Analysis

  • max time kernel
    58s
  • max time network
    181s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    20-06-2021 02:11

General

  • Target

    a29be9e688d14557bb2c8d1bab72071a.exe

  • Size

    3.6MB

  • MD5

    a29be9e688d14557bb2c8d1bab72071a

  • SHA1

    4f839d5d4bd6f098abe8f5bc64db2542b0e40798

  • SHA256

    885c540ea597bed7e1d4b8fd3670bc66e821368ba0df789c53a5fd2cb96ed33f

  • SHA512

    6779e16636d379032752571d1db35385b88d46d007d9fc6093ff9537e6a1fcb7ce5937a649f0f908535c1d0a295faeaa34a719503b1a346e8609b8e2da185e1e

Malware Config

Extracted

Family

redline

Botnet

NCanal01

C2

pupdatastart.tech:80

pupdatastart.xyz:80

pupdatastar.store:80

Extracted

Family

vidar

Version

39.3

Botnet

706

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

Ani

C2

yaklalau.xyz:80

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.3

Botnet

865

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    865

Extracted

Family

vidar

Version

39.3

Botnet

932

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    932

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 6 IoCs
  • ASPack v2.12-2.42 14 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Kills process with taskkill 8 IoCs
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:876
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:592
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2912
    • C:\Users\Admin\AppData\Local\Temp\a29be9e688d14557bb2c8d1bab72071a.exe
      "C:\Users\Admin\AppData\Local\Temp\a29be9e688d14557bb2c8d1bab72071a.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sonia_1.exe
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:972
          • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_1.exe
            sonia_1.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:780
            • C:\Windows\SysWOW64\rUNdlL32.eXe
              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
              5⤵
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1836
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sonia_3.exe
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1868
          • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.exe
            sonia_3.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            PID:1372
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.exe" & del C:\ProgramData\*.dll & exit
              5⤵
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2936
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im sonia_3.exe /f
                6⤵
                • Kills process with taskkill
                PID:2496
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 6
                6⤵
                • Delays execution with timeout.exe
                PID:2288
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sonia_4.exe
          3⤵
          • Loads dropped DLL
          PID:1880
          • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_4.exe
            sonia_4.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:960
            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1820
            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2684
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c sonia_9.exe
          3⤵
          • Loads dropped DLL
          PID:456
          • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.exe
            sonia_9.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1832
            • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.exe
              C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.exe
              5⤵
                PID:2332
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_8.exe
            3⤵
            • Loads dropped DLL
            PID:1972
            • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_8.exe
              sonia_8.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1148
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_7.exe
            3⤵
            • Loads dropped DLL
            PID:1640
            • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_7.exe
              sonia_7.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1776
              • C:\Users\Admin\Documents\f0WbTc7w34VkDgz2XOuHhS4J.exe
                "C:\Users\Admin\Documents\f0WbTc7w34VkDgz2XOuHhS4J.exe"
                5⤵
                • Executes dropped EXE
                PID:2440
              • C:\Users\Admin\Documents\WihTbjwrCHgWj4j86OPRmd9n.exe
                "C:\Users\Admin\Documents\WihTbjwrCHgWj4j86OPRmd9n.exe"
                5⤵
                  PID:2476
                  • C:\Users\Admin\Documents\WihTbjwrCHgWj4j86OPRmd9n.exe
                    "C:\Users\Admin\Documents\WihTbjwrCHgWj4j86OPRmd9n.exe"
                    6⤵
                      PID:2468
                  • C:\Users\Admin\Documents\Wm2VLJQRdLx8HSMqYGoj63OT.exe
                    "C:\Users\Admin\Documents\Wm2VLJQRdLx8HSMqYGoj63OT.exe"
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2600
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                      6⤵
                        PID:2396
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                          7⤵
                            PID:2316
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          6⤵
                            PID:2068
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef4514f50,0x7fef4514f60,0x7fef4514f70
                              7⤵
                                PID:2064
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1560 /prefetch:8
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2332
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 /prefetch:8
                                7⤵
                                  PID:2284
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1068 /prefetch:2
                                  7⤵
                                    PID:2012
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
                                    7⤵
                                      PID:1616
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
                                      7⤵
                                        PID:548
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
                                        7⤵
                                          PID:3120
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
                                          7⤵
                                            PID:3180
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
                                            7⤵
                                              PID:3112
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
                                              7⤵
                                                PID:3104
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,1215317258020151707,8967334406788440395,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3332 /prefetch:2
                                                7⤵
                                                  PID:3584
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "cmd.exe" /C taskkill /F /PID 2600 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Wm2VLJQRdLx8HSMqYGoj63OT.exe"
                                                6⤵
                                                  PID:2748
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /F /PID 2600
                                                    7⤵
                                                    • Kills process with taskkill
                                                    PID:684
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "cmd.exe" /C taskkill /F /PID 2600 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Wm2VLJQRdLx8HSMqYGoj63OT.exe"
                                                  6⤵
                                                    PID:2580
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /F /PID 2600
                                                      7⤵
                                                      • Kills process with taskkill
                                                      PID:1676
                                                • C:\Users\Admin\Documents\4d0vtjhPPk4MYHLkS8HYeTZT.exe
                                                  "C:\Users\Admin\Documents\4d0vtjhPPk4MYHLkS8HYeTZT.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Modifies system certificate store
                                                  PID:2628
                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:1804
                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:836
                                                • C:\Users\Admin\Documents\j8EohNldod3D9TzYMKOtHKoJ.exe
                                                  "C:\Users\Admin\Documents\j8EohNldod3D9TzYMKOtHKoJ.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  PID:2584
                                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:2808
                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                      7⤵
                                                        PID:912
                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:2800
                                                    • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                      "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                      6⤵
                                                        PID:2768
                                                      • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                        "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:2852
                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                          7⤵
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2304
                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:2924
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 292
                                                          7⤵
                                                          • Program crash
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3060
                                                    • C:\Users\Admin\Documents\ympzjDLvRl3dTX_gxuBWk5Zh.exe
                                                      "C:\Users\Admin\Documents\ympzjDLvRl3dTX_gxuBWk5Zh.exe"
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2784
                                                      • C:\Users\Admin\Documents\ympzjDLvRl3dTX_gxuBWk5Zh.exe
                                                        C:\Users\Admin\Documents\ympzjDLvRl3dTX_gxuBWk5Zh.exe
                                                        6⤵
                                                          PID:2996
                                                      • C:\Users\Admin\Documents\MU6Eh406AoiCnbY5MJKWIniF.exe
                                                        "C:\Users\Admin\Documents\MU6Eh406AoiCnbY5MJKWIniF.exe"
                                                        5⤵
                                                          PID:2740
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "MU6Eh406AoiCnbY5MJKWIniF.exe" /f & erase "C:\Users\Admin\Documents\MU6Eh406AoiCnbY5MJKWIniF.exe" & exit
                                                            6⤵
                                                            • Executes dropped EXE
                                                            PID:912
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /im "MU6Eh406AoiCnbY5MJKWIniF.exe" /f
                                                              7⤵
                                                              • Kills process with taskkill
                                                              PID:3032
                                                          • C:\Users\Admin\AppData\Local\Temp\3hcviv15.5yd\JoSetp.exe
                                                            C:\Users\Admin\AppData\Local\Temp\3hcviv15.5yd\JoSetp.exe
                                                            6⤵
                                                              PID:2024
