1488f5d64ff
SHA12cf7f8ac503949da3a8e7ef5245b9cfbfb6a3498
SHA25670b71de5159cc877c54fb792ec132e2ee741ed052e7803f9ccde5b503f0be91d
SHA5129f8c53fb8b36a2098f73471b945cf434bec534b10ba5748045ad0fb6034ec71d61ca53522e9b951e26b8aedc768ac73764176da65a505f8eb8804a2b37058e38
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_6.exeFilesize
152KB
MD588505063bfe174330a0b64921ae996b2
SHA1822ee3826ec4864a3799d88c8c44e720a821ca9f
SHA256118bd4bc740ceb90ee746885aa223d084df5ea457db13a826ed426fc9bf3add8
SHA51259c8732370a884a81896eb2c8e2da1c33bb901521f61440f6496589c95e5f23c3ce8a75de4d62512e49471990dfde08d6de97923019a9290c58a5029c24525b9
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_6.txtFilesize
152KB
MD588505063bfe174330a0b64921ae996b2
SHA1822ee3826ec4864a3799d88c8c44e720a821ca9f
SHA256118bd4bc740ceb90ee746885aa223d084df5ea457db13a826ed426fc9bf3add8
SHA51259c8732370a884a81896eb2c8e2da1c33bb901521f61440f6496589c95e5f23c3ce8a75de4d62512e49471990dfde08d6de97923019a9290c58a5029c24525b9
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_7.exeFilesize
812KB
MD5f8fdccdc4cc17f6781497d69742aeb58
SHA1026edf00ad6a4f77a99a8100060184caeb9a58ba
SHA25697f751d8e067a8ff661e6f4cb0eb7cd3033abdb89d5e87e50581e011ff4f4144
SHA512ee4969810435ab43fd7fe1cfc42667544cdb9766dacca2258cc4a860983b6477a9c8c74e6e41ef6230a89fd016f8f044eb83ca5e96796a6375dacd28e7254ac1
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_7.txtFilesize
812KB
MD5f8fdccdc4cc17f6781497d69742aeb58
SHA1026edf00ad6a4f77a99a8100060184caeb9a58ba
SHA25697f751d8e067a8ff661e6f4cb0eb7cd3033abdb89d5e87e50581e011ff4f4144
SHA512ee4969810435ab43fd7fe1cfc42667544cdb9766dacca2258cc4a860983b6477a9c8c74e6e41ef6230a89fd016f8f044eb83ca5e96796a6375dacd28e7254ac1
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_8.exeFilesize
354KB
MD56b4ac0ee3d52ba9636ae9ebe431fbd3c
SHA1b2c57b93ed94801d16c996059663ee7f252b29c6
SHA2562d82a6d61b624173e1492efa0eb272cd0ba50b950c3390d5aa4f8ca4f5141dfd
SHA512c3a75c8dda2ecb1fdd11bcf398036c9e28d4504c589d8b720fa398b03bebb101c752b0ff200b6977883015583fa8653624d6debbe10457f864f43b3c40dcc89c
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_8.txtFilesize
354KB
MD56b4ac0ee3d52ba9636ae9ebe431fbd3c
SHA1b2c57b93ed94801d16c996059663ee7f252b29c6
SHA2562d82a6d61b624173e1492efa0eb272cd0ba50b950c3390d5aa4f8ca4f5141dfd
SHA512c3a75c8dda2ecb1fdd11bcf398036c9e28d4504c589d8b720fa398b03bebb101c752b0ff200b6977883015583fa8653624d6debbe10457f864f43b3c40dcc89c
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_9.exeFilesize
159KB
MD5ca379d9f27877f8cd46f40663d6310a0
SHA1b987d948282b9ac460bddb667c673a289dfd1f17
SHA2568325fd805649d3037ccf0fb384876c211a5a8f78fd43275815aaa4211c0673e8
SHA512889ce30d0c36698dbe9347b076a4ccc2411a8ff13b4f28d5a465ebcab4954d63cd282f2a097d424286ed0c58b7ead9a2a63ed876728d1a7efe5cb747ffd828f8
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\sahiba_9.txtFilesize
159KB
MD5ca379d9f27877f8cd46f40663d6310a0
SHA1b987d948282b9ac460bddb667c673a289dfd1f17
SHA2568325fd805649d3037ccf0fb384876c211a5a8f78fd43275815aaa4211c0673e8
SHA512889ce30d0c36698dbe9347b076a4ccc2411a8ff13b4f28d5a465ebcab4954d63cd282f2a097d424286ed0c58b7ead9a2a63ed876728d1a7efe5cb747ffd828f8
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\setup_install.exeFilesize
287KB
MD591bb1a6c1cf044d60a57f3cf6a3d0b17
SHA1df5d1eeaf9abc0870c9b2a0a45856211bddabf7a
