Resubmissions
06-02-2023 08:40
230206-kk236acg99 1006-02-2023 08:37
230206-kjc3mscg93 1006-02-2023 07:50
230206-jpbw4acf42 10Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 08:37
Static task
static1
Behavioral task
behavioral1
Sample
008ad6f06b42fa51f990a67d08a39cae.zip
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
008ad6f06b42fa51f990a67d08a39cae.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe
Resource
win10v2004-20221111-en
General
-
Target
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe
-
Size
3.3MB
-
MD5
008ad6f06b42fa51f990a67d08a39cae
-
SHA1
74be7d963aa3fa076e2119cebc5ee4a246069941
-
SHA256
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
-
SHA512
0c6a89a9382e46b8fe4740f0d539c2f302a0301b8fdf060efcdb989971410b958118c9b56b6946c861607210852d4a20b9a2c44ef9d500653188a4b44ca2b91d
-
SSDEEP
98304:JhZ2y+lmG4JJsHf608xmtdOVTjQwiH11XD9ml7Js1NR8:Jh0y+lmzJJY6dm7Ol9M11XD8l7Js1o
Malware Config
Extracted
nullmixer
http://watira.xyz/
Extracted
vidar
39.8
706
https://xeronxikxxx.tumblr.com/
-
profile_id
706
Extracted
redline
AniOLD
liezaphare.xyz:80
Signatures
-
Detect Fabookie payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_9.txt family_fabookie C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_9.exe family_fabookie -
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral4/memory/2316-225-0x0000000003390000-0x0000000003399000-memory.dmp family_smokeloader -
Processes:
sahiba_7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sahiba_7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" sahiba_7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection sahiba_7.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/1516-247-0x0000000000000000-mapping.dmp family_redline behavioral4/memory/1516-249-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/1516-247-0x0000000000000000-mapping.dmp family_sectoprat behavioral4/memory/1516-249-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral4/memory/4396-230-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/3060-233-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/4404-253-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/1668-257-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/4956-267-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/2112-264-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/3156-271-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral4/memory/1528-274-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft -
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral4/memory/3436-245-0x0000000000400000-0x00000000032A0000-memory.dmp family_vidar behavioral4/memory/3436-238-0x0000000004F20000-0x0000000004FBD000-memory.dmp family_vidar behavioral4/memory/3436-277-0x0000000000400000-0x00000000032A0000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurlpp.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exesetup_installer.exesahiba_1.exesahiba_7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation sahiba_1.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation sahiba_7.exe -
Executes dropped EXE 24 IoCs
Processes:
setup_installer.exesetup_install.exesahiba_1.exesahiba_2.exesahiba_7.exesahiba_4.exesahiba_3.exesahiba_5.exesahiba_6.exesahiba_8.exesahiba_9.exesahiba_8.tmpsahiba_5.tmpsahiba_1.exejfiag3g_gg.exejfiag3g_gg.exesahiba_4.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exegutjadfpid process 3744 setup_installer.exe 3504 setup_install.exe 2352 sahiba_1.exe 2316 sahiba_2.exe 2628 sahiba_7.exe 3400 sahiba_4.exe 3436 sahiba_3.exe 940 sahiba_5.exe 3216 sahiba_6.exe 3416 sahiba_8.exe 1944 sahiba_9.exe 4136 sahiba_8.tmp 3352 sahiba_5.tmp 4808 sahiba_1.exe 4396 jfiag3g_gg.exe 3060 jfiag3g_gg.exe 1516 sahiba_4.exe 4404 jfiag3g_gg.exe 1668 jfiag3g_gg.exe 2112 jfiag3g_gg.exe 4956 jfiag3g_gg.exe 3156 jfiag3g_gg.exe 1528 jfiag3g_gg.exe 4188 gutjadf -
