Malware Analysis Report

2024-08-06 12:49

Sample ID 240627-akc4xsvdkj
Target Space Stealer Builder.exe
SHA256 ed46cc48a406b547e9f91d216933b952a5ce41d14c7566e4e0d02513ec85c0d5
Tags
asyncrat stealerium xworm default execution rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ed46cc48a406b547e9f91d216933b952a5ce41d14c7566e4e0d02513ec85c0d5

Threat Level: Known bad

The file Space Stealer Builder.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat stealerium xworm default execution rat stealer trojan

Stealerium

Detect Xworm Payload

AsyncRat

Xworm

Async RAT payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-27 00:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 00:15

Reported

2024-06-27 00:18

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

Signatures

AsyncRat

rat asyncrat

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealerium

stealer stealerium

Xworm

trojan rat xworm

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4756 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe
PID 4756 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe
PID 4756 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 4756 wrote to memory of 3664 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 4756 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe
PID 4756 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe
PID 2068 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe
PID 2068 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe
PID 2068 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 2068 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 2068 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe
PID 2068 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe
PID 888 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe
PID 888 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe
PID 888 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 888 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 888 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe
PID 888 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe
PID 3664 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3664 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2100 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 2100 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 2100 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 2100 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe
PID 2100 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe
PID 2100 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe'

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bind to shiba.exe'

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Windows\system32\chcp.com

chcp 65001

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\findstr.exe

findstr All

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

"C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe"

C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe

"C:\Users\Admin\AppData\Local\Temp\Space Stealer Builder.exe"

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 147.185.221.20:36797 tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.187.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 i.pki.goog udp
US 8.8.8.8:53 i.pki.goog udp
GB 142.250.200.3:80 i.pki.goog tcp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 phones-prevent.gl.at.ply.gg udp
US 147.185.221.20:44101 phones-prevent.gl.at.ply.gg tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 147.185.221.20:36797 phones-prevent.gl.at.ply.gg tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 147.185.221.20:36797 phones-prevent.gl.at.ply.gg tcp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp
US 147.185.221.20:44101 phones-prevent.gl.at.ply.gg tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp

Files

memory/4756-0-0x00007FF984463000-0x00007FF984465000-memory.dmp

memory/4756-1-0x0000000000E10000-0x00000000014F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Shiba Genisis Loader.exe

MD5 8406bf53e6f2457c5fffb895943b04c1
SHA1 c496e3ab44710259f5d9a5153d4471c2cfc6184f
SHA256 a55c7ed8b626f509f1db86fb6be1823a6bdf54b47c73a348cfe70c36e8b45d82
SHA512 77e81537492c79e62ef92d199f8db61b43f15d3c192472a908f798f10e480434eb14f96e850dc5d4302311bd28895fe862078e0f357ef06d5880e8e1f2d730d5

memory/4628-16-0x00000000009D0000-0x00000000009E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bind to shiba.exe

MD5 541cb6e0ccfabdb9fe99b12ce94c7da2
SHA1 d0e6fefcc25c7fabfba6b6580d39fecbc49e994d
SHA256 859136ba5066c5560dd12f299fc8d1feb19bf5056f06a59666391bd8871a65d9
SHA512 6f0ce07f67c29f5f02ea792654f1639515748468a5603465b8192cd8120a9f29bd62928bda74881c347e7f4976a304f1c399f9797dbf7918e75e052839aaee2e

memory/3664-25-0x00000000008A0000-0x00000000008B8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Space Stealer Builder.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/4628-29-0x00007FF984460000-0x00007FF984F21000-memory.dmp

memory/4756-28-0x000000001C090000-0x000000001C131000-memory.dmp

memory/3664-30-0x00007FF984460000-0x00007FF984F21000-memory.dmp

memory/2068-33-0x0000000002CB0000-0x0000000002D51000-memory.dmp

memory/888-36-0x000000001B950000-0x000000001B9F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eyk5oh4h.plv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3744-51-0x0000029CFFE50000-0x0000029CFFE72000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Shiba Genisis Loader.exe.log

MD5 fff5cbccb6b31b40f834b8f4778a779a
SHA1 899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA512 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a8e8360d573a4ff072dcc6f09d992c88
SHA1 3446774433ceaf0b400073914facab11b98b6807
SHA256 bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA512 4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

memory/3664-118-0x00007FF984460000-0x00007FF984F21000-memory.dmp

memory/4628-119-0x00007FF984460000-0x00007FF984F21000-memory.dmp

memory/4628-120-0x000000001CAA0000-0x000000001CB16000-memory.dmp

memory/4628-121-0x000000001CC20000-0x000000001D028000-memory.dmp

memory/4628-122-0x000000001B670000-0x000000001B68E000-memory.dmp

memory/3664-205-0x00007FF984460000-0x00007FF984F21000-memory.dmp

memory/4628-350-0x000000001D130000-0x000000001D2B8000-memory.dmp

memory/4628-355-0x0000000002CE0000-0x0000000002CEA000-memory.dmp

C:\Users\Admin\AppData\Local\1be0f094029f23c1b391c1aef01b0888\Admin@OAILVCNY_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