                                                              • C:\Users\Admin\AppData\Roaming\1882099.exe
                                                                "C:\Users\Admin\AppData\Roaming\1882099.exe"
                                                                7⤵
                                                                  PID:3768
                                                                • C:\Users\Admin\AppData\Roaming\2274393.exe
                                                                  "C:\Users\Admin\AppData\Roaming\2274393.exe"
                                                                  7⤵
                                                                    PID:3836
                                                                  • C:\Users\Admin\AppData\Roaming\8939015.exe
                                                                    "C:\Users\Admin\AppData\Roaming\8939015.exe"
                                                                    7⤵
                                                                      PID:3876
                                                                    • C:\Users\Admin\AppData\Roaming\6155522.exe
                                                                      "C:\Users\Admin\AppData\Roaming\6155522.exe"
                                                                      7⤵
                                                                        PID:4004
                                                                  • C:\Users\Admin\Documents\fHS_quyS7zC6pYE7gd5WRVlD.exe
                                                                    "C:\Users\Admin\Documents\fHS_quyS7zC6pYE7gd5WRVlD.exe"
                                                                    5⤵
                                                                      PID:2260
                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                        6⤵
                                                                          PID:2936
                                                                      • C:\Users\Admin\Documents\X4bfqS4ZQ9vJp2NlN6Ln5ezr.exe
                                                                        "C:\Users\Admin\Documents\X4bfqS4ZQ9vJp2NlN6Ln5ezr.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Checks processor information in registry
                                                                        PID:2828
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im X4bfqS4ZQ9vJp2NlN6Ln5ezr.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\X4bfqS4ZQ9vJp2NlN6Ln5ezr.exe" & del C:\ProgramData\*.dll & exit
                                                                          6⤵
                                                                            PID:2080
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im X4bfqS4ZQ9vJp2NlN6Ln5ezr.exe /f
                                                                              7⤵
                                                                              • Kills process with taskkill
                                                                              PID:2580
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 6
                                                                              7⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:2356
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                                      3⤵
                                                                      • Loads dropped DLL
                                                                      PID:388
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_6.exe
                                                                        sonia_6.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Modifies system certificate store
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:828
                                                                        • C:\Users\Admin\AppData\Roaming\6136036.exe
                                                                          "C:\Users\Admin\AppData\Roaming\6136036.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Modifies system certificate store
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2168
                                                                        • C:\Users\Admin\AppData\Roaming\3212764.exe
                                                                          "C:\Users\Admin\AppData\Roaming\3212764.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Adds Run key to start application
                                                                          PID:2244
                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            PID:2416
                                                                        • C:\Users\Admin\AppData\Roaming\8263076.exe
                                                                          "C:\Users\Admin\AppData\Roaming\8263076.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Checks processor information in registry
                                                                          PID:2400
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im 8263076.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\8263076.exe" & del C:\ProgramData\*.dll & exit
                                                                            6⤵
                                                                              PID:3012
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /im 8263076.exe /f
                                                                                7⤵
                                                                                • Kills process with taskkill
                                                                                PID:2728
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout /t 6
                                                                                7⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:2320
                                                                          • C:\Users\Admin\AppData\Roaming\6177225.exe
                                                                            "C:\Users\Admin\AppData\Roaming\6177225.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            PID:2528
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sonia_5.exe
                                                                        3⤵
                                                                        • Loads dropped DLL
                                                                        PID:1060
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c sonia_2.exe
                                                                        3⤵
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:568
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_5.exe
                                                                    sonia_5.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    PID:1600
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-Q8FGE.tmp\sonia_5.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-Q8FGE.tmp\sonia_5.tmp" /SL5="$5012C,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_5.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:1688
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-EGH5N.tmp\____(768çshjs).exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-EGH5N.tmp\____(768çshjs).exe" /S /UID=burnerch1
                                                                        3⤵
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        PID:2232
                                                                        • C:\Program Files\Windows Journal\AIJTYTGEDR\ultramediaburner.exe
                                                                          "C:\Program Files\Windows Journal\AIJTYTGEDR\ultramediaburner.exe" /VERYSILENT
                                                                          4⤵
                                                                            PID:2620
                                                                            • C:\Users\Admin\AppData\Local\Temp\is-OGK1Q.tmp\ultramediaburner.tmp
                                                                              "C:\Users\Admin\AppData\Local\Temp\is-OGK1Q.tmp\ultramediaburner.tmp" /SL5="$60172,281924,62464,C:\Program Files\Windows Journal\AIJTYTGEDR\ultramediaburner.exe" /VERYSILENT
                                                                              5⤵
                                                                                PID:1624
                                                                                • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2768
                                                                            • C:\Users\Admin\AppData\Local\Temp\0a-ae4f0-7b4-3f191-b79c9d754b667\Metiqaefaecy.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\0a-ae4f0-7b4-3f191-b79c9d754b667\Metiqaefaecy.exe"
                                                                              4⤵
                                                                                PID:2944
                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                  5⤵
                                                                                    PID:2176
                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
                                                                                      6⤵
                                                                                        PID:1156
                                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:734224 /prefetch:2
                                                                                        6⤵
                                                                                          PID:3816
                                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:2110472 /prefetch:2
                                                                                          6⤵
                                                                                            PID:2484
                                                                                      • C:\Users\Admin\AppData\Local\Temp\08-af6a9-4c9-0878f-2ea3ba9219d16\Pyshaesysobu.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\08-af6a9-4c9-0878f-2ea3ba9219d16\Pyshaesysobu.exe"
                                                                                        4⤵
                                                                                          PID:1592
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bgsigf3m.of2\001.exe & exit
                                                                                            5⤵
                                                                                              PID:2668
                                                                                              • C:\Users\Admin\AppData\Local\Temp\bgsigf3m.of2\001.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\bgsigf3m.of2\001.exe
                                                                                                6⤵
                                                                                                  PID:1916
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z43d4dap.rlt\ebook.exe & exit
                                                                                                5⤵
                                                                                                  PID:2108
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\z43d4dap.rlt\ebook.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\z43d4dap.rlt\ebook.exe
                                                                                                    6⤵
                                                                                                      PID:3012
                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\z43d4dap.rlt\EBOOKE~1.TMP,S C:\Users\Admin\AppData\Local\Temp\z43d4dap.rlt\ebook.exe
