Analysis

  • max time kernel
    65s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    20-06-2021 02:11

General

  • Target

    a29be9e688d14557bb2c8d1bab72071a.exe

  • Size

    3.6MB

  • MD5

    a29be9e688d14557bb2c8d1bab72071a

  • SHA1

    4f839d5d4bd6f098abe8f5bc64db2542b0e40798

  • SHA256

    885c540ea597bed7e1d4b8fd3670bc66e821368ba0df789c53a5fd2cb96ed33f

  • SHA512

    6779e16636d379032752571d1db35385b88d46d007d9fc6093ff9537e6a1fcb7ce5937a649f0f908535c1d0a295faeaa34a719503b1a346e8609b8e2da185e1e

Malware Config

Extracted

Family

redline

Botnet

Ani

C2

yaklalau.xyz:80

Extracted

Family

redline

Botnet

NCanal01

C2

pupdatastart.tech:80

pupdatastart.xyz:80

pupdatastar.store:80

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

19_6_r

C2

qitoshalan.xyz:80

Extracted

Family

vidar

Version

39.3

Botnet

706

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

vidar

Version

39.3

Botnet

865

C2

https://bandakere.tumblr.com

Attributes
  • profile_id

    865

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 44 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 19 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
  • Kills process with taskkill 7 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 30 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:1052
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2796
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2788
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2748
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2556
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2520
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1872
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1400
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1360
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1176
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1100
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:300
                        • C:\Users\Admin\AppData\Local\Temp\a29be9e688d14557bb2c8d1bab72071a.exe
                          "C:\Users\Admin\AppData\Local\Temp\a29be9e688d14557bb2c8d1bab72071a.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:860
                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\setup_install.exe
                            "C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\setup_install.exe"
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:2812
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sonia_1.exe
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1328
                              • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_1.exe
                                sonia_1.exe
                                4⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Modifies registry class
                                PID:684
                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                                  5⤵
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4196
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sonia_2.exe
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2212
                              • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_2.exe
                                sonia_2.exe
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:3968
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sonia_3.exe
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3404
                              • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_3.exe
                                sonia_3.exe
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                PID:3172
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_3.exe" & del C:\ProgramData\*.dll & exit
                                  5⤵
                                    PID:3880
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /im sonia_3.exe /f
                                      6⤵
                                      • Kills process with taskkill
                                      PID:5104
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 6
                                      6⤵
                                      • Delays execution with timeout.exe
                                      PID:6044
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_4.exe
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2160
                                • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_4.exe
                                  sonia_4.exe
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:3972
                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    5⤵
                                    • Executes dropped EXE
                                    PID:3600
                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5044
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_5.exe
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3332
                                • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_5.exe
                                  sonia_5.exe
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:3944
                                  • C:\Users\Admin\AppData\Local\Temp\is-6QTKT.tmp\sonia_5.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-6QTKT.tmp\sonia_5.tmp" /SL5="$5004E,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_5.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:3628
                                    • C:\Users\Admin\AppData\Local\Temp\is-AQ8E5.tmp\____(768çshjs).exe
                                      "C:\Users\Admin\AppData\Local\Temp\is-AQ8E5.tmp\____(768çshjs).exe" /S /UID=burnerch1
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4100
                                      • C:\Program Files\VideoLAN\XUINTCBVJS\ultramediaburner.exe
                                        "C:\Program Files\VideoLAN\XUINTCBVJS\ultramediaburner.exe" /VERYSILENT
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4664
                                        • C:\Users\Admin\AppData\Local\Temp\is-UNSC5.tmp\ultramediaburner.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-UNSC5.tmp\ultramediaburner.tmp" /SL5="$20248,281924,62464,C:\Program Files\VideoLAN\XUINTCBVJS\ultramediaburner.exe" /VERYSILENT
                                          8⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of FindShellTrayWindow
                                          PID:5204
                                          • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                            "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                            9⤵
                                            • Executes dropped EXE
                                            PID:5540
                                      • C:\Users\Admin\AppData\Local\Temp\9b-4ae78-82d-937ab-65f91dd974802\Labyfilaeha.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9b-4ae78-82d-937ab-65f91dd974802\Labyfilaeha.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5216
                                      • C:\Users\Admin\AppData\Local\Temp\16-8273f-cda-1bcb6-51a20e767725a\Galilaqity.exe
                                        "C:\Users\Admin\AppData\Local\Temp\16-8273f-cda-1bcb6-51a20e767725a\Galilaqity.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5280
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\feocfjhx.ceo\001.exe & exit
                                          8⤵
                                            PID:5684
                                            • C:\Users\Admin\AppData\Local\Temp\feocfjhx.ceo\001.exe
                                              C:\Users\Admin\AppData\Local\Temp\feocfjhx.ceo\001.exe
                                              9⤵
                                                PID:5600
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sr1fga5i.eds\GcleanerEU.exe /eufive & exit
                                              8⤵
                                                PID:5852
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2cw5rlzk.upu\installer.exe /qn CAMPAIGN="654" & exit
                                                8⤵
                                                  PID:5392
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\csxx1zks.f0m\gaoou.exe & exit
                                                  8⤵
                                                    PID:5892
                                                    • C:\Users\Admin\AppData\Local\Temp\csxx1zks.f0m\gaoou.exe
                                                      C:\Users\Admin\AppData\Local\Temp\csxx1zks.f0m\gaoou.exe
                                                      9⤵
                                                        PID:6124
                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          10⤵
                                                            PID:5376
                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                            10⤵
                                                              PID:4212
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y0m2ea2h.s1j\Setup3310.exe /Verysilent /subid=623 & exit
                                                          8⤵
                                                            PID:1084
                                                            • C:\Users\Admin\AppData\Local\Temp\y0m2ea2h.s1j\Setup3310.exe
                                                              C:\Users\Admin\AppData\Local\Temp\y0m2ea2h.s1j\Setup3310.exe /Verysilent /subid=623
                                                              9⤵
                                                                PID:5776
                                                                • C:\Users\Admin\AppData\Local\Temp\is-7FNHO.tmp\Setup3310.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-7FNHO.tmp\Setup3310.tmp" /SL5="$10318,138429,56832,C:\Users\Admin\AppData\Local\Temp\y0m2ea2h.s1j\Setup3310.exe" /Verysilent /subid=623
                                                                  10⤵
                                                                    PID:5956
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-FVG3V.tmp\Setup.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-FVG3V.tmp\Setup.exe" /Verysilent
                                                                      11⤵
                                                                        PID:4924
                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                          12⤵
                                                                            PID:3220
                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                              13⤵
                                                                                PID:6100
                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                13⤵
                                                                                  PID:6544
                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                12⤵
                                                                                  PID:4708
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                    13⤵
                                                                                      PID:6372
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /im RunWW.exe /f
                                                                                        14⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:6484
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout /t 6
                                                                                        14⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:6804
                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                    12⤵
                                                                                      PID:3880
                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-BV5SA.tmp\LabPicV3.tmp
                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-BV5SA.tmp\LabPicV3.tmp" /SL5="$303BC,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                        13⤵
                                                                                          PID:5516
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-VIB1A.tmp\_____________.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-VIB1A.tmp\_____________.exe" /S /UID=lab214
                                                                                            14⤵
                                                                                              PID:5472
                                                                                              • C:\Program Files\Windows Defender\JAVDYMBFUJ\prolab.exe
                                                                                                "C:\Program Files\Windows Defender\JAVDYMBFUJ\prolab.exe" /VERYSILENT
                                                                                                15⤵
                                                                                                  PID:7000
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-F7EF4.tmp\prolab.tmp
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-F7EF4.tmp\prolab.tmp" /SL5="$503B0,575243,216576,C:\Program Files\Windows Defender\JAVDYMBFUJ\prolab.exe" /VERYSILENT
                                                                                                    16⤵
                                                                                                      PID:7020
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\66-79195-765-36dae-5567b5d4acc1b\Qomytibuzhae.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\66-79195-765-36dae-5567b5d4acc1b\Qomytibuzhae.exe"
                                                                                                    15⤵
                                                                                                      PID:7060
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d2-f1f99-d34-c56bd-7c14f524e6a37\Cerolyshupo.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\d2-f1f99-d34-c56bd-7c14f524e6a37\Cerolyshupo.exe"
                                                                                                      15⤵
                                                                                                        PID:7104
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ul50p2qo.vzp\001.exe & exit
                                                                                                          16⤵
                                                                                                            PID:5764
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ul50p2qo.vzp\001.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\ul50p2qo.vzp\001.exe
                                                                                                              17⤵
                                                                                                                PID:6252
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bayiyinz.wvj\GcleanerEU.exe /eufive & exit
                                                                                                              16⤵
                                                                                                                PID:6164
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2ixdc4u5.mxa\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                16⤵
                                                                                                                  PID:3112
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qpsoadcv.cfc\gaoou.exe & exit