C:\Users\Admin\AppData\Local\1be0f094029f23c1b391c1aef01b0888\Admin@OAILVCNY_en-US\System\Process.txt

MD5 555c579b64094058f4fed4a1f855003d
SHA1 913ea8fc2649862ee941021c5235d35b5c708ba0
SHA256 316f14a5e4b9dbc1c28de17ccbea22244f2879cbd671c4a1c99802f313de1dc3
SHA512 3bf03fd1c49b99f406d86b864988b6f8469d2ea1cf8633b4b74e73852c77e87f8652931b62d0f9507ba61e4140d6959cb290d32d9d1241d265a878849b46b636

memory/3664-445-0x00007FF984460000-0x00007FF984F21000-memory.dmp

C:\Users\Admin\AppData\Local\1be0f094029f23c1b391c1aef01b0888\Admin@OAILVCNY_en-US\System\Process.txt

MD5 94dd6c334164e2f418f7738db4bd4976
SHA1 29fd1f7bfbe81be4897e2bf03e4d0baa193899e1
SHA256 e30773168ab72b6e8157c8255f07b4150e1080365cb6f09c88bfbb65da579fda
SHA512 576d613bb3ad0a364b0bfda944f0f2ad056dc204be07cabadbf958c4009c0895dc64554cfc5b261c884a8b8c9aecb7b094653b1921adf4f47231efdcaa1880c8

C:\Users\Admin\AppData\Local\1be0f094029f23c1b391c1aef01b0888\Admin@OAILVCNY_en-US\System\Process.txt

MD5 ca8159324cb32bdb03592f6455d1529c
SHA1 a470449f9b6d3d3e079ca182136e18a32f1a17ba
SHA256 7e68f2361a335433cf04e410726219409466181d2cbe260f72bba12946ce5b97
SHA512 0652a0a1c70ad6339461d46ec3d62416155b6c89db64b6436360c5feda7fba87ea191418f7e149991beebbd489dfb39e2497743927cb4aa7b53c145937a2f233

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 98e6b48a1e95dd661c89b897012099b3
SHA1 8430edf3d62f461e3ee818483874cf4cae6444e4
SHA256 6ca4262199e1fd9b0f51dddd19b06b439f216ca115aa7354f51f7a0385ececcb
SHA512 06b16dd5b727141598ceea26a4bd65ad61b4bba1f337741e829adf830ea85bc5d170116d88e54c65e226fef45df95ff44705330069160bd61b3bca9828e4a8d9

memory/3664-810-0x000000001B550000-0x000000001B55C000-memory.dmp

C:\Program Files\Java\jre-1.8\COPYRIGHT

MD5 e2807f5e234eb72b7a7be7fce8fb78b5
SHA1 726b8958c5b1cd6c3102124403423b2da962d2db
SHA256 cfcfaefb61dd248d4feeb39511e1f49fdbca0d93d74a3fe668d903ae3da080b8
SHA512 df79b433c59e32e28fec7bc950d6d9ee8eff202b0e4b6d543387bed4496072964ebc0994d4282126186650e82d4fa0dfccb909e02ec6a67b18eb5568c7eb64df

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 34c9024742b39cf4df18bed2d757c226
SHA1 3963de3fa4a54455265ccfd2d88f76bccb7983f8
SHA256 9efe8c971c853f02b08078fb6a113b4729328e9133cdaddcab3289c88876af72
SHA512 31ac2bc21274c0042f5013820abf170bd4c340a927f24638f8b581b13c4d04b26000fbdefbb8954ac0a704c6f7c9ee8f06ed407317eaba1b6e2762653351be50

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 a728697357ee78dacfa3de5006ec9291
SHA1 0f5ae565cb5fefa1c9202403c9739b48b0d1ddce
SHA256 8f0bfa48fe1f5d071002501ddd9a62c82588f44ad500a02a58219dc46f0f4628
SHA512 05c6db1147231fd754e737b3ab35ce2f4e5d3c900824116d1a5ff87416ee77134edc002638d33c47db4ba48f2b01ca8dca140499bc0821727ab7ea42548d7989

C:\Program Files\Java\jre-1.8\LICENSE

MD5 2728eaf2b85ed345196d71f145688cf9
SHA1 1ca521ee378e2610daf69a51ba1045edd19d2498
SHA256 e809786c6908fc1d9d0d958223df28c968012b69924f83cca1a601f2079b3499
SHA512 f296e3eab1ac596c36acc836e74a8170dac3ad493ddf209868cde19589df93a1ab731bc6faa398f897ffda10eafda9cf38723dd2ae464ddd3dc32add28d93e36