Loads dropped DLL 8 IoCs
Processes:
setup_install.exesahiba_5.tmpsahiba_8.tmppid process 3504 setup_install.exe 3504 setup_install.exe 3504 setup_install.exe 3504 setup_install.exe 3504 setup_install.exe 3504 setup_install.exe 3352 sahiba_5.tmp 4136 sahiba_8.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral4/memory/4396-230-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral4/memory/3060-233-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/4404-253-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral4/memory/1668-257-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral4/memory/4956-267-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral4/memory/2112-264-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral4/memory/3156-271-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral4/memory/1528-274-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 ipinfo.io 14 ipinfo.io 20 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sahiba_4.exedescription pid process target process PID 3400 set thread context of 1516 3400 sahiba_4.exe sahiba_4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3604 3504 WerFault.exe setup_install.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
gutjadfsahiba_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gutjadf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gutjadf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gutjadf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sahiba_2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sahiba_2.exepid process 2316 sahiba_2.exe 2316 sahiba_2.exe 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 372 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
sahiba_2.exegutjadfpid process 2316 sahiba_2.exe 4188 gutjadf -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sahiba_6.exesahiba_4.exedescription pid process Token: SeDebugPrivilege 3216 sahiba_6.exe Token: SeDebugPrivilege 1516 sahiba_4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exesahiba_8.exesahiba_5.exedescription pid process target process PID 1420 wrote to memory of 3744 1420 dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe setup_installer.exe PID 1420 wrote to memory of 3744 1420 dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe setup_installer.exe PID 1420 wrote to memory of 3744 1420 dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe setup_installer.exe PID 3744 wrote to memory of 3504 3744 setup_installer.exe setup_install.exe PID 3744 wrote to memory of 3504 3744 setup_installer.exe setup_install.exe PID 3744 wrote to memory of 3504 3744 setup_installer.exe setup_install.exe PID 3504 wrote to memory of 4232 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4232 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4232 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4512 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4512 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4512 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 5108 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 5108 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 5108 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 2136 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 2136 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 2136 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 812 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 812 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 812 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4464 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4464 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4464 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4444 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4444 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4444 