                                                                                                                  16⤵
                                                                                                                    PID:5728
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\qpsoadcv.cfc\gaoou.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\qpsoadcv.cfc\gaoou.exe
                                                                                                                      17⤵
                                                                                                                        PID:4984
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                          18⤵
                                                                                                                            PID:5600
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                            18⤵
                                                                                                                              PID:5996
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vutgyqvf.zdj\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                          16⤵
                                                                                                                            PID:6576
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vutgyqvf.zdj\Setup3310.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\vutgyqvf.zdj\Setup3310.exe /Verysilent /subid=623
                                                                                                                              17⤵
                                                                                                                                PID:6984
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-K7NR8.tmp\Setup3310.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-K7NR8.tmp\Setup3310.tmp" /SL5="$20536,138429,56832,C:\Users\Admin\AppData\Local\Temp\vutgyqvf.zdj\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                  18⤵
                                                                                                                                    PID:4760
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-HSKAM.tmp\Setup.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-HSKAM.tmp\Setup.exe" /Verysilent
                                                                                                                                      19⤵
                                                                                                                                        PID:4412
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p344nkd5.utr\google-game.exe & exit
                                                                                                                                  16⤵
                                                                                                                                    PID:4504
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\p344nkd5.utr\google-game.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\p344nkd5.utr\google-game.exe
                                                                                                                                      17⤵
                                                                                                                                        PID:6712
                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                          18⤵
                                                                                                                                            PID:4908
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 596
                                                                                                                                              19⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:4044
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\44c1ayqy.f5i\005.exe & exit
                                                                                                                                        16⤵
                                                                                                                                          PID:4236
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\44c1ayqy.f5i\005.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\44c1ayqy.f5i\005.exe
                                                                                                                                            17⤵
                                                                                                                                              PID:6752
                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                    12⤵
                                                                                                                                      PID:4816
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-Q9HVT.tmp\lylal220.tmp
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-Q9HVT.tmp\lylal220.tmp" /SL5="$203E6,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                        13⤵
                                                                                                                                          PID:1348
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-T77GO.tmp\56FT____________________.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-T77GO.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                                                                            14⤵
                                                                                                                                              PID:5964
                                                                                                                                              • C:\Program Files\VideoLAN\LJXMMXKWLO\irecord.exe
                                                                                                                                                "C:\Program Files\VideoLAN\LJXMMXKWLO\irecord.exe" /VERYSILENT
                                                                                                                                                15⤵
                                                                                                                                                  PID:6220
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-7HI5I.tmp\irecord.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-7HI5I.tmp\irecord.tmp" /SL5="$303B4,6139911,56832,C:\Program Files\VideoLAN\LJXMMXKWLO\irecord.exe" /VERYSILENT
                                                                                                                                                    16⤵
                                                                                                                                                      PID:4820
                                                                                                                                                      • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                        "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                        17⤵
                                                                                                                                                          PID:6324
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\96-7fa10-54d-28a81-da55ceb1d8bcc\Fubelydizha.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\96-7fa10-54d-28a81-da55ceb1d8bcc\Fubelydizha.exe"
                                                                                                                                                      15⤵
                                                                                                                                                        PID:6036
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\36-ee436-4e1-d609e-72f4452954ec7\Fedaehowaele.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\36-ee436-4e1-d609e-72f4452954ec7\Fedaehowaele.exe"
                                                                                                                                                        15⤵
                                                                                                                                                          PID:6256
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jabspogy.5yx\001.exe & exit
                                                                                                                                                            16⤵
                                                                                                                                                              PID:1792
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jabspogy.5yx\001.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jabspogy.5yx\001.exe
                                                                                                                                                                17⤵
                                                                                                                                                                  PID:5408
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\if1ibqdz.etj\GcleanerEU.exe /eufive & exit
                                                                                                                                                                16⤵
                                                                                                                                                                  PID:6992
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ln55ofxr.rg3\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                  16⤵
                                                                                                                                                                    PID:5896
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t1biwnj0.frl\gaoou.exe & exit
                                                                                                                                                                    16⤵
                                                                                                                                                                      PID:6824
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\t1biwnj0.frl\gaoou.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\t1biwnj0.frl\gaoou.exe
                                                                                                                                                                        17⤵
                                                                                                                                                                          PID:5516
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                            18⤵
                                                                                                                                                                              PID:736
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                              18⤵
                                                                                                                                                                                PID:1204
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b3lyu1ha.t0i\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                            16⤵
                                                                                                                                                                              PID:5500
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b3lyu1ha.t0i\Setup3310.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\b3lyu1ha.t0i\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                17⤵
                                                                                                                                                                                  PID:3164
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-0KIM8.tmp\Setup3310.tmp
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-0KIM8.tmp\Setup3310.tmp" /SL5="$20524,138429,56832,C:\Users\Admin\AppData\Local\Temp\b3lyu1ha.t0i\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                    18⤵
                                                                                                                                                                                      PID:1472
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-CFJ18.tmp\Setup.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-CFJ18.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                        19⤵
                                                                                                                                                                                          PID:6432
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\10rdmph2.03s\google-game.exe & exit
                                                                                                                                                                                    16⤵
                                                                                                                                                                                      PID:368
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10rdmph2.03s\google-game.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\10rdmph2.03s\google-game.exe
                                                                                                                                                                                        17⤵
                                                                                                                                                                                          PID:5764
                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                            18⤵
                                                                                                                                                                                              PID:5512
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\upce5ivx.1ch\005.exe & exit
                                                                                                                                                                                          16⤵
                                                                                                                                                                                            PID:512
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\upce5ivx.1ch\005.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\upce5ivx.1ch\005.exe
                                                                                                                                                                                              17⤵
                                                                                                                                                                                                PID:6468
                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                      12⤵
                                                                                                                                                                                        PID:4820
                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                          13⤵