                                                                                                        7⤵
                                                                                                          PID:3676
                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                            C:\Windows\system32\rundll32.exe C:\PROGRA~3\LAUVHF~1\JHAKLD~1.TMP,UTkYcTJEWVk= C:\Users\Admin\AppData\Local\Temp\z43d4dap.rlt\EBOOKE~1.TMP
                                                                                                            8⤵
                                                                                                              PID:3704
                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 29733
                                                                                                                9⤵
                                                                                                                  PID:4264
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5l5ffssl.llk\GcleanerEU.exe /eufive & exit
                                                                                                          5⤵
                                                                                                            PID:1500
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v50a5me2.5bs\md1_1eaf.exe & exit
                                                                                                            5⤵
                                                                                                              PID:2772
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\v50a5me2.5bs\md1_1eaf.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\v50a5me2.5bs\md1_1eaf.exe
                                                                                                                6⤵
                                                                                                                  PID:2204
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 276
                                                                                                                    7⤵
                                                                                                                    • Program crash
                                                                                                                    PID:2880
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wu3pf21w.vou\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                5⤵
                                                                                                                • Blocklisted process makes network request
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2996
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3hcviv15.5yd\JoSetp.exe & exit
                                                                                                                5⤵
                                                                                                                  PID:2740
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\buvg1y31.05m\gaoou.exe & exit
                                                                                                                  5⤵
                                                                                                                    PID:3320
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\buvg1y31.05m\gaoou.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\buvg1y31.05m\gaoou.exe
                                                                                                                      6⤵
                                                                                                                        PID:3464
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                          7⤵
                                                                                                                            PID:3664
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                            7⤵
                                                                                                                              PID:864
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\12ikb3pg.agb\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                          5⤵
                                                                                                                            PID:3688
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\12ikb3pg.agb\Setup3310.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\12ikb3pg.agb\Setup3310.exe /Verysilent /subid=623
                                                                                                                              6⤵
                                                                                                                                PID:3748
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-GPN54.tmp\Setup3310.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-GPN54.tmp\Setup3310.tmp" /SL5="$502DE,138429,56832,C:\Users\Admin\AppData\Local\Temp\12ikb3pg.agb\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                  7⤵
                                                                                                                                    PID:3808
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-N4UUP.tmp\Setup.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-N4UUP.tmp\Setup.exe" /Verysilent
                                                                                                                                      8⤵
                                                                                                                                        PID:3644
                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                          9⤵
                                                                                                                                            PID:3552
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                              10⤵
                                                                                                                                                PID:1284
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                10⤵
                                                                                                                                                  PID:3520
                                                                                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                9⤵
                                                                                                                                                  PID:3568
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                    10⤵
                                                                                                                                                      PID:3256
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill /im RunWW.exe /f
                                                                                                                                                        11⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:3176
                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                        timeout /t 6
                                                                                                                                                        11⤵
                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                        PID:3780
                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                    9⤵
                                                                                                                                                      PID:2012
                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                        10⤵
                                                                                                                                                          PID:2904
                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                        9⤵
                                                                                                                                                          PID:3760
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-RSJ10.tmp\lylal220.tmp
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-RSJ10.tmp\lylal220.tmp" /SL5="$1040C,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                            10⤵
                                                                                                                                                              PID:3828
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-LIS7G.tmp\56FT____________________.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-LIS7G.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:3712
                                                                                                                                                                  • C:\Program Files\Windows Journal\IFHRXCELLM\irecord.exe
                                                                                                                                                                    "C:\Program Files\Windows Journal\IFHRXCELLM\irecord.exe" /VERYSILENT
                                                                                                                                                                    12⤵
                                                                                                                                                                      PID:2136
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-3LG64.tmp\irecord.tmp
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-3LG64.tmp\irecord.tmp" /SL5="$30408,6139911,56832,C:\Program Files\Windows Journal\IFHRXCELLM\irecord.exe" /VERYSILENT
                                                                                                                                                                        13⤵
                                                                                                                                                                          PID:2756
                                                                                                                                                                          • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                                            "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                            14⤵
                                                                                                                                                                              PID:3536
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6a-f1c98-23d-a4993-3eea066cd31d1\Jaexisaetija.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6a-f1c98-23d-a4993-3eea066cd31d1\Jaexisaetija.exe"
                                                                                                                                                                          12⤵
                                                                                                                                                                            PID:2284
                                                                                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                              13⤵
                                                                                                                                                                                PID:3148
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\cf-cda28-b62-02385-a886fb1bbdb40\Rolepulapa.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\cf-cda28-b62-02385-a886fb1bbdb40\Rolepulapa.exe"