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4392 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4392 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 4392 3504 setup_install.exe cmd.exe PID 4232 wrote to memory of 2352 4232 cmd.exe sahiba_1.exe PID 4232 wrote to memory of 2352 4232 cmd.exe sahiba_1.exe PID 4232 wrote to memory of 2352 4232 cmd.exe sahiba_1.exe PID 3504 wrote to memory of 3572 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 3572 3504 setup_install.exe cmd.exe PID 3504 wrote to memory of 3572 3504 setup_install.exe cmd.exe PID 4512 wrote to memory of 2316 4512 cmd.exe sahiba_2.exe PID 4512 wrote to memory of 2316 4512 cmd.exe sahiba_2.exe PID 4512 wrote to memory of 2316 4512 cmd.exe sahiba_2.exe PID 4444 wrote to memory of 2628 4444 cmd.exe sahiba_7.exe PID 4444 wrote to memory of 2628 4444 cmd.exe sahiba_7.exe PID 4444 wrote to memory of 2628 4444 cmd.exe sahiba_7.exe PID 2136 wrote to memory of 3400 2136 cmd.exe sahiba_4.exe PID 2136 wrote to memory of 3400 2136 cmd.exe sahiba_4.exe PID 2136 wrote to memory of 3400 2136 cmd.exe sahiba_4.exe PID 5108 wrote to memory of 3436 5108 cmd.exe sahiba_3.exe PID 5108 wrote to memory of 3436 5108 cmd.exe sahiba_3.exe PID 5108 wrote to memory of 3436 5108 cmd.exe sahiba_3.exe PID 812 wrote to memory of 940 812 cmd.exe sahiba_5.exe PID 812 wrote to memory of 940 812 cmd.exe sahiba_5.exe PID 812 wrote to memory of 940 812 cmd.exe sahiba_5.exe PID 4464 wrote to memory of 3216 4464 cmd.exe sahiba_6.exe PID 4464 wrote to memory of 3216 4464 cmd.exe sahiba_6.exe PID 4392 wrote to memory of 3416 4392 cmd.exe sahiba_8.exe PID 4392 wrote to memory of 3416 4392 cmd.exe sahiba_8.exe PID 4392 wrote to memory of 3416 4392 cmd.exe sahiba_8.exe PID 3572 wrote to memory of 1944 3572 cmd.exe sahiba_9.exe PID 3572 wrote to memory of 1944 3572 cmd.exe sahiba_9.exe PID 3572 wrote to memory of 1944 3572 cmd.exe sahiba_9.exe PID 3416 wrote to memory of 4136 3416 sahiba_8.exe sahiba_8.tmp PID 3416 wrote to memory of 4136 3416 sahiba_8.exe sahiba_8.tmp PID 3416 wrote to memory of 4136 3416 sahiba_8.exe sahiba_8.tmp PID 940 wrote to memory of 3352 940 sahiba_5.exe sahiba_5.tmp PID 940 wrote to memory of 3352 940 sahiba_5.exe sahiba_5.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe"C:\Users\Admin\AppData\Local\Temp\dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_1.exesahiba_1.exe5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_2.exesahiba_2.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_3.exesahiba_3.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_4.exesahiba_4.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_4.exeC:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_4.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_5.exesahiba_5.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MBO77.tmp\sahiba_5.tmp"C:\Users\Admin\AppData\Local\Temp\is-MBO77.tmp\sahiba_5.tmp" /SL5="$900DE,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_5.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_6.exesahiba_6.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_7.exesahiba_7.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_8.exesahiba_8.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_9.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_9.exesahiba_9.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /DeleteCookiesWildcard "*.facebook.com"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 5684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3504 -ip 35041⤵
-
C:\Users\Admin\AppData\Local\Temp\is-E6158.tmp\sahiba_8.tmp"C:\Users\Admin\AppData\Local\Temp\is-E6158.tmp\sahiba_8.tmp" /SL5="$1101D4,238351,154624,C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_8.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\gutjadfC:\Users\Admin\AppData\Roaming\gutjadf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_1.exeFilesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_1.exeFilesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_1.txtFilesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_2.exeFilesize