                                                                                                                                                                                            PID:5372
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\siigxrlr.43g\google-game.exe & exit
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:5480
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\siigxrlr.43g\google-game.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\siigxrlr.43g\google-game.exe
                                                                                                                                                                                      9⤵
                                                                                                                                                                                        PID:5372
                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                          10⤵
                                                                                                                                                                                            PID:2212
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bhag3phj.mc2\005.exe & exit
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:5388
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bhag3phj.mc2\005.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\bhag3phj.mc2\005.exe
                                                                                                                                                                                            9⤵
                                                                                                                                                                                              PID:2116
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c5z21vnc.u4a\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:6104
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eopbww3w.k4o\toolspab1.exe & exit
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:5776
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\eopbww3w.k4o\toolspab1.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\eopbww3w.k4o\toolspab1.exe
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                  PID:3332
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\eopbww3w.k4o\toolspab1.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\eopbww3w.k4o\toolspab1.exe
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:2112
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_6.exe
                                                                                                                                                                                          sonia_6.exe
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:3992
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7170081.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\7170081.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                            PID:3176
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im 7170081.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\7170081.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                  taskkill /im 7170081.exe /f
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                  PID:1084
                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                  timeout /t 6
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                  PID:5636
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\5774171.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\5774171.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              PID:4604
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4108
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\7097650.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\7097650.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1196
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\6585802.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\6585802.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:4828
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sonia_8.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:4056
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_8.exe
                                                                                                                                                                                            sonia_8.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:2324
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sonia_9.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:2252
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_9.exe
                                                                                                                                                                                            sonia_9.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:3872
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_9.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_9.exe
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:500
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:2280
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_7.exe
                                                                                                                                                                                            sonia_7.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:608
                                                                                                                                                                                            • C:\Users\Admin\Documents\_bTfDHLQM9PgtRRkdZZ91Wff.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\_bTfDHLQM9PgtRRkdZZ91Wff.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                              PID:4224
                                                                                                                                                                                              • C:\Users\Admin\Documents\_bTfDHLQM9PgtRRkdZZ91Wff.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\_bTfDHLQM9PgtRRkdZZ91Wff.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                PID:4868
                                                                                                                                                                                            • C:\Users\Admin\Documents\0lUw3hWawywdTQEcSn0Sx8oQ.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\0lUw3hWawywdTQEcSn0Sx8oQ.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4312
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im 0lUw3hWawywdTQEcSn0Sx8oQ.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0lUw3hWawywdTQEcSn0Sx8oQ.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:4332
                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                    taskkill /im 0lUw3hWawywdTQEcSn0Sx8oQ.exe /f
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                    timeout /t 6
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                              • C:\Users\Admin\Documents\tnXaRmZ5lJddkgc2NTM5YG9B.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\tnXaRmZ5lJddkgc2NTM5YG9B.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4372
                                                                                                                                                                                              • C:\Users\Admin\Documents\qq4BRcL7YaVULPSNG35hEWCo.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\qq4BRcL7YaVULPSNG35hEWCo.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:4696
                                                                                                                                                                                                • C:\Users\Admin\Documents\qq4BRcL7YaVULPSNG35hEWCo.exe
                                                                                                                                                                                                  C:\Users\Admin\Documents\qq4BRcL7YaVULPSNG35hEWCo.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                              • C:\Users\Admin\Documents\rcBIHCAtgIzmXllr1q9AsVVA.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\rcBIHCAtgIzmXllr1q9AsVVA.exe"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:5012
                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:5320
                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:5480
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:5412
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffada994f50,0x7ffada994f60,0x7ffada994f70
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:5160
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1676,9528555732659150202,8503078822315626909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:8
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:5652
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,9528555732659150202,8503078822315626909,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1736 /prefetch:8
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:2004
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1676,9528555732659150202,8503078822315626909,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1688 /prefetch:2
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:6100
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "cmd.exe" /C taskkill /F /PID 5012 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\rcBIHCAtgIzmXllr1q9AsVVA.exe"
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:5416
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                      taskkill /F /PID 5012
                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "cmd.exe" /C taskkill /F /PID 5012 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\rcBIHCAtgIzmXllr1q9AsVVA.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:5484
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /PID 5012
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:5680
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\T89KIRITX75GRbGcbAta5T9h.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Documents\T89KIRITX75GRbGcbAta5T9h.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:3688
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\Ohk_7hVLVrMiDiDM9kNQFNMn.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Documents\Ohk_7hVLVrMiDiDM9kNQFNMn.exe"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "Ohk_7hVLVrMiDiDM9kNQFNMn.exe" /f & erase "C:\Users\Admin\Documents\Ohk_7hVLVrMiDiDM9kNQFNMn.exe" & exit
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:5416
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                          taskkill /im "Ohk_7hVLVrMiDiDM9kNQFNMn.exe" /f
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                          PID:5840
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\hTZDmEjKrX5vNwvtVncUkiRA.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\hTZDmEjKrX5vNwvtVncUkiRA.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4240
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4236
                                                                                                                                                                                                                      • C:\Users\Admin\Documents\xujnNOGO_KUTFTp1Cof9Natl.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Documents\xujnNOGO_KUTFTp1Cof9Natl.exe"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:1120
                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4680
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4772
                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:6180
                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6956
                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3D92.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3D92.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:6744
                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:6832
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4757.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\4757.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:6928
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\536D.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\536D.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:6400
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\536D.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:7280
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                            timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                            PID:7384
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5812.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\5812.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5812.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\5812.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:7156
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                icacls "C:\Users\Admin\AppData\Local\605821f7-bf15-41db-8334-940ef188aba1" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6EA8.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\6EA8.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:6872
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7456.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7456.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7456.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7456.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7AEF.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7AEF.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:6372
                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:2284
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7FB2.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7FB2.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7FB2.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7FB2.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:7244
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\84F3.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\84F3.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:5212
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8D03.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\8D03.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9A13.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\9A13.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:368
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:6748
                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:5252
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:5296
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:4872
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:6856
                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                              • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                werfault.exe /h /shared Global\6a64f4f9004743818604565799cd36a3 /t 2808 /p 2284
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:3732
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\C655.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\C655.exe
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:7164
                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:7316
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 7316 -s 1816
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:7512
                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:7588
                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:7776