                                                                                                                                                                              12⤵
                                                                                                                                                                                PID:752
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cl0utsll.p1p\001.exe & exit
                                                                                                                                                                                  13⤵
                                                                                                                                                                                    PID:3636
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cl0utsll.p1p\001.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\cl0utsll.p1p\001.exe
                                                                                                                                                                                      14⤵
                                                                                                                                                                                        PID:3596
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kinaoo0o.ggt\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                      13⤵
                                                                                                                                                                                        PID:3676
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vyj2u4k3.pkq\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                        13⤵
                                                                                                                                                                                          PID:2296
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\odzrhz0n.bt2\gaoou.exe & exit
                                                                                                                                                                                          13⤵
                                                                                                                                                                                            PID:3284
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\odzrhz0n.bt2\gaoou.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\odzrhz0n.bt2\gaoou.exe
                                                                                                                                                                                              14⤵
                                                                                                                                                                                                PID:1716
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                    PID:2996
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                      PID:4524
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nucr5inv.tkv\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nucr5inv.tkv\Setup3310.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\nucr5inv.tkv\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                        PID:3996
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-P6K6E.tmp\Setup3310.tmp
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-P6K6E.tmp\Setup3310.tmp" /SL5="$40568,138429,56832,C:\Users\Admin\AppData\Local\Temp\nucr5inv.tkv\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                            PID:3908
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\folf2vvt.f1u\google-game.exe & exit
                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\folf2vvt.f1u\google-game.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\folf2vvt.f1u\google-game.exe
                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                              PID:4092
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ts4on2v4.uzw\005.exe & exit
                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                PID:2096
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ts4on2v4.uzw\005.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ts4on2v4.uzw\005.exe
                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                            PID:3972
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-CUELB.tmp\LabPicV3.tmp
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-CUELB.tmp\LabPicV3.tmp" /SL5="$203BC,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-K5IF7.tmp\_____________.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-K5IF7.tmp\_____________.exe" /S /UID=lab214
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\YLKCVOWWXM\prolab.exe
                                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\YLKCVOWWXM\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-K0JHL.tmp\prolab.tmp
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-K0JHL.tmp\prolab.tmp" /SL5="$403EA,575243,216576,C:\Program Files\Mozilla Firefox\YLKCVOWWXM\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                            PID:2064
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\f0-f56f2-86d-ad882-8dcf6316e0790\Cerajitexi.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\f0-f56f2-86d-ad882-8dcf6316e0790\Cerajitexi.exe"
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                                              "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                PID:4048
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\91-cce0e-2c5-184bb-4a5d387884f24\Fesesaleshe.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\91-cce0e-2c5-184bb-4a5d387884f24\Fesesaleshe.exe"
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                PID:1916
                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yrb1isxn.lwu\001.exe & exit
                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                    PID:3812
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\yrb1isxn.lwu\001.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\yrb1isxn.lwu\001.exe
                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                        PID:3184
                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hv3ff4l4.ykt\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                        PID:1612
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uzdwkydq.zco\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                          PID:2224
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rb4woix3.tpb\gaoou.exe & exit
                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                            PID:3584
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\rb4woix3.tpb\gaoou.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\rb4woix3.tpb\gaoou.exe
                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                    PID:3496
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                      PID:3924
                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\upwssrom.agq\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                    PID:2104
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\upwssrom.agq\Setup3310.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\upwssrom.agq\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                        PID:3096
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-MDNKI.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-MDNKI.tmp\Setup3310.tmp" /SL5="$104FC,138429,56832,C:\Users\Admin\AppData\Local\Temp\upwssrom.agq\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-0RQV7.tmp\Setup.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-0RQV7.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                PID:2236
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zeowmaow.nzk\google-game.exe & exit
                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\zeowmaow.nzk\google-game.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\zeowmaow.nzk\google-game.exe
                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                PID:3500
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pmeyd0jq.tft\005.exe & exit
                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pmeyd0jq.tft\005.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\pmeyd0jq.tft\005.exe
                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nkkb2pj0.uru\google-game.exe & exit
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:4040
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nkkb2pj0.uru\google-game.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\nkkb2pj0.uru\google-game.exe
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:976
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ovgu3cbm.m04\askinstall46.exe & exit
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ovgu3cbm.m04\askinstall46.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\ovgu3cbm.m04\askinstall46.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:1116
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:3512
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hnrozdwl.s2p\app.exe & exit
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:4020
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hnrozdwl.s2p\app.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hnrozdwl.s2p\app.exe
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hnrozdwl.s2p\app.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\hnrozdwl.s2p\app.exe"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:3172
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xsbkwodq.lei\005.exe & exit
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:2288
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\xsbkwodq.lei\005.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\xsbkwodq.lei\005.exe
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:3664
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c3aujzdw.b35\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:3640
                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4qcxcmdx.4g2\toolspab1.exe & exit
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:3984
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4qcxcmdx.4g2\toolspab1.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\4qcxcmdx.4g2\toolspab1.exe
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:3440
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4qcxcmdx.4g2\toolspab1.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\4qcxcmdx.4g2\toolspab1.exe
                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\trzxw0it.nrh\3o.exe & exit
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\trzxw0it.nrh\3o.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\trzxw0it.nrh\3o.exe
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1ilipf5w.tnw\app.exe /8-2222 & exit
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:2356
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1ilipf5w.tnw\app.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1ilipf5w.tnw\app.exe /8-2222
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_2.exe
                                                                                                                                                                                                                                                                                sonia_2.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                PID:1760
                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "1946636251-8321326646378614101944478729-187095775415340575411849664033-31223408"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "1307782075-482326116-1383866660423995946-86010738848194962514313859781674489715"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:2260