323KB
MD5bb7409da9c80af6ca5ef4fdb40b08ed7
SHA1f415c4ab1ad47e2f14f5be85386d0f3537bebf78
SHA2566c64ee41cc2643df2f95efde9a4ab31c71bef2af1371c71931fd216e93209c2e
SHA5129b3fad8a7ead617be9b76a9b6bd6b3bb12f99362446609e5591e2609f4b13cb26271c4fce194627031be2633f274c2b95fd0fdb591ae798be4a413d7df3a7611
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_2.txtFilesize
323KB
MD5bb7409da9c80af6ca5ef4fdb40b08ed7
SHA1f415c4ab1ad47e2f14f5be85386d0f3537bebf78
SHA2566c64ee41cc2643df2f95efde9a4ab31c71bef2af1371c71931fd216e93209c2e
SHA5129b3fad8a7ead617be9b76a9b6bd6b3bb12f99362446609e5591e2609f4b13cb26271c4fce194627031be2633f274c2b95fd0fdb591ae798be4a413d7df3a7611
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_3.exeFilesize
660KB
MD54fa4a626bfe65bbb3ba048e66170556a
SHA105e0beeedc4a183056292c36cc87a9822f3a19af
SHA2567e1282097df8513b7a380803f31386373c178bb97102862d6a08816c0a8902f4
SHA5123236f3a9baf67ec60e1fef21c7c053df5f33d70b8fad9146ad45f2d9f55c9db95e468d5edabb6658a43bb11776a813f0a5448b560b7939f35a38490c2345e7cd
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_3.txtFilesize
660KB
MD54fa4a626bfe65bbb3ba048e66170556a
SHA105e0beeedc4a183056292c36cc87a9822f3a19af
SHA2567e1282097df8513b7a380803f31386373c178bb97102862d6a08816c0a8902f4
SHA5123236f3a9baf67ec60e1fef21c7c053df5f33d70b8fad9146ad45f2d9f55c9db95e468d5edabb6658a43bb11776a813f0a5448b560b7939f35a38490c2345e7cd
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_4.exeFilesize
390KB
MD5eb73f48eaf544bf7e035a58f95f73394
SHA1251f0d09f14452538ecfa0924a4618c3c16887e3
SHA256da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
SHA512a190b5e95308aa2a855dbb6c93841fbfbd79bd3c04b3f3c90e94b88c35c0409de68c39f31373b7dce38998ecdc35064541efad17f63978e14022ec9efac3b4c1
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_4.exeFilesize
390KB
MD5eb73f48eaf544bf7e035a58f95f73394
SHA1251f0d09f14452538ecfa0924a4618c3c16887e3
SHA256da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
SHA512a190b5e95308aa2a855dbb6c93841fbfbd79bd3c04b3f3c90e94b88c35c0409de68c39f31373b7dce38998ecdc35064541efad17f63978e14022ec9efac3b4c1
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_4.txtFilesize
390KB
MD5eb73f48eaf544bf7e035a58f95f73394
SHA1251f0d09f14452538ecfa0924a4618c3c16887e3
SHA256da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
SHA512a190b5e95308aa2a855dbb6c93841fbfbd79bd3c04b3f3c90e94b88c35c0409de68c39f31373b7dce38998ecdc35064541efad17f63978e14022ec9efac3b4c1
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_5.exeFilesize
749KB
MD54b300abf0da6582cde1e9ec29c214abf
SHA173ff7d346dd476d34236cbeb67268dcf0af570ac
SHA256783242dd1841ef1e7b62d7004291bfe3cd20816109dcd6932ec797aa5e6f09ff
SHA512d9c3a11830da2e39cd9b6b0e476f5a6bca7fe94d0a6300e838118bed998bde79c30f25ed758fba459d81ae06a87d9fc708eae318126c47529b23b4d17fba4587
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_5.txtFilesize
749KB
MD54b300abf0da6582cde1e9ec29c214abf
SHA173ff7d346dd476d34236cbeb67268dcf0af570ac
SHA256783242dd1841ef1e7b62d7004291bfe3cd20816109dcd6932ec797aa5e6f09ff
SHA512d9c3a11830da2e39cd9b6b0e476f5a6bca7fe94d0a6300e838118bed998bde79c30f25ed758fba459d81ae06a87d9fc708eae318126c47529b23b4d17fba4587
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_6.exeFilesize
170KB
MD5255aac71617edb0cc31709ef30fbee0a
SHA198ef84fd1e1cc4ff60a52bab85d00db7093a8f01
SHA256d0812c78e146d7774b25061dbdabae004fefc503ea363b441fa691add1eef26b
SHA5122d2ae0e917453a52ab374ae4f0b12a4ec3e16ecf3c6aff2352a3daa187f189c000adc241ea48077fb7c1fbfc36cfa6702969a70a25502cc7db5ec9ef554121bc
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_6.txtFilesize