                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                          Modify Existing Service

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1031

                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1060

                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                          Disabling Security Tools

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1089

                                                                                                                                                                                                                                                                                          File Permissions Modification

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                          Credentials in Files

                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                          T1081

                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qq4BRcL7YaVULPSNG35hEWCo.exe.log
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            808e884c00533a9eb0e13e64960d9c3a

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            279d05181fc6179a12df1a669ff5d8b64c1380ae

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            9489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\libcurl.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\libcurlpp.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\libstdc++-6.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\libwinpthread-1.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\setup_install.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\setup_install.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            3e7323028ebf49f65a6cade6e5cf52b0

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b0c68edeabe02e1b290bdca02b84cf6433b3ddca

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            85873368167cb2330cd808bca6cdc126725af22de99521cb2427d2ce84e5e9e0

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            8d923356f8f41289b3fefd3a284c8d7309e9e81a3ec81ae66f0534d6cea6a9c0904e7cf3c01ec25aed898d30d494bb0f9352887199c1f8f1e19aad261524a840

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_1.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            cd2432b2a7980238b57791ae06cf6f65

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4e7d16dcdafe324d095127cbeafdefe241d47bad

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            fd0b85544e8dd7e550ae5fcce101140c9c1c101fefeee2551c4be72c2fe6f9b31865a5900d3d3026b62b12c51f3dda46bc848083dbd23445e9e1890d2638d556

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_1.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            cd2432b2a7980238b57791ae06cf6f65

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4e7d16dcdafe324d095127cbeafdefe241d47bad

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            4105ed9fb231cbe5ca165accacdb315a6ea602dba29125d3dbdc88e518841939

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            fd0b85544e8dd7e550ae5fcce101140c9c1c101fefeee2551c4be72c2fe6f9b31865a5900d3d3026b62b12c51f3dda46bc848083dbd23445e9e1890d2638d556

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_2.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_2.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            1f621b5af1871708ae2d63d9b70288c2

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            e6dec1ab0238705693d346f6dcd33d2e999c1edb

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a09ba9ad25ec20f5aa3b7c64a4dfc4901b746d3542d632ef305c05c18eeaf149

