Analysis

  • max time kernel
    31s
  • max time network
    63s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    05-07-2021 03:20

General

  • Target

    0DE6D453BB0EEED2910795A70279D479.exe

  • Size

    3.6MB

  • MD5

    0de6d453bb0eeed2910795a70279d479

  • SHA1

    7a7671111c5a29fdabf73fd916851cd3c21be82b

  • SHA256

    497d6c2077bc72c42f5623e82c1da083b4541b69b428021dc8bb65661166ec1e

  • SHA512

    4f24897b83be1a143ed81ed2c96ccbe8f2b41d489097069e3a798f8c4bc5e685736008399738fb4a93f5ec40311ef0aec9f3546e4d5db753eb71753efbe9c5b5

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

DomAni2

C2

detuyaluro.xyz:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 21 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 14 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 63 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 22 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 8 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          3⤵
            PID:1740
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:2264
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
            PID:2824
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
              PID:2796
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k SystemNetworkService
              2⤵
                PID:2720
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                  PID:2872
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                    PID:2860
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                    2⤵
                      PID:2884
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                      2⤵
                        PID:2900
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                          PID:2912
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                            PID:2924
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                              PID:2936
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                              2⤵
                                PID:2960
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                  PID:3000
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                  2⤵
                                    PID:3012
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                    2⤵
                                      PID:3024
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                      2⤵
                                        PID:3036
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                          PID:3068
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                          2⤵
                                            PID:3056
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                            2⤵
                                              PID:924
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                              2⤵
                                                PID:2144
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                2⤵
                                                  PID:2172
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                  2⤵
                                                    PID:2164
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                    2⤵
                                                      PID:1932
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                      2⤵
                                                        PID:2256
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                        2⤵
                                                          PID:2292
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                          2⤵
                                                            PID:2236
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                            2⤵
                                                              PID:2232
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                              2⤵
                                                                PID:904
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                2⤵
                                                                  PID:2412
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                  2⤵
                                                                    PID:2116
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                    2⤵
                                                                      PID:1452
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                      2⤵
                                                                        PID:2544
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                        2⤵
                                                                          PID:2588
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                          2⤵
                                                                            PID:2624
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                            2⤵
                                                                              PID:2400
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                              2⤵
                                                                                PID:2580
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                2⤵
                                                                                  PID:2688
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                  2⤵
                                                                                    PID:2304
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:2040
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                    2⤵
                                                                                      PID:2620
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                      2⤵
                                                                                        PID:1104
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                        2⤵
                                                                                          PID:2640
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                          2⤵
                                                                                            PID:2540
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                            2⤵
                                                                                              PID:2168
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                              2⤵
                                                                                                PID:2628
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                2⤵
                                                                                                  PID:2532
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                  2⤵
                                                                                                    PID:936
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                    2⤵
                                                                                                      PID:1948
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                      2⤵
                                                                                                        PID:2512
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                        2⤵
                                                                                                          PID:2600
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                          2⤵
                                                                                                            PID:1784
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                            2⤵
                                                                                                              PID:2728
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                              2⤵
                                                                                                                PID:472
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                2⤵
                                                                                                                  PID:2012
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                  2⤵
                                                                                                                    PID:1448
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                    2⤵
                                                                                                                      PID:1680
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                      2⤵
                                                                                                                        PID:1576
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                        2⤵
                                                                                                                          PID:1492
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                          2⤵
                                                                                                                            PID:2736
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                            2⤵
                                                                                                                              PID:624
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                              2⤵
                                                                                                                                PID:2068
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                2⤵
                                                                                                                                  PID:2100
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                  2⤵
                                                                                                                                    PID:2220
                                                                                                                                • C:\Windows\Explorer.EXE
                                                                                                                                  C:\Windows\Explorer.EXE
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:1180
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0DE6D453BB0EEED2910795A70279D479.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0DE6D453BB0EEED2910795A70279D479.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1672
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:1996
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c sotema_1.exe
                                                                                                                                        4⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:1248
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_1.exe
                                                                                                                                          sotema_1.exe
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:1980
                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft
                                                                                                                                            6⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1224
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c sotema_2.exe
                                                                                                                                        4⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:1324
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_2.exe
                                                                                                                                          sotema_2.exe
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                          PID:1444
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c sotema_3.exe
                                                                                                                                        4⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:1172
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_3.exe
                                                                                                                                          sotema_3.exe
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:1312
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c sotema_4.exe
                                                                                                                                        4⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                        PID:524
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_4.exe
                                                                                                                                          sotema_4.exe
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:1612
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                            6⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:1892
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                            6⤵
                                                                                                                                              PID:188
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sotema_5.exe
                                                                                                                                          4⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:768
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_5.exe
                                                                                                                                            sotema_5.exe
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:1756
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c sotema_6.exe
                                                                                                                                          4⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:856
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_6.exe
                                                                                                                                            sotema_6.exe
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:928
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\4612800.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\4612800.exe"
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:1284
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\7290630.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\7290630.exe"
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              PID:2040
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:2528
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\6147862.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\6147862.exe"
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Modifies system certificate store
                                                                                                                                              PID:1324
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\8965471.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\8965471.exe"
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1124
                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                "C:\Windows\System32\reg.exe" add "hkcu\software\microsoft\windows\currentversion\run" /v "David Brown" /d "C:\Users\Admin\AppData\Roaming\David Brown\Godvnlup.exe" /f
                                                                                                                                                7⤵
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                PID:2132
                                                                                                                                              • C:\Windows\System32\shutdown.exe
                                                                                                                                                "C:\Windows\System32\shutdown.exe" -r -f -t 00
                                                                                                                                                7⤵
                                                                                                                                                  PID:2232
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c sotema_8.exe
                                                                                                                                            4⤵
                                                                                                                                              PID:1604
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c sotema_9.exe
                                                                                                                                              4⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:924
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                                sotema_9.exe
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                PID:1600
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                                  6⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  PID:1552
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c sotema_7.exe
                                                                                                                                              4⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:944
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-R82OC.tmp\sotema_5.tmp
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-R82OC.tmp\sotema_5.tmp" /SL5="$4012E,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_5.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:1776
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-HDLM9.tmp\JFHGSFGSIUGFSUIG.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-HDLM9.tmp\JFHGSFGSIUGFSUIG.exe" /S /UID=burnerch2
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1784
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_7.exe
                                                                                                                                        sotema_7.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:900
                                                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                                                        "LogonUI.exe" /flags:0x0
                                                                                                                                        1⤵
                                                                                                                                          PID:2388