                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                              Modify Existing Service

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1031

                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1060

                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                              Disabling Security Tools

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1089

                                                                                                                                                                                                                                                                              Install Root Certificate

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1130

                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                              Credentials in Files

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1081

                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1102

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\libcurl.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\libcurlpp.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\libstdc++-6.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\libwinpthread-1.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_1.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                cd2432b2a7980238b57791ae06cf6f65

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4e7d16dcdafe324d095127cbeafdefe241d47bad

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                fd0b85544e8dd7e550ae5fcce101140c9c1c101fefeee2551c4be72c2fe6f9b31865a5900d3d3026b62b12c51f3dda46bc848083dbd23445e9e1890d2638d556

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_1.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                cd2432b2a7980238b57791ae06cf6f65

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4e7d16dcdafe324d095127cbeafdefe241d47bad

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                fd0b85544e8dd7e550ae5fcce101140c9c1c101fefeee2551c4be72c2fe6f9b31865a5900d3d3026b62b12c51f3dda46bc848083dbd23445e9e1890d2638d556

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_2.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_2.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_4.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                509aa5db8abd44cec60705aebb88e354

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                557beb26da0a0dcafa6528557038f2887639e2b2

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f2925c78059a0fe7a48910d2179182bf7a72196d61141379a689e2d3931d9105

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ec7351801119cd3bc1c9ee579cba5e0f99ba560d2747b672a2c487808668116dd0db4db656b36e92867805f140ffb4f9c85b6243c63d7e861a3c9ab54843368e

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_4.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                509aa5db8abd44cec60705aebb88e354

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                557beb26da0a0dcafa6528557038f2887639e2b2

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f2925c78059a0fe7a48910d2179182bf7a72196d61141379a689e2d3931d9105

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ec7351801119cd3bc1c9ee579cba5e0f99ba560d2747b672a2c487808668116dd0db4db656b36e92867805f140ffb4f9c85b6243c63d7e861a3c9ab54843368e

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_5.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3630ff5c281859f4f95aa0516a33f24a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                32943c4bf92b7b763736af2bf360e91de1f9ef77