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            f2f1e86ee80e73836c0f201322cec6f9df53d5208090f291f38564a4a29e11d4390cf1c8c4b57ee2c1bd1f7a0bc8756c3e6cb545b10acbdf1b3458046db99fc5

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_3.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_3.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            7c08cf62a9a21332ae10df331dc02d37

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            15c580f6308f004c26f5eb5685175bfb7ebd4bd7

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            7a0986fc19457f0d93e4a3da6e55ba94b58d05dcaf4068dec6e529e58a14e57e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            75c532816ddf02a1fd1a5d5b405c7b60bb6f391473e1d9c71c0ad1132fb188723cc324a63e5ccc21511fcfbb193c3de1b623e4fafca2615299294b7282f706bf

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_4.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            509aa5db8abd44cec60705aebb88e354

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            557beb26da0a0dcafa6528557038f2887639e2b2

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f2925c78059a0fe7a48910d2179182bf7a72196d61141379a689e2d3931d9105

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ec7351801119cd3bc1c9ee579cba5e0f99ba560d2747b672a2c487808668116dd0db4db656b36e92867805f140ffb4f9c85b6243c63d7e861a3c9ab54843368e

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_4.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            509aa5db8abd44cec60705aebb88e354

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            557beb26da0a0dcafa6528557038f2887639e2b2

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f2925c78059a0fe7a48910d2179182bf7a72196d61141379a689e2d3931d9105

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ec7351801119cd3bc1c9ee579cba5e0f99ba560d2747b672a2c487808668116dd0db4db656b36e92867805f140ffb4f9c85b6243c63d7e861a3c9ab54843368e

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_5.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            3630ff5c281859f4f95aa0516a33f24a

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            32943c4bf92b7b763736af2bf360e91de1f9ef77

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2f1f85c6ea774f0337c5028d557489eb48bf82783c891dec229270e6fcc8d496

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            f5a1268d78faa349ddf054fb8cfcf39344065b828181191431ea0bb7d82216a85fab96db902940ec574d992b75b954978fcad96d36d585e6df27623c6320e640

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_5.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            3630ff5c281859f4f95aa0516a33f24a

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            32943c4bf92b7b763736af2bf360e91de1f9ef77

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2f1f85c6ea774f0337c5028d557489eb48bf82783c891dec229270e6fcc8d496

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            f5a1268d78faa349ddf054fb8cfcf39344065b828181191431ea0bb7d82216a85fab96db902940ec574d992b75b954978fcad96d36d585e6df27623c6320e640

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_6.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            441b8c0783a61a25e127d7cc74085142

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b2d69cc4296e9b3467daaaec95e89bd3d2c80585

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            5b5e12e0f70e6809381c55ff68322708e9e97d2f97f5aa566241247bcf048091

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            379c45c95f1e16590bc284cab84df034290e49000260c0a5a9889c07e338393d2edf4eaf6f9e1a48e8083bdd37a144eac10b8c1a3607f7b9ddb6e384cd238fc7

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_6.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            441b8c0783a61a25e127d7cc74085142

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b2d69cc4296e9b3467daaaec95e89bd3d2c80585

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            5b5e12e0f70e6809381c55ff68322708e9e97d2f97f5aa566241247bcf048091

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            379c45c95f1e16590bc284cab84df034290e49000260c0a5a9889c07e338393d2edf4eaf6f9e1a48e8083bdd37a144eac10b8c1a3607f7b9ddb6e384cd238fc7

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_7.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            2a8da3478be390b9ce722f4994357c96

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            7a6bc0a303854cc864de5612a36d177d6dba3123

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            1241e0e6e0bff794a184838286ab10089b567832ba1433a9c37984ba6ad97e12

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            93b0e33b6124cb05264b5bb7e689388deb352f0dca244ea812f8d317e1b52832b1a7305276109b29e45383f7e5d298f2734cc2f1063e1aec250b57d738be15b3

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_7.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            2a8da3478be390b9ce722f4994357c96

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            7a6bc0a303854cc864de5612a36d177d6dba3123

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            1241e0e6e0bff794a184838286ab10089b567832ba1433a9c37984ba6ad97e12

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            93b0e33b6124cb05264b5bb7e689388deb352f0dca244ea812f8d317e1b52832b1a7305276109b29e45383f7e5d298f2734cc2f1063e1aec250b57d738be15b3

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_8.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_8.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            3ea9068ef774fe66ede07919a06de29c

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            435ab456c4cd3e5612465b9157f8f22020844f18

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            579c7ffad54f291a1e8d266cb41f48c0b55548a5ad49f8e4e0e0696bd3d96398

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            76e5fa254f45573de8bc3c0a613d09e9c0d670b8c335e1722ccfff27353dac2ccb6e06be5424e0016933bed85f5c4570b64f9950e93a806f97ba5f953ba3ae04

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_9.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_9.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC531EAA4\sonia_9.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            38a2ce6359f87ccb4b803c0ce9e92639

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4248468d23ed24500ffa67e70c32831b20139006

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            7194c466e083d286f9e16acc1a84b928474542fd9257f9162389b35b4211af0d

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            baf9e12b4a578e3dc01d4d720ccb9013df4351ed1603126ac10f26c6d92bc8d01e9aabf1ec9c81bd81eda2d2df82f72b156cc9043f15978e7761cbb7394610b3

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\install.dat
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            b4bcbdab68f289e054205eb6d6b246ce

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            a9b8a0bae8eb7b8c3ee66bdf5eac1a3d22482270

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            df42d059f9f469b284cbf7cc1cc2cfa99f4c896085d42c7c7e1acbc054305db2

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            a6dbb8173d6d5830be9970c5f2f908aac79903543e89c58a467693626d7c28bd53209ed16e2638f74116a1c8d70f514a65261c641a06892a19ea8d1a5d059a62