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                        Persistence

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1060

                                                                                                                                        Defense Evasion

                                                                                                                                        Modify Registry

                                                                                                                                        2
                                                                                                                                        T1112

                                                                                                                                        Install Root Certificate

                                                                                                                                        1
                                                                                                                                        T1130

                                                                                                                                        Discovery

                                                                                                                                        System Information Discovery

                                                                                                                                        3
                                                                                                                                        T1082

                                                                                                                                        Query Registry

                                                                                                                                        2
                                                                                                                                        T1012

                                                                                                                                        Peripheral Device Discovery

                                                                                                                                        1
                                                                                                                                        T1120

                                                                                                                                        Command and Control

                                                                                                                                        Web Service

                                                                                                                                        1
                                                                                                                                        T1102

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\libcurl.dll
                                                                                                                                          MD5

                                                                                                                                          d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                          SHA1

                                                                                                                                          028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                          SHA256

                                                                                                                                          0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                          SHA512

                                                                                                                                          857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\libcurlpp.dll
                                                                                                                                          MD5

                                                                                                                                          e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                          SHA1

                                                                                                                                          b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                          SHA256

                                                                                                                                          43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                          SHA512

                                                                                                                                          9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\libgcc_s_dw2-1.dll
                                                                                                                                          MD5

                                                                                                                                          9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                          SHA1

                                                                                                                                          64264300801a353db324d11738ffed876550e1d3

                                                                                                                                          SHA256

                                                                                                                                          59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                          SHA512

                                                                                                                                          0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\libstdc++-6.dll
                                                                                                                                          MD5

                                                                                                                                          5e279950775baae5fea04d2cc4526bcc

                                                                                                                                          SHA1

                                                                                                                                          8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                          SHA256

                                                                                                                                          97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                          SHA512

                                                                                                                                          666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\libwinpthread-1.dll
                                                                                                                                          MD5

                                                                                                                                          1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                          SHA1

                                                                                                                                          fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                          SHA256

                                                                                                                                          509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                          SHA512

                                                                                                                                          3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_1.exe
                                                                                                                                          MD5