SHA25613e77e12451713bfb5c3ebe71a070d6486f029b679793565d0da40b7744421a0
SHA51238cfe7e012c4f3c4641a0d156b971982bf8d04f6e861793b356483ba9497bc7275d27cb6e4ad7979133e12850c4b79d3b257c07b2a8f839a54c43b3f4709716d
-
C:\Users\Admin\AppData\Local\Temp\7zS0913B558\setup_install.exeFilesize
287KB
MD591bb1a6c1cf044d60a57f3cf6a3d0b17
SHA1df5d1eeaf9abc0870c9b2a0a45856211bddabf7a
SHA25613e77e12451713bfb5c3ebe71a070d6486f029b679793565d0da40b7744421a0
SHA51238cfe7e012c4f3c4641a0d156b971982bf8d04f6e861793b356483ba9497bc7275d27cb6e4ad7979133e12850c4b79d3b257c07b2a8f839a54c43b3f4709716d
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Users\Admin\AppData\Local\Temp\axhub.datFilesize
552KB
MD599ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
73KB
MD51c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\Documents\AoiuRFXzMZ1VTBK5S_7J2caf.exeFilesize
907KB
MD5b35d335e9261e963bca114d269140695
SHA18f2b1ead99ae43690ecd29e6f16022d53d91d280
SHA256e450f635c564bda4d1c22e0d9d4763f582c70a3806d54a3733a0bcc12edb3884
SHA512eca4c239e588103243d2ee9f6d5958a81665c48594d96446dfd91202b90c3a83dd45da0c03350f2fd5b3388ec67eb6d6217e4781ee3d9a638599cbc2842166df
-
C:\Users\Admin\Documents\AoiuRFXzMZ1VTBK5S_7J2caf.exeFilesize
907KB
MD5b35d335e9261e963bca114d269140695
SHA18f2b1ead99ae43690ecd29e6f16022d53d91d280
SHA256e450f635c564bda4d1c22e0d9d4763f582c70a3806d54a3733a0bcc12edb3884
SHA512eca4c239e588103243d2ee9f6d5958a81665c48594d96446dfd91202b90c3a83dd45da0c03350f2fd5b3388ec67eb6d6217e4781ee3d9a638599cbc2842166df
-
C:\Users\Admin\Documents\Bewl1SStti7hLe8BI9j1064h.exeFilesize
437KB
MD5dcd73ac46fc2fc613f987e3878f0d8ab
SHA1dc16d0eb04cbbcc03b8388f4dae57bfe65020b3d
SHA256f06e926da976e7eec09a05c384bb644841dd90c50828e89076356db56bff8ed6
SHA51294080a44be6229c7480970562f4c59b15d3c97acf3bb2135ff24a052a9c70442f337fa0a58bdf669443a259280d74efe149031d05a05c374a340777229461272
-
C:\Users\Admin\Documents\Bewl1SStti7hLe8BI9j1064h.exeFilesize
437KB
MD5dcd73ac46fc2fc613f987e3878f0d8ab
SHA1dc16d0eb04cbbcc03b8388f4dae57bfe65020b3d
SHA256f06e926da976e7eec09a05c384bb644841dd90c50828e89076356db56bff8ed6
SHA51294080a44be6229c7480970562f4c59b15d3c97acf3bb2135ff24a052a9c70442f337fa0a58bdf669443a259280d74efe149031d05a05c374a340777229461272
-
C:\Users\Admin\Documents\Ct5ZeQEjzK_leNBC9VpIhFv4.exeFilesize
1.7MB
MD51910c2b166ddbe21891499d9acdd8df3
SHA1b7b8268c3edb7d6f6024971173ab617f222336ef
SHA256cbbbecec4f7c97f85be78895d9bb590de0e631453ec873402d1cc97d9f61e446
SHA512a9f2b4ab78f42b9ceb222dd3effe12a4a342bbd26c2f5b745a2f399acac5794aca1a2a32e8719fdf05dd2b63f1447ac8f627197f4d4e6d05dd4d45f633737e60
-
C:\Users\Admin\Documents\Ct5ZeQEjzK_leNBC9VpIhFv4.exeFilesize
1.7MB
MD51910c2b166ddbe21891499d9acdd8df3
SHA1b7b8268c3edb7d6f6024971173ab617f222336ef
SHA256cbbbecec4f7c97f85be78895d9bb590de0e631453ec873402d1cc97d9f61e446
SHA512a9f2b4ab78f42b9ceb222dd3effe12a4a342bbd26c2f5b745a2f399acac5794aca1a2a32e8719fdf05dd2b63f1447ac8f627197f4d4e6d05dd4d45f633737e60
-
C:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exeFilesize
1.2MB
MD5c6a52c382a68643bc538132ab22c7ff5
SHA14191b9c6b01b0425514a611e9e6f2b0e7949a27b
SHA2569103fa2a21c6764da58c6a3b2884c50fc575d5fccd976b6194369275006778c5
SHA512630a387570b148a3e57b98eb068c793cef7a512ef4de343a0914b3882341c45737be9b21c8f89f6dfb69403542db660ce5903429b5f596a459b97ee88d34f6f8
-