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2f1f85c6ea774f0337c5028d557489eb48bf82783c891dec229270e6fcc8d496

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f5a1268d78faa349ddf054fb8cfcf39344065b828181191431ea0bb7d82216a85fab96db902940ec574d992b75b954978fcad96d36d585e6df27623c6320e640

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_5.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3630ff5c281859f4f95aa0516a33f24a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                32943c4bf92b7b763736af2bf360e91de1f9ef77

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2f1f85c6ea774f0337c5028d557489eb48bf82783c891dec229270e6fcc8d496

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f5a1268d78faa349ddf054fb8cfcf39344065b828181191431ea0bb7d82216a85fab96db902940ec574d992b75b954978fcad96d36d585e6df27623c6320e640

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_6.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                441b8c0783a61a25e127d7cc74085142

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b2d69cc4296e9b3467daaaec95e89bd3d2c80585

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                5b5e12e0f70e6809381c55ff68322708e9e97d2f97f5aa566241247bcf048091

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                379c45c95f1e16590bc284cab84df034290e49000260c0a5a9889c07e338393d2edf4eaf6f9e1a48e8083bdd37a144eac10b8c1a3607f7b9ddb6e384cd238fc7

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_6.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                441b8c0783a61a25e127d7cc74085142

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b2d69cc4296e9b3467daaaec95e89bd3d2c80585

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                5b5e12e0f70e6809381c55ff68322708e9e97d2f97f5aa566241247bcf048091

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                379c45c95f1e16590bc284cab84df034290e49000260c0a5a9889c07e338393d2edf4eaf6f9e1a48e8083bdd37a144eac10b8c1a3607f7b9ddb6e384cd238fc7

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_7.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                2a8da3478be390b9ce722f4994357c96

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7a6bc0a303854cc864de5612a36d177d6dba3123

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1241e0e6e0bff794a184838286ab10089b567832ba1433a9c37984ba6ad97e12

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                93b0e33b6124cb05264b5bb7e689388deb352f0dca244ea812f8d317e1b52832b1a7305276109b29e45383f7e5d298f2734cc2f1063e1aec250b57d738be15b3

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_7.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                2a8da3478be390b9ce722f4994357c96

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7a6bc0a303854cc864de5612a36d177d6dba3123

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1241e0e6e0bff794a184838286ab10089b567832ba1433a9c37984ba6ad97e12

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                93b0e33b6124cb05264b5bb7e689388deb352f0dca244ea812f8d317e1b52832b1a7305276109b29e45383f7e5d298f2734cc2f1063e1aec250b57d738be15b3

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_8.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_8.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.txt
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\libcurl.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\libcurlpp.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\libstdc++-6.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\libwinpthread-1.dll
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\setup_install.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_1.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                cd2432b2a7980238b57791ae06cf6f65

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4e7d16dcdafe324d095127cbeafdefe241d47bad

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                fd0b85544e8dd7e550ae5fcce101140c9c1c101fefeee2551c4be72c2fe6f9b31865a5900d3d3026b62b12c51f3dda46bc848083dbd23445e9e1890d2638d556

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_1.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                cd2432b2a7980238b57791ae06cf6f65

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4e7d16dcdafe324d095127cbeafdefe241d47bad

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                fd0b85544e8dd7e550ae5fcce101140c9c1c101fefeee2551c4be72c2fe6f9b31865a5900d3d3026b62b12c51f3dda46bc848083dbd23445e9e1890d2638d556

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_1.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                cd2432b2a7980238b57791ae06cf6f65

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4e7d16dcdafe324d095127cbeafdefe241d47bad

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                fd0b85544e8dd7e550ae5fcce101140c9c1c101fefeee2551c4be72c2fe6f9b31865a5900d3d3026b62b12c51f3dda46bc848083dbd23445e9e1890d2638d556

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_2.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_2.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_2.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_2.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_3.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_4.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                509aa5db8abd44cec60705aebb88e354

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                557beb26da0a0dcafa6528557038f2887639e2b2

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f2925c78059a0fe7a48910d2179182bf7a72196d61141379a689e2d3931d9105

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ec7351801119cd3bc1c9ee579cba5e0f99ba560d2747b672a2c487808668116dd0db4db656b36e92867805f140ffb4f9c85b6243c63d7e861a3c9ab54843368e

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_4.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                509aa5db8abd44cec60705aebb88e354

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                557beb26da0a0dcafa6528557038f2887639e2b2

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f2925c78059a0fe7a48910d2179182bf7a72196d61141379a689e2d3931d9105

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ec7351801119cd3bc1c9ee579cba5e0f99ba560d2747b672a2c487808668116dd0db4db656b36e92867805f140ffb4f9c85b6243c63d7e861a3c9ab54843368e

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_4.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                509aa5db8abd44cec60705aebb88e354

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                557beb26da0a0dcafa6528557038f2887639e2b2

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f2925c78059a0fe7a48910d2179182bf7a72196d61141379a689e2d3931d9105

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ec7351801119cd3bc1c9ee579cba5e0f99ba560d2747b672a2c487808668116dd0db4db656b36e92867805f140ffb4f9c85b6243c63d7e861a3c9ab54843368e

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_5.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3630ff5c281859f4f95aa0516a33f24a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                32943c4bf92b7b763736af2bf360e91de1f9ef77