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\install.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d5b43b52e76ed607e77062961b01d27b

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            7fb32d68fd04a49373840f73ea94a020b11d2616

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            cec7a92e19c44c5cbf66de2ceda993c29d88a60fccb20cf170611725887a2626

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ea88cca76ce4f3e74f0f7bca637f543c1276c9e80bbe96ffc87331c07c09349c431cb97ed4008363b027092b99192a56324c37c16a06890d2aebd9390f7eae0f

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-6QTKT.tmp\sonia_5.tmp
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            4cd3babd15cb599aca85cc7f9804a347

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            f3e7b1e376e2aa5e2c25af62395b953b373b8baf

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2752ffaa3030729fcb577d04d59eb6d03f43769bd85f733250960acb86096f43

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            10afaa6523ed05839e63cd151f5159e2d707d9e74e52bc09d1e4bdeb7ec34a39aae20894b2cd3f0bacad4b709e0b61744983a6f97e825413329e90b8e6868b28

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-AQ8E5.tmp\____(768çshjs).exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d847a52edc28bc0c7eddbe6a9f71716a

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            8b7150653d1edbc2195926ff8f0a3da7f9c9404c

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            352973909142a3f955d442ebc1bb589faa68bd934bf5b72222a4ad9df9303287

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            2adf68324345310e7efa63fa152cb291326d71e3bb8db9f59bee3565f8ce79ef61fec73b1fd1cf9b5bded5e2406b777f6f9eb555fac6df33de7c69ee0410366a

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-AQ8E5.tmp\____(768çshjs).exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d847a52edc28bc0c7eddbe6a9f71716a

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            8b7150653d1edbc2195926ff8f0a3da7f9c9404c

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            352973909142a3f955d442ebc1bb589faa68bd934bf5b72222a4ad9df9303287

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            2adf68324345310e7efa63fa152cb291326d71e3bb8db9f59bee3565f8ce79ef61fec73b1fd1cf9b5bded5e2406b777f6f9eb555fac6df33de7c69ee0410366a

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7097650.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            649a729ce787e7a14841fdc720901271

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            7222ecba92fcd93b4d074f8320974f3ffa400acd

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            8a311d3eed3748c23de63d1798c9a4bb497b3a3bc838ffdcc21330e8a450fa98

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            28441efd193dd6f182670d03df0fa96244006b01349be445bd624936a6656e74191989b29e3b8cb249b95d7ef207bf8f29a568537749696f7366ab764d745ff3

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\7097650.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            649a729ce787e7a14841fdc720901271

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            7222ecba92fcd93b4d074f8320974f3ffa400acd

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            8a311d3eed3748c23de63d1798c9a4bb497b3a3bc838ffdcc21330e8a450fa98

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            28441efd193dd6f182670d03df0fa96244006b01349be445bd624936a6656e74191989b29e3b8cb249b95d7ef207bf8f29a568537749696f7366ab764d745ff3

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\0lUw3hWawywdTQEcSn0Sx8oQ.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            93a9015edc62b53c12a3e3c9ca7e17f0

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            5102f1f1a500a4089ccf6188a76fe664ec810870

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            b0bf944eb3f2f6706a87e98b89a862ac20501beda28e8805116190f51bb56133

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            fc27a538d61bbebfef194ed15113ceeeeffe72949996a9c7fb4f19f731f283bd95450cafd4e34a2b99c28e289a52448612e964dd7b47d2cb7b5b2d7215d3890c

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\0lUw3hWawywdTQEcSn0Sx8oQ.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            93a9015edc62b53c12a3e3c9ca7e17f0

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            5102f1f1a500a4089ccf6188a76fe664ec810870

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            b0bf944eb3f2f6706a87e98b89a862ac20501beda28e8805116190f51bb56133

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            fc27a538d61bbebfef194ed15113ceeeeffe72949996a9c7fb4f19f731f283bd95450cafd4e34a2b99c28e289a52448612e964dd7b47d2cb7b5b2d7215d3890c

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\Ohk_7hVLVrMiDiDM9kNQFNMn.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            26781b5f89eec75eb2ba9ea9a692edc9

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            d3462096ed87de0559d15b96d0e81a45de3b75bb

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            ce0ac04ab37aefb8b87413453770c44a6c3be760e4e805243fb2073edde10e8d

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            0f28f46a804b0a754c2cbe08947d0e5a668a109c1c72986b89328521a64c4035dd30303c5588295f63a3094ffe7647b3f39983b49f611e46979cc3a296cc7d4e

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\Ohk_7hVLVrMiDiDM9kNQFNMn.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            26781b5f89eec75eb2ba9ea9a692edc9

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            d3462096ed87de0559d15b96d0e81a45de3b75bb

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            ce0ac04ab37aefb8b87413453770c44a6c3be760e4e805243fb2073edde10e8d

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            0f28f46a804b0a754c2cbe08947d0e5a668a109c1c72986b89328521a64c4035dd30303c5588295f63a3094ffe7647b3f39983b49f611e46979cc3a296cc7d4e

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\T89KIRITX75GRbGcbAta5T9h.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            aed57d50123897b0012c35ef5dec4184

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            568571b12ca44a585df589dc810bf53adf5e8050

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\T89KIRITX75GRbGcbAta5T9h.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            aed57d50123897b0012c35ef5dec4184

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            568571b12ca44a585df589dc810bf53adf5e8050

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\_bTfDHLQM9PgtRRkdZZ91Wff.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9dcce4ecc3e308732b0ad93cf9eb9b61

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            16db3ecdb2b779707c3159df6be973d0ac47e279

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            107e2586cabefc864d97ae0920e7252eccc59438b1bad1435d9eb30a14be253f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            85ab0b9eeb73a3152edc30214a1ca85df08ebd1f7b4b5e07442e20dcb4be737e44b6f2e96fb75404aeab7e3e654e2ab277078ad938a00bd570cec7f5c3703841