C:\Users\Admin\Documents\E20r1ZeDV_WOPBWKx9a7az21.exeFilesize
1.2MB
MD5c6a52c382a68643bc538132ab22c7ff5
SHA14191b9c6b01b0425514a611e9e6f2b0e7949a27b
SHA2569103fa2a21c6764da58c6a3b2884c50fc575d5fccd976b6194369275006778c5
SHA512630a387570b148a3e57b98eb068c793cef7a512ef4de343a0914b3882341c45737be9b21c8f89f6dfb69403542db660ce5903429b5f596a459b97ee88d34f6f8
-
C:\Users\Admin\Documents\H65992wLOu3WGoN4ryV8F9An.exeFilesize
423KB
MD551d2bd035b62f920449b5e06b9083145
SHA1a3ea5aca5a5b08490d7d3206eabcce22e8fd12bd
SHA2569978de85e75a25a6c5e1d84a656bf96f7d295009573a4f7f6384f709fee9e4d8
SHA51232334559260ef12bd282750bb15530ea0ec01582826d6f6002588eb93f938589fca658632c23720fea975be0f1ae911812c04a60525cbc8d1d5a02ec436f3a52
-
C:\Users\Admin\Documents\H65992wLOu3WGoN4ryV8F9An.exeFilesize
423KB
MD551d2bd035b62f920449b5e06b9083145
SHA1a3ea5aca5a5b08490d7d3206eabcce22e8fd12bd
SHA2569978de85e75a25a6c5e1d84a656bf96f7d295009573a4f7f6384f709fee9e4d8
SHA51232334559260ef12bd282750bb15530ea0ec01582826d6f6002588eb93f938589fca658632c23720fea975be0f1ae911812c04a60525cbc8d1d5a02ec436f3a52
-
C:\Users\Admin\Documents\a4AM0eoSmjtut4ZFLwhmsaN3.exeFilesize
76KB
MD50fa8b5af44c7bc0a44fae529acab3233
SHA1ec7d13a9e33cf4b4ede260c58a36f685b780ba00
SHA2562e10931eaa1c392d2b410e1676e6da9e2e8adb8b959403771845f168119710de
SHA5122ac39c159cb71712e0c9367926666106288f9c0f318687c94e7efdd725ec4b5465099be1a0e2dcd236778243da24bab814463bc8653bbd4b1ebc7c0dc0497128
-
C:\Users\Admin\Documents\pDisoKZNsDRBQG5LRIUshCwd.exeFilesize
383KB
MD5071eba0ab1d12e679e9c74c9b3e3a0fa
SHA1e593a4e7e8184551bb17713c4d15fae52e32aa15
SHA256d05df8f319e17b1780f3fc7c41a368c750cd6e76f0005a1110c0a3bdef4c7eca
SHA5123ff7d79b00cb082cb20f164896c2c004cde5e23615cf781dd8db88f2f9bf827b9c4b0e83413e8aeed7c275cea00fa54504fe8414e76009f77c3de42f673903c3
-
C:\Users\Admin\Documents\pDisoKZNsDRBQG5LRIUshCwd.exeFilesize
383KB
MD5071eba0ab1d12e679e9c74c9b3e3a0fa
SHA1e593a4e7e8184551bb17713c4d15fae52e32aa15
SHA256d05df8f319e17b1780f3fc7c41a368c750cd6e76f0005a1110c0a3bdef4c7eca
SHA5123ff7d79b00cb082cb20f164896c2c004cde5e23615cf781dd8db88f2f9bf827b9c4b0e83413e8aeed7c275cea00fa54504fe8414e76009f77c3de42f673903c3
-
C:\Users\Admin\Documents\y8ig3dLKJ8QKLHJEUsSeg0Lk.exeFilesize
1.4MB
MD55bf0b18c04ea51f8f0e1e30632067e46
SHA1c469a84de747ffad7133bdaea38222d28c54f574
SHA256dab6ddccb6147c17b517862ec18fe697867c11f237ceaccf794187d71476bc4b
SHA51267b313e1a121c71d98ca0e603039bb0c2159cd5140c5f0e3e63156ebd12072b2de7c93d8886ba49dc1da7888b13f396a56fa8924e62e473f070d3d51a920eade
-
C:\Users\Admin\Documents\y8ig3dLKJ8QKLHJEUsSeg0Lk.exeFilesize
1.4MB
MD55bf0b18c04ea51f8f0e1e30632067e46
SHA1c469a84de747ffad7133bdaea38222d28c54f574
SHA256dab6ddccb6147c17b517862ec18fe697867c11f237ceaccf794187d71476bc4b
SHA51267b313e1a121c71d98ca0e603039bb0c2159cd5140c5f0e3e63156ebd12072b2de7c93d8886ba49dc1da7888b13f396a56fa8924e62e473f070d3d51a920eade
-
C:\Users\Admin\Documents\zWfayiUooxBFqddIUxA4buco.exeFilesize
2.3MB
MD52f0c92fc69cc4dcc6e084870761467d7
SHA1e7f161250a42a406a905569b9ee5fdf6c7a6e2e1
SHA256c988f8334a6bc85e29e82aab21afc3ec524a81ad0c47d1b0f68b2681f7dbb8a8
SHA51200a1817d55685e3045a645532984ca18e7d37efe26a1c021c57ed85649909c76f13c5c6334404cc2d36e502944e47e61648218f62b3b77d89c0d643a9daeb70e
-
C:\Users\Admin\Documents\zWfayiUooxBFqddIUxA4buco.exeFilesize
2.3MB
MD52f0c92fc69cc4dcc6e084870761467d7