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2f1f85c6ea774f0337c5028d557489eb48bf82783c891dec229270e6fcc8d496

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f5a1268d78faa349ddf054fb8cfcf39344065b828181191431ea0bb7d82216a85fab96db902940ec574d992b75b954978fcad96d36d585e6df27623c6320e640

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_5.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3630ff5c281859f4f95aa0516a33f24a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                32943c4bf92b7b763736af2bf360e91de1f9ef77

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2f1f85c6ea774f0337c5028d557489eb48bf82783c891dec229270e6fcc8d496

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f5a1268d78faa349ddf054fb8cfcf39344065b828181191431ea0bb7d82216a85fab96db902940ec574d992b75b954978fcad96d36d585e6df27623c6320e640

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_5.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3630ff5c281859f4f95aa0516a33f24a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                32943c4bf92b7b763736af2bf360e91de1f9ef77

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                2f1f85c6ea774f0337c5028d557489eb48bf82783c891dec229270e6fcc8d496

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f5a1268d78faa349ddf054fb8cfcf39344065b828181191431ea0bb7d82216a85fab96db902940ec574d992b75b954978fcad96d36d585e6df27623c6320e640

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_6.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                441b8c0783a61a25e127d7cc74085142

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b2d69cc4296e9b3467daaaec95e89bd3d2c80585

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                5b5e12e0f70e6809381c55ff68322708e9e97d2f97f5aa566241247bcf048091

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                379c45c95f1e16590bc284cab84df034290e49000260c0a5a9889c07e338393d2edf4eaf6f9e1a48e8083bdd37a144eac10b8c1a3607f7b9ddb6e384cd238fc7

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_7.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                2a8da3478be390b9ce722f4994357c96

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7a6bc0a303854cc864de5612a36d177d6dba3123

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1241e0e6e0bff794a184838286ab10089b567832ba1433a9c37984ba6ad97e12

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                93b0e33b6124cb05264b5bb7e689388deb352f0dca244ea812f8d317e1b52832b1a7305276109b29e45383f7e5d298f2734cc2f1063e1aec250b57d738be15b3

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_7.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                2a8da3478be390b9ce722f4994357c96

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7a6bc0a303854cc864de5612a36d177d6dba3123

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1241e0e6e0bff794a184838286ab10089b567832ba1433a9c37984ba6ad97e12

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                93b0e33b6124cb05264b5bb7e689388deb352f0dca244ea812f8d317e1b52832b1a7305276109b29e45383f7e5d298f2734cc2f1063e1aec250b57d738be15b3

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_7.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                2a8da3478be390b9ce722f4994357c96

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                7a6bc0a303854cc864de5612a36d177d6dba3123

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1241e0e6e0bff794a184838286ab10089b567832ba1433a9c37984ba6ad97e12

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                93b0e33b6124cb05264b5bb7e689388deb352f0dca244ea812f8d317e1b52832b1a7305276109b29e45383f7e5d298f2734cc2f1063e1aec250b57d738be15b3

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_8.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_8.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_8.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_8.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zSC0472B94\sonia_9.exe
                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                              • memory/388-107-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/456-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/568-94-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/592-189-0x00000000FF3D246C-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/592-192-0x00000000004E0000-0x0000000000551000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                              • memory/780-104-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/828-181-0x0000000000A40000-0x0000000000A5D000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                116KB

                                                                                                                                                                                                                                                                              • memory/828-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/828-183-0x00000000003F0000-0x00000000003F1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/828-185-0x000000001ACB0000-0x000000001ACB2000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/828-179-0x00000000003E0000-0x00000000003E1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/828-167-0x0000000000B20000-0x0000000000B21000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/836-294-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/876-299-0x00000000014E0000-0x0000000001551000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                              • memory/876-190-0x0000000001760000-0x00000000017D1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                              • memory/876-279-0x0000000001980000-0x00000000019F0000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                              • memory/876-298-0x0000000000E30000-0x0000000000E7C000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                              • memory/876-277-0x00000000009E0000-0x0000000000A2B000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                              • memory/876-188-0x0000000000840000-0x000000000088B000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                              • memory/912-305-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/912-280-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/960-112-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/972-93-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1036-59-0x0000000075721000-0x0000000075723000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/1060-99-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1148-202-0x0000000004EB2000-0x0000000004EB3000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/1148-196-0x0000000002270000-0x000000000228B000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                108KB

                                                                                                                                                                                                                                                                              • memory/1148-198-0x0000000000240000-0x000000000026F000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                188KB

                                                                                                                                                                                                                                                                              • memory/1148-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1148-199-0x0000000000400000-0x00000000008FE000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.0MB

                                                                                                                                                                                                                                                                              • memory/1148-200-0x0000000004EB1000-0x0000000004EB2000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/1148-210-0x0000000004EB4000-0x0000000004EB6000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/1148-201-0x00000000025A0000-0x00000000025B9000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                              • memory/1148-203-0x0000000004EB3000-0x0000000004EB4000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/1208-251-0x0000000003A90000-0x0000000003AA6000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                              • memory/1208-289-0x0000000003B20000-0x0000000003B37000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                92KB

                                                                                                                                                                                                                                                                              • memory/1372-228-0x0000000000400000-0x000000000093E000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                                                                              • memory/1372-111-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1372-221-0x0000000000E30000-0x0000000000EC7000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                604KB