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\_bTfDHLQM9PgtRRkdZZ91Wff.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9dcce4ecc3e308732b0ad93cf9eb9b61

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            16db3ecdb2b779707c3159df6be973d0ac47e279

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            107e2586cabefc864d97ae0920e7252eccc59438b1bad1435d9eb30a14be253f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            85ab0b9eeb73a3152edc30214a1ca85df08ebd1f7b4b5e07442e20dcb4be737e44b6f2e96fb75404aeab7e3e654e2ab277078ad938a00bd570cec7f5c3703841

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\hTZDmEjKrX5vNwvtVncUkiRA.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            623c88cc55a2df1115600910bbe14457

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            8c7e43140b1558b5ccbfeb978567daf57e3fc44f

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            47bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\hTZDmEjKrX5vNwvtVncUkiRA.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            623c88cc55a2df1115600910bbe14457

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            8c7e43140b1558b5ccbfeb978567daf57e3fc44f

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            47bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\qq4BRcL7YaVULPSNG35hEWCo.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            f6c86fcba14550740e6ad7468f6ad59e

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            f411059643a3e9854635750a442c3d0c677f3ea6

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2899fd4889efb16d5b5257b8b05801829b5d10a14264b3734c0ca324cf51e5ca

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            766574b9fe367623ec9cf27b62b24f63db76f13d086232bf95f15b54e85a7808636abf65c111007139297fdf6a64413495afdd380746327b723e67b5a8db0cf6

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\qq4BRcL7YaVULPSNG35hEWCo.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            f6c86fcba14550740e6ad7468f6ad59e

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            f411059643a3e9854635750a442c3d0c677f3ea6

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2899fd4889efb16d5b5257b8b05801829b5d10a14264b3734c0ca324cf51e5ca

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            766574b9fe367623ec9cf27b62b24f63db76f13d086232bf95f15b54e85a7808636abf65c111007139297fdf6a64413495afdd380746327b723e67b5a8db0cf6

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\qq4BRcL7YaVULPSNG35hEWCo.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            f6c86fcba14550740e6ad7468f6ad59e

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            f411059643a3e9854635750a442c3d0c677f3ea6

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2899fd4889efb16d5b5257b8b05801829b5d10a14264b3734c0ca324cf51e5ca

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            766574b9fe367623ec9cf27b62b24f63db76f13d086232bf95f15b54e85a7808636abf65c111007139297fdf6a64413495afdd380746327b723e67b5a8db0cf6

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\rcBIHCAtgIzmXllr1q9AsVVA.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            856cf6ed735093f5fe523f0d99e18424

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            d8946c746ac52c383a8547a4c8ff96ec85108b76

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f47a0c643ec5aa9d2b0302391d39bedfd675abd8892d5a2bd18b66fc303f66f7

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            cbdfed752970534997542ce70f7a610eff7e28d42507865855af29b47f5c5500adab6dcc163b695347086b9bb6a7f1f5d6826a473b0a387b5a8f4ad944a1f322

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\rcBIHCAtgIzmXllr1q9AsVVA.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            856cf6ed735093f5fe523f0d99e18424

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            d8946c746ac52c383a8547a4c8ff96ec85108b76

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f47a0c643ec5aa9d2b0302391d39bedfd675abd8892d5a2bd18b66fc303f66f7

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            cbdfed752970534997542ce70f7a610eff7e28d42507865855af29b47f5c5500adab6dcc163b695347086b9bb6a7f1f5d6826a473b0a387b5a8f4ad944a1f322

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\tnXaRmZ5lJddkgc2NTM5YG9B.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            1c32647a706fbef6faeac45a75201489

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            9055c809cc813d8358bc465603165be70f9216b7

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f60e23e0d5cbd44794977c641d07228f8c7a9255f469a1fe9b2ae4c4cc009edc

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            c8acb58b5686b5daf16de893a9a09c61429892b61195442c456982b14be16baef714b4cf1ad61705480afb880c48d82ace5f65a055ad3bad204a8e776971a3d0

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\xujnNOGO_KUTFTp1Cof9Natl.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            41c69a7f93fbe7edc44fd1b09795fa67

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            f09309b52d2a067585266ec57a58817b3fc0c9df

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            8b720f6963165f9aca1600e2e3efb04a7162014d0d738fb7f8b9872019f49bd5

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            c561b02eb7aeb0e994716a6b046973ac36c3fd004fa2524b402c1a9b09e931cf0db41ec938c808acadefc708e9e6950a7262f4b7f3b60c0083a660f58e0b01a9

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSC531EAA4\libcurl.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSC531EAA4\libcurl.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSC531EAA4\libcurlpp.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSC531EAA4\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSC531EAA4\libgcc_s_dw2-1.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSC531EAA4\libstdc++-6.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSC531EAA4\libwinpthread-1.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            50741b3f2d7debf5d2bed63d88404029

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            56210388a627b926162b36967045be06ffb1aad3

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\install.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d5b43b52e76ed607e77062961b01d27b

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            7fb32d68fd04a49373840f73ea94a020b11d2616

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            cec7a92e19c44c5cbf66de2ceda993c29d88a60fccb20cf170611725887a2626

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ea88cca76ce4f3e74f0f7bca637f543c1276c9e80bbe96ffc87331c07c09349c431cb97ed4008363b027092b99192a56324c37c16a06890d2aebd9390f7eae0f