170KB
MD5255aac71617edb0cc31709ef30fbee0a
SHA198ef84fd1e1cc4ff60a52bab85d00db7093a8f01
SHA256d0812c78e146d7774b25061dbdabae004fefc503ea363b441fa691add1eef26b
SHA5122d2ae0e917453a52ab374ae4f0b12a4ec3e16ecf3c6aff2352a3daa187f189c000adc241ea48077fb7c1fbfc36cfa6702969a70a25502cc7db5ec9ef554121bc
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_7.exeFilesize
1.2MB
MD53011f2257b899aa8196e02447383a46b
SHA1cb90ff25622aa5e5e20e257f6c6cb3ce58bd6940
SHA2564df50c6d6d188c3413bdba53851cbeea7b281b92b0d5341c021a65912395fa5b
SHA512db29dcb83a786af54720ad0a6db69949f3479c95cc940e005b803000e28d00a5dbe3d68b075215c8c4c4f804986e9c3839a3de3a93751725326e1b62ef420323
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_7.txtFilesize
1.2MB
MD53011f2257b899aa8196e02447383a46b
SHA1cb90ff25622aa5e5e20e257f6c6cb3ce58bd6940
SHA2564df50c6d6d188c3413bdba53851cbeea7b281b92b0d5341c021a65912395fa5b
SHA512db29dcb83a786af54720ad0a6db69949f3479c95cc940e005b803000e28d00a5dbe3d68b075215c8c4c4f804986e9c3839a3de3a93751725326e1b62ef420323
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_8.exeFilesize
480KB
MD5c06e890154e59a75f67e2d37295c2bc9
SHA1e6deea575d36331a0c2f8d42586442c43f5d58b8
SHA25676d4acbc47089e7b075834a63bd148062da9d01b2d9bfada50dbe2bfc500cd97
SHA5123d64c2a95e738b50e1ae8a048fac79d974118e86fbdb6fde537a891bfa9a7dbbaeeaf068d3f7432567d1bf2f93b96182a61f49a71f718847f99ee1de3649ad5c
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_8.txtFilesize
480KB
MD5c06e890154e59a75f67e2d37295c2bc9
SHA1e6deea575d36331a0c2f8d42586442c43f5d58b8
SHA25676d4acbc47089e7b075834a63bd148062da9d01b2d9bfada50dbe2bfc500cd97
SHA5123d64c2a95e738b50e1ae8a048fac79d974118e86fbdb6fde537a891bfa9a7dbbaeeaf068d3f7432567d1bf2f93b96182a61f49a71f718847f99ee1de3649ad5c
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_9.exeFilesize
983KB
MD5270dd1da0ab7f38cdff6fab84562ec7a
SHA1cf7be169ee4415085baeb4aeaa60932ac5abf4ac
SHA2567d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6
SHA512dc3d7d112a8e43c34261f3425ef6710d61cb92d797dd4a1e9b04e02971db42a4a2e2488bf5397c0ec9a6a1a6a718cec77c379377647402099cb7e4a5bb381286
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\sahiba_9.txtFilesize
983KB
MD5270dd1da0ab7f38cdff6fab84562ec7a
SHA1cf7be169ee4415085baeb4aeaa60932ac5abf4ac
SHA2567d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6
SHA512dc3d7d112a8e43c34261f3425ef6710d61cb92d797dd4a1e9b04e02971db42a4a2e2488bf5397c0ec9a6a1a6a718cec77c379377647402099cb7e4a5bb381286
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\setup_install.exeFilesize
287KB
MD53e6e91a0a2292b94b83916d430ad0db5
SHA1ccbde14c585446acbfc7b981fdae3ec4f473b3b9
SHA2564ff18dc2fe0d3a6522a7bccb363eefce100f52d9da3566a3f4954ae0cae9f2fb
SHA51274757b04a31fc52f76b8bb079323616f3f5086405a61069d4b483d046c924f379b51fdb5f3686c4beaac5665c7b7bef4efc058ef5bc8cba30fde95a77ca9b11a
-
C:\Users\Admin\AppData\Local\Temp\7zS0AE98096\setup_install.exeFilesize
287KB
MD53e6e91a0a2292b94b83916d430ad0db5
SHA1ccbde14c585446acbfc7b981fdae3ec4f473b3b9
SHA2564ff18dc2fe0d3a6522a7bccb363eefce100f52d9da3566a3f4954ae0cae9f2fb
SHA51274757b04a31fc52f76b8bb079323616f3f5086405a61069d4b483d046c924f379b51fdb5f3686c4beaac5665c7b7bef4efc058ef5bc8cba30fde95a77ca9b11a
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtFilesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtFilesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtFilesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtFilesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\is-E6158.tmp\sahiba_8.tmpFilesize
790KB
MD51623272fc3047895b1db3c60b2dd7bc5
SHA1772e1f9d062d8b98d241ae54414c814b8a6610bb
SHA25689b72c11ec6a19aeb26bc5305912b5b734e732211fe12160d3a07507a0fd99c1
SHA512135c85f2f2eba58f6f64a218f5a4e76a57d97906d50fa9877fa5b9292bc34a341dda0b72470736019e1031403be32f7505cf3f797502292fe97c29adbc8daa73
-