SHA1e7f161250a42a406a905569b9ee5fdf6c7a6e2e1
SHA256c988f8334a6bc85e29e82aab21afc3ec524a81ad0c47d1b0f68b2681f7dbb8a8
SHA51200a1817d55685e3045a645532984ca18e7d37efe26a1c021c57ed85649909c76f13c5c6334404cc2d36e502944e47e61648218f62b3b77d89c0d643a9daeb70e
-
memory/540-188-0x0000000000000000-mapping.dmp
-
memory/664-281-0x0000000000000000-mapping.dmp
-
memory/968-293-0x0000000000000000-mapping.dmp
-
memory/968-316-0x0000000000320000-0x000000000059E000-memory.dmpFilesize
2.5MB
-
memory/1080-309-0x0000000000000000-mapping.dmp
-
memory/1112-187-0x0000000000000000-mapping.dmp
-
memory/1244-288-0x0000000000000000-mapping.dmp
-
memory/1244-221-0x0000000000000000-mapping.dmp
-
memory/1244-327-0x0000000000DE0000-0x0000000001423000-memory.dmpFilesize
6.3MB
-
memory/1432-179-0x0000000000000000-mapping.dmp
-
memory/1456-181-0x0000000000000000-mapping.dmp
-
memory/1732-272-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/1732-248-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/1732-240-0x0000000000F40000-0x0000000000F60000-memory.dmpFilesize
128KB
-
memory/1732-237-0x0000000000000000-mapping.dmp
-
memory/1772-279-0x0000000000000000-mapping.dmp
-
memory/1796-149-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1796-257-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1796-151-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1796-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1796-154-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1796-155-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1796-156-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1796-157-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-158-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-148-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1796-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1796-166-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-162-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-152-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1796-258-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1796-256-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1796-135-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-255-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1796-254-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-159-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1796-161-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1796-132-0x0000000000000000-mapping.dmp
-
memory/1796-163-0x00000000007A0000-0x000000000082F000-memory.dmpFilesize
572KB
-
memory/1796-165-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1796-164-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-160-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1796-167-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1972-271-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/1972-245-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/1972-233-0x0000000000000000-mapping.dmp
-
memory/1972-236-0x0000000000DE0000-0x0000000000E00000-memory.dmpFilesize
128KB
-
memory/1976-182-0x0000000000000000-mapping.dmp
-
memory/2060-341-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-318-0x0000000007D30000-0x0000000007D40000-memory.dmpFilesize
64KB
-