                                                                                                                                                                                                                                                                              • memory/1444-133-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                572KB

                                                                                                                                                                                                                                                                              • memory/1444-63-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1444-135-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                152KB

                                                                                                                                                                                                                                                                              • memory/1444-82-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                152KB

                                                                                                                                                                                                                                                                              • memory/1444-136-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                              • memory/1444-123-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                              • memory/1444-80-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                572KB

                                                                                                                                                                                                                                                                              • memory/1444-131-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                              • memory/1444-83-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                              • memory/1444-129-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                              • memory/1444-118-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                              • memory/1444-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                                                              • memory/1444-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                                                              • memory/1592-314-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1600-166-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                              • memory/1600-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1624-311-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1640-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1688-184-0x00000000001F0000-0x00000000001F1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/1688-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1760-102-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1760-223-0x00000000001D0000-0x00000000001D9000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                              • memory/1760-225-0x0000000000400000-0x00000000008E5000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4.9MB

                                                                                                                                                                                                                                                                              • memory/1776-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1804-268-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1820-193-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1832-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1832-209-0x0000000000840000-0x0000000000841000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/1832-195-0x00000000013B0000-0x00000000013B1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/1836-186-0x0000000000CE0000-0x0000000000DE1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                              • memory/1836-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1836-187-0x0000000000590000-0x00000000005EC000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                368KB

                                                                                                                                                                                                                                                                              • memory/1868-96-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1880-97-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/1972-125-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2168-208-0x00000000009F0000-0x00000000009F1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2168-206-0x0000000000300000-0x0000000000301000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2168-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2168-216-0x0000000000320000-0x0000000000348000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                160KB

                                                                                                                                                                                                                                                                              • memory/2232-220-0x0000000000540000-0x0000000000542000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/2232-211-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2244-214-0x00000000009E0000-0x00000000009E1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2244-219-0x0000000000970000-0x0000000000971000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2244-217-0x0000000000490000-0x0000000000491000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2244-218-0x0000000000960000-0x000000000096E000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                56KB

                                                                                                                                                                                                                                                                              • memory/2244-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2260-278-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2288-313-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2304-271-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2304-273-0x0000000000BB0000-0x0000000000CB1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                              • memory/2304-275-0x0000000000920000-0x000000000097C000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                368KB

                                                                                                                                                                                                                                                                              • memory/2316-303-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2332-249-0x0000000000417DBE-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2332-246-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                              • memory/2332-260-0x00000000050F0000-0x00000000050F1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2332-253-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                              • memory/2396-302-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2400-286-0x0000000000400000-0x000000000093E000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                                                                              • memory/2400-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2400-285-0x0000000000B90000-0x0000000000C27000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                604KB

                                                                                                                                                                                                                                                                              • memory/2416-248-0x00000000048E0000-0x00000000048E1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2416-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2416-229-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2468-272-0x0000000000402F68-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2468-274-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                              • memory/2476-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2476-276-0x0000000000240000-0x000000000024C000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                              • memory/2496-309-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2528-236-0x0000000001230000-0x0000000001231000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2528-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2528-245-0x0000000000230000-0x0000000000231000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2584-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2600-290-0x0000000005041000-0x0000000005042000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2600-295-0x0000000005044000-0x0000000005046000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                              • memory/2600-288-0x0000000000400000-0x000000000095D000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.4MB

                                                                                                                                                                                                                                                                              • memory/2600-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2600-293-0x0000000005043000-0x0000000005044000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2600-291-0x0000000005042000-0x0000000005043000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2600-287-0x0000000002310000-0x000000000239E000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                568KB

                                                                                                                                                                                                                                                                              • memory/2620-310-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2628-244-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2684-284-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2740-252-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2740-301-0x0000000000400000-0x00000000008F7000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.0MB

                                                                                                                                                                                                                                                                              • memory/2740-300-0x0000000000240000-0x000000000026F000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                188KB

                                                                                                                                                                                                                                                                              • memory/2768-256-0x0000000000200000-0x0000000000210000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                              • memory/2768-261-0x00000000002A0000-0x00000000002B2000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                              • memory/2768-254-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2784-255-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2784-266-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/2800-304-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2808-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2828-282-0x0000000000400000-0x000000000093E000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.2MB

                                                                                                                                                                                                                                                                              • memory/2828-281-0x00000000022E0000-0x0000000002377000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                604KB

                                                                                                                                                                                                                                                                              • memory/2828-258-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2852-259-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2912-263-0x00000000FF3D246C-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2912-264-0x0000000000060000-0x00000000000AC000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                              • memory/2912-307-0x00000000028B0000-0x00000000029B6000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                              • memory/2912-265-0x00000000004B0000-0x0000000000521000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                              • memory/2924-262-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2936-296-0x0000000000CF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                              • memory/2936-292-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2936-297-0x00000000003D0000-0x000000000042D000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                                                                              • memory/2936-308-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2944-312-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2996-269-0x0000000000417F16-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/2996-270-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/3032-306-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                              • memory/3060-283-0x0000000000930000-0x0000000000931000-memory.dmp
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                              • memory/3060-267-0x0000000000000000-mapping.dmp