C:\Users\Admin\AppData\Local\Temp\is-MBO77.tmp\sahiba_5.tmpFilesize
1.0MB
MD5b6cee06d96499009bc0fddd23dc935aa
SHA1ffaef1baa4456b6e10bb40c2612dba7b18743d01
SHA2569553aee4cfe474165afa02a4f89455aaba3e27fe03bfda46ec85ec7c6f01574f
SHA512b710767c8802981495368f0b4e0dd87a4b04833b974e6b82605c92a8303b1cf5525634b3c34a1e251193c73c59579aa15704260c3898a2d49f641770b2d95b4f
-
C:\Users\Admin\AppData\Local\Temp\is-Q6QOE.tmp\idp.dllFilesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
C:\Users\Admin\AppData\Local\Temp\is-RUIOS.tmp\idp.dllFilesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
3.3MB
MD5937768008be3b71478be77f512943a75
SHA1be2c1470c46eb18c49500dd5bb07a7cabe588398
SHA256dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SHA5120cba8d244ea822578021fdac8a215bf5ed2e6c3ff2d712bb01b4e80b004b8df326ac568ab682bb3d59a15cab6ff80b137b9fa9a66fe5b05438b8b6141d4ea469
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
3.3MB
MD5937768008be3b71478be77f512943a75
SHA1be2c1470c46eb18c49500dd5bb07a7cabe588398
SHA256dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SHA5120cba8d244ea822578021fdac8a215bf5ed2e6c3ff2d712bb01b4e80b004b8df326ac568ab682bb3d59a15cab6ff80b137b9fa9a66fe5b05438b8b6141d4ea469
-
C:\Users\Admin\AppData\Roaming\gutjadfFilesize
323KB
MD5bb7409da9c80af6ca5ef4fdb40b08ed7
SHA1f415c4ab1ad47e2f14f5be85386d0f3537bebf78
SHA2566c64ee41cc2643df2f95efde9a4ab31c71bef2af1371c71931fd216e93209c2e
SHA5129b3fad8a7ead617be9b76a9b6bd6b3bb12f99362446609e5591e2609f4b13cb26271c4fce194627031be2633f274c2b95fd0fdb591ae798be4a413d7df3a7611
-
C:\Users\Admin\AppData\Roaming\gutjadfFilesize
323KB
MD5bb7409da9c80af6ca5ef4fdb40b08ed7
SHA1f415c4ab1ad47e2f14f5be85386d0f3537bebf78
SHA2566c64ee41cc2643df2f95efde9a4ab31c71bef2af1371c71931fd216e93209c2e
SHA5129b3fad8a7ead617be9b76a9b6bd6b3bb12f99362446609e5591e2609f4b13cb26271c4fce194627031be2633f274c2b95fd0fdb591ae798be4a413d7df3a7611
-
memory/812-183-0x0000000000000000-mapping.dmp
-
memory/940-201-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/940-196-0x0000000000000000-mapping.dmp
-
memory/940-242-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1516-247-0x0000000000000000-mapping.dmp
-
memory/1516-254-0x00000000059A0000-0x0000000005FB8000-memory.dmpFilesize
6.1MB
-
memory/1516-249-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1516-256-0x00000000053E0000-0x00000000053F2000-memory.dmpFilesize
72KB
-
memory/1516-258-0x0000000005440000-0x000000000547C000-memory.dmpFilesize
240KB
-
memory/1516-265-0x0000000005730000-0x000000000583A000-memory.dmpFilesize
1.0MB
-
memory/1528-272-0x0000000000000000-mapping.dmp
-
memory/1528-274-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1668-252-0x0000000000000000-mapping.dmp
-
memory/1668-257-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/1944-211-0x0000000000000000-mapping.dmp
-
memory/2112-264-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2112-261-0x0000000000000000-mapping.dmp
-
memory/2136-182-0x0000000000000000-mapping.dmp
-
memory/2316-225-0x0000000003390000-0x0000000003399000-memory.dmpFilesize
36KB
-
memory/2316-259-0x0000000000400000-0x000000000324C000-memory.dmpFilesize
46.3MB
-
memory/2316-224-0x000000000358E000-0x000000000359E000-memory.dmpFilesize
64KB
-
memory/2316-190-0x0000000000000000-mapping.dmp
-
memory/2316-234-0x0000000000400000-0x000000000324C000-memory.dmpFilesize
46.3MB
-
memory/2352-187-0x0000000000000000-mapping.dmp
-
memory/2628-191-0x0000000000000000-mapping.dmp
-
memory/3060-233-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3060-229-0x0000000000000000-mapping.dmp
-
memory/3156-271-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3156-269-0x0000000000000000-mapping.dmp
-
memory/3216-244-0x00007FFEC8C40000-0x00007FFEC9701000-memory.dmpFilesize
10.8MB
-
memory/3216-197-0x0000000000000000-mapping.dmp
-
memory/3216-207-0x0000000000160000-0x0000000000194000-memory.dmpFilesize
208KB