memory/2060-320-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-298-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-364-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-375-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-361-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-310-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-323-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-406-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-325-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-326-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-346-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-347-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-343-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-321-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-370-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-317-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2060-322-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/2220-231-0x00000000004C0000-0x00000000004C9000-memory.dmpFilesize
36KB
-
memory/2220-259-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2220-232-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2220-197-0x0000000000000000-mapping.dmp
-
memory/2220-229-0x00000000005FA000-0x000000000060B000-memory.dmpFilesize
68KB
-
memory/2256-273-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/2256-247-0x0000000000000000-mapping.dmp
-
memory/2256-260-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/2256-252-0x00000000000F0000-0x0000000000110000-memory.dmpFilesize
128KB
-
memory/2300-184-0x0000000000000000-mapping.dmp
-
memory/2412-200-0x0000000000000000-mapping.dmp
-
memory/2412-262-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/2412-212-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/2412-216-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/2444-311-0x0000000000300000-0x0000000000370000-memory.dmpFilesize
448KB
-
memory/2444-278-0x0000000000000000-mapping.dmp
-
memory/2516-292-0x0000000000000000-mapping.dmp
-
memory/2656-345-0x0000000000400000-0x0000000000ADA000-memory.dmpFilesize
6.9MB
-
memory/2656-291-0x0000000000000000-mapping.dmp
-
memory/2680-275-0x0000000000000000-mapping.dmp
-
memory/2740-183-0x0000000000000000-mapping.dmp
-
memory/2768-304-0x0000000000000000-mapping.dmp
-
memory/2768-349-0x0000000000400000-0x0000000000D6E000-memory.dmpFilesize
9.4MB
-
memory/2892-193-0x0000000000000000-mapping.dmp
-
memory/2892-268-0x0000000002080000-0x00000000020AF000-memory.dmpFilesize
188KB
-
memory/2892-223-0x00000000004EA000-0x000000000050C000-memory.dmpFilesize
136KB
-
memory/2892-250-0x0000000002530000-0x0000000002542000-memory.dmpFilesize
72KB
-
memory/2892-270-0x00000000004EA000-0x000000000050C000-memory.dmpFilesize
136KB
-
memory/2892-246-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2892-217-0x0000000002080000-0x00000000020AF000-memory.dmpFilesize
188KB
-
memory/2892-267-0x0000000005870000-0x000000000597A000-memory.dmpFilesize
1.0MB
-
memory/2892-228-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/2892-225-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/2892-261-0x0000000002690000-0x00000000026CC000-memory.dmpFilesize
240KB
-
memory/3148-329-0x00000000080A0000-0x0000000008132000-memory.dmpFilesize
584KB
-
memory/3148-274-0x0000000000000000-mapping.dmp
-
memory/3148-313-0x0000000000ED0000-0x0000000000F44000-memory.dmpFilesize