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\is-AQ8E5.tmp\idp.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                                                                                                                                                          • memory/300-244-0x000001D60EEB0000-0x000001D60EF21000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/500-209-0x0000000005B90000-0x0000000005B91000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/500-228-0x0000000005430000-0x0000000005431000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/500-195-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                          • memory/500-210-0x0000000005570000-0x0000000005571000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/500-196-0x0000000000417DBE-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/500-215-0x0000000005390000-0x0000000005391000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/500-220-0x00000000053F0000-0x00000000053F1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/500-246-0x00000000056A0000-0x00000000056A1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/608-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/684-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/1052-258-0x0000020CBFE50000-0x0000020CBFEC1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/1100-253-0x000001E936500000-0x000001E936571000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/1120-216-0x000002469E430000-0x000002469E47B000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            300KB

                                                                                                                                                                                                                                                                                          • memory/1120-219-0x000002469E4F0000-0x000002469E561000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/1176-269-0x000001D8B8D20000-0x000001D8B8D91000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/1196-316-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/1196-324-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/1196-327-0x0000000005940000-0x0000000005941000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/1328-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/1360-280-0x0000023B8CB70000-0x0000023B8CBE1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/1400-259-0x0000024478380000-0x00000244783F1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/1872-270-0x000001B9F2860000-0x000001B9F28D1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/2112-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2160-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2212-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2252-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2280-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2324-332-0x0000000004F93000-0x0000000004F94000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/2324-308-0x0000000000900000-0x0000000000A4A000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                          • memory/2324-298-0x0000000000400000-0x00000000008FE000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            5.0MB

                                                                                                                                                                                                                                                                                          • memory/2324-328-0x0000000004F90000-0x0000000004F91000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/2324-315-0x0000000004F94000-0x0000000004F96000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/2324-303-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/2324-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2324-311-0x0000000004E30000-0x0000000004E49000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                          • memory/2324-300-0x00000000025F0000-0x000000000260B000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            108KB

                                                                                                                                                                                                                                                                                          • memory/2324-331-0x0000000004F92000-0x0000000004F93000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/2520-243-0x000001C8E7840000-0x000001C8E78B1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/2556-237-0x000001B527B80000-0x000001B527BF1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/2644-323-0x0000000000CA0000-0x0000000000CB6000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                                                          • memory/2748-232-0x00000203D3A10000-0x00000203D3A81000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/2788-301-0x000001E1DFE40000-0x000001E1DFEB1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/2796-312-0x0000028C4A700000-0x0000028C4A771000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/2812-131-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                                                                          • memory/2812-130-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                                                                          • memory/2812-144-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                          • memory/2812-143-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                          • memory/2812-145-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                          • memory/2812-142-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                                                                          • memory/2812-129-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            572KB

                                                                                                                                                                                                                                                                                          • memory/2812-132-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                                                                          • memory/2812-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3172-329-0x0000000000400000-0x000000000093E000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                                                                          • memory/3172-326-0x0000000000C10000-0x0000000000CA7000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            604KB

                                                                                                                                                                                                                                                                                          • memory/3172-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3176-330-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3332-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3404-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3600-188-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3628-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3628-186-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/3688-340-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3872-179-0x00000000008D0000-0x00000000008D1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/3872-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3872-187-0x0000000005120000-0x0000000005121000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/3880-369-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3944-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3944-175-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            436KB

                                                                                                                                                                                                                                                                                          • memory/3968-288-0x00000000008F0000-0x0000000000A3A000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                          • memory/3968-319-0x0000000000400000-0x00000000008E5000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4.9MB

                                                                                                                                                                                                                                                                                          • memory/3968-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3972-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3992-183-0x0000000000F50000-0x0000000000F51000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/3992-173-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/3992-182-0x0000000000F30000-0x0000000000F4D000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            116KB

                                                                                                                                                                                                                                                                                          • memory/3992-185-0x000000001B7A0000-0x000000001B7A2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/3992-177-0x0000000000F20000-0x0000000000F21000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/3992-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4056-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4100-207-0x0000000002190000-0x0000000002192000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/4100-191-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4108-352-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4196-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4196-213-0x0000000004BCE000-0x0000000004CCF000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                          • memory/4196-221-0x0000000004CD0000-0x0000000004D2C000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            368KB

                                                                                                                                                                                                                                                                                          • memory/4224-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4224-342-0x0000000000B20000-0x0000000000B2C000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                                                                                          • memory/4236-349-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4240-354-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4312-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4312-343-0x0000000002560000-0x00000000025F7000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            604KB

                                                                                                                                                                                                                                                                                          • memory/4312-345-0x0000000000400000-0x000000000093E000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                                                                          • memory/4332-368-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4348-348-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4372-355-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4372-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4376-309-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4404-242-0x0000026D6D170000-0x0000026D6D1E1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/4404-224-0x00007FF674E84060-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4416-346-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4416-350-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                                                                          • memory/4416-351-0x0000000000430000-0x000000000057A000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1.3MB

                                                                                                                                                                                                                                                                                          • memory/4584-347-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4604-325-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4664-357-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4696-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4696-262-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4696-268-0x00000000052E0000-0x00000000052E1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4828-334-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4828-338-0x0000000005990000-0x0000000005991000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4864-335-0x00007FF674E84060-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4864-337-0x0000023E4C670000-0x0000023E4C6E1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            452KB

                                                                                                                                                                                                                                                                                          • memory/4864-336-0x0000023E4C380000-0x0000023E4C3CC000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                                                                          • memory/4868-341-0x0000000000402F68-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4868-344-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                                                                                          • memory/4960-356-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4980-282-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                          • memory/4980-305-0x0000000002830000-0x0000000002831000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4980-290-0x0000000000417F16-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5012-274-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5012-353-0x0000000002680000-0x000000000270E000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            568KB

                                                                                                                                                                                                                                                                                          • memory/5036-276-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5044-339-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5060-279-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5080-281-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5204-358-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5216-359-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5280-360-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5320-361-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5416-362-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5428-363-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5480-364-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5540-365-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5840-366-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/6104-367-0x0000000000000000-mapping.dmp