-
memory/3216-212-0x00007FFEC8C40000-0x00007FFEC9701000-memory.dmpFilesize
10.8MB
-
memory/3352-215-0x0000000000000000-mapping.dmp
-
memory/3400-205-0x00000000004C0000-0x0000000000528000-memory.dmpFilesize
416KB
-
memory/3400-231-0x0000000005440000-0x00000000059E4000-memory.dmpFilesize
5.6MB
-
memory/3400-210-0x0000000004CF0000-0x0000000004D66000-memory.dmpFilesize
472KB
-
memory/3400-194-0x0000000000000000-mapping.dmp
-
memory/3400-220-0x0000000004CC0000-0x0000000004CDE000-memory.dmpFilesize
120KB
-
memory/3416-208-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3416-223-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3416-203-0x0000000000000000-mapping.dmp
-
memory/3416-241-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3436-276-0x00000000033CD000-0x0000000003431000-memory.dmpFilesize
400KB
-
memory/3436-277-0x0000000000400000-0x00000000032A0000-memory.dmpFilesize
46.6MB
-
memory/3436-195-0x0000000000000000-mapping.dmp
-
memory/3436-237-0x00000000033CD000-0x0000000003431000-memory.dmpFilesize
400KB
-
memory/3436-238-0x0000000004F20000-0x0000000004FBD000-memory.dmpFilesize
628KB
-
memory/3436-245-0x0000000000400000-0x00000000032A0000-memory.dmpFilesize
46.6MB
-
memory/3504-169-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-158-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3504-239-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3504-163-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-243-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3504-235-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-159-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3504-236-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3504-164-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3504-162-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3504-149-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3504-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3504-240-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3504-156-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-161-0x0000000000720000-0x00000000007AF000-memory.dmpFilesize
572KB
-
memory/3504-165-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-160-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3504-151-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3504-152-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3504-135-0x0000000000000000-mapping.dmp
-
memory/3504-166-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-167-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-154-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3504-168-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3504-155-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3504-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3572-189-0x0000000000000000-mapping.dmp
-
memory/3744-132-0x0000000000000000-mapping.dmp
-
memory/4136-213-0x0000000000000000-mapping.dmp
-
memory/4188-280-0x000000000335D000-0x000000000336D000-memory.dmpFilesize
64KB
-
memory/4188-281-0x0000000000400000-0x000000000324C000-memory.dmpFilesize
46.3MB
-
memory/4188-282-0x0000000000400000-0x000000000324C000-memory.dmpFilesize
46.3MB
-
memory/4232-179-0x0000000000000000-mapping.dmp
-
memory/4392-186-0x0000000000000000-mapping.dmp
-
memory/4396-230-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4396-226-0x0000000000000000-mapping.dmp
-
memory/4404-248-0x0000000000000000-mapping.dmp
-
memory/4404-253-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4444-185-0x0000000000000000-mapping.dmp
-
memory/4464-184-0x0000000000000000-mapping.dmp
-
memory/4512-180-0x0000000000000000-mapping.dmp
-
memory/4808-216-0x0000000000000000-mapping.dmp
-
memory/4956-267-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/4956-263-0x0000000000000000-mapping.dmp
-
memory/5108-181-0x0000000000000000-mapping.dmp