464KB
-
memory/3304-178-0x0000000000000000-mapping.dmp
-
memory/3408-186-0x0000000000000000-mapping.dmp
-
memory/3516-226-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/3516-265-0x0000000002150000-0x00000000021ED000-memory.dmpFilesize
628KB
-
memory/3516-266-0x00000000004FA000-0x000000000055E000-memory.dmpFilesize
400KB
-
memory/3516-218-0x0000000002150000-0x00000000021ED000-memory.dmpFilesize
628KB
-
memory/3516-191-0x0000000000000000-mapping.dmp
-
memory/3516-224-0x00000000004FA000-0x000000000055E000-memory.dmpFilesize
400KB
-
memory/3620-222-0x0000023E387F0000-0x0000023E3885E000-memory.dmpFilesize
440KB
-
memory/3620-204-0x0000000000000000-mapping.dmp
-
memory/3624-210-0x0000000000950000-0x0000000000980000-memory.dmpFilesize
192KB
-
memory/3624-263-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/3624-214-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/3624-195-0x0000000000000000-mapping.dmp
-
memory/3628-215-0x0000000000580000-0x0000000000612000-memory.dmpFilesize
584KB
-
memory/3628-196-0x0000000000000000-mapping.dmp
-
memory/3688-201-0x0000000000000000-mapping.dmp
-
memory/3692-190-0x0000000000000000-mapping.dmp
-
memory/3692-213-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/3692-264-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/3692-211-0x00000000001F0000-0x0000000000220000-memory.dmpFilesize
192KB
-
memory/3836-331-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3836-324-0x0000000000000000-mapping.dmp
-
memory/4092-180-0x0000000000000000-mapping.dmp
-
memory/4204-315-0x00000000009E0000-0x0000000000C56000-memory.dmpFilesize
2.5MB
-
memory/4204-290-0x0000000000000000-mapping.dmp
-
memory/4248-185-0x0000000000000000-mapping.dmp
-
memory/4368-312-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/4368-285-0x0000000000000000-mapping.dmp
-
memory/4548-284-0x0000000000000000-mapping.dmp
-
memory/4548-314-0x0000000000800000-0x0000000000934000-memory.dmpFilesize
1.2MB
-
memory/4568-282-0x0000000000000000-mapping.dmp
-
memory/4648-350-0x0000000000400000-0x0000000000AEA000-memory.dmpFilesize
6.9MB
-
memory/4648-289-0x0000000000000000-mapping.dmp
-
memory/4744-283-0x0000000000000000-mapping.dmp
-
memory/4752-244-0x0000000000F20000-0x0000000000F40000-memory.dmpFilesize
128KB
-
memory/4752-253-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/4752-241-0x0000000000000000-mapping.dmp
-
memory/4752-269-0x00007FFA19CB0000-0x00007FFA1A771000-memory.dmpFilesize
10.8MB
-
memory/4812-208-0x0000000000000000-mapping.dmp
-
memory/4928-280-0x0000000000000000-mapping.dmp
-
memory/4952-366-0x0000000000000000-mapping.dmp
-
memory/4952-374-0x0000000001FE0000-0x0000000002183000-memory.dmpFilesize
1.6MB
-
memory/5860-376-0x0000000000000000-mapping.dmp
-
memory/14524-404-0x0000000000000000-mapping.dmp
-
memory/14524-407-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/16228-381-0x0000000000000000-mapping.dmp
-
memory/20288-387-0x0000000000000000-mapping.dmp
-
memory/22284-389-0x0000000000000000-mapping.dmp
-
memory/26804-394-0x0000000000000000-mapping.dmp
-
memory/31680-401-0x0000000000000000-mapping.dmp
-
memory/36332-411-0x0000000000000000-mapping.dmp
-
memory/36332-413-0x0000000000400000-0x00000000004C8000-memory.dmpFilesize
800KB
-
memory/55108-412-0x0000000000000000-mapping.dmp
-
memory/58048-414-0x0000000000000000-mapping.dmp