                                                                                                                                          6e487aa1b2d2b9ef05073c11572925f2

                                                                                                                                          SHA1

                                                                                                                                          b2b58a554b75029cd8bdf5ffd012611b1bfe430b

                                                                                                                                          SHA256

                                                                                                                                          77eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597

                                                                                                                                          SHA512

                                                                                                                                          b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_1.txt
                                                                                                                                          MD5

                                                                                                                                          6e487aa1b2d2b9ef05073c11572925f2

                                                                                                                                          SHA1

                                                                                                                                          b2b58a554b75029cd8bdf5ffd012611b1bfe430b

                                                                                                                                          SHA256

                                                                                                                                          77eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597

                                                                                                                                          SHA512

                                                                                                                                          b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_2.exe
                                                                                                                                          MD5

                                                                                                                                          f66da6e8da0511113af4d902350a0dfb

                                                                                                                                          SHA1

                                                                                                                                          33f2af62b47a992dd8fa793420942f3ed7f905dc

                                                                                                                                          SHA256

                                                                                                                                          c320eb412a415d869030e0aa3a5a25c17d34d198ab1b4404ffb9deaf3b4e2a5f

                                                                                                                                          SHA512

                                                                                                                                          eef1cad0b2380a065c44307a08e1742da11d467a21492a4cd1dcc0aec10ef8cd79fcf2d7f7f413edeb8ab484fc1262ed593abdb09d7f56f6f4f29b0f9f3d40e5

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_2.txt
                                                                                                                                          MD5

                                                                                                                                          f66da6e8da0511113af4d902350a0dfb

                                                                                                                                          SHA1

                                                                                                                                          33f2af62b47a992dd8fa793420942f3ed7f905dc

                                                                                                                                          SHA256

                                                                                                                                          c320eb412a415d869030e0aa3a5a25c17d34d198ab1b4404ffb9deaf3b4e2a5f

                                                                                                                                          SHA512

                                                                                                                                          eef1cad0b2380a065c44307a08e1742da11d467a21492a4cd1dcc0aec10ef8cd79fcf2d7f7f413edeb8ab484fc1262ed593abdb09d7f56f6f4f29b0f9f3d40e5

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_3.exe
                                                                                                                                          MD5

                                                                                                                                          5b41f469c10147f4203de9ccf153ffab

                                                                                                                                          SHA1

                                                                                                                                          bd2829615c350b5856b73242232df0e43c1b93bf

                                                                                                                                          SHA256

                                                                                                                                          803b50725bf88f35f41ead18c55dbb57d30ada81e3ce63757505fce5efb60140

                                                                                                                                          SHA512

                                                                                                                                          465d58c448b4fca450eb7d69d2c2d953b85bab6d176378f5caa7dac0017dcecb66db65d5c1b1fefbe80bbccb05981c6b2328ef1dfc5d5c33a6d9a243df938ca6

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_3.txt
                                                                                                                                          MD5

                                                                                                                                          5b41f469c10147f4203de9ccf153ffab

                                                                                                                                          SHA1

                                                                                                                                          bd2829615c350b5856b73242232df0e43c1b93bf

                                                                                                                                          SHA256

                                                                                                                                          803b50725bf88f35f41ead18c55dbb57d30ada81e3ce63757505fce5efb60140

                                                                                                                                          SHA512

                                                                                                                                          465d58c448b4fca450eb7d69d2c2d953b85bab6d176378f5caa7dac0017dcecb66db65d5c1b1fefbe80bbccb05981c6b2328ef1dfc5d5c33a6d9a243df938ca6

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_4.exe
                                                                                                                                          MD5

                                                                                                                                          5668cb771643274ba2c375ec6403c266

                                                                                                                                          SHA1

                                                                                                                                          dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                          SHA256

                                                                                                                                          d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                          SHA512

                                                                                                                                          135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_4.txt
                                                                                                                                          MD5

                                                                                                                                          5668cb771643274ba2c375ec6403c266

                                                                                                                                          SHA1

                                                                                                                                          dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                          SHA256

                                                                                                                                          d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                          SHA512

                                                                                                                                          135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_5.exe
                                                                                                                                          MD5

                                                                                                                                          8c4df9d37195987ede03bf8adb495686

                                                                                                                                          SHA1

                                                                                                                                          010626025ca791720f85984a842c893b78f439d2

                                                                                                                                          SHA256

                                                                                                                                          5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                          SHA512

                                                                                                                                          8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_5.txt
                                                                                                                                          MD5

                                                                                                                                          8c4df9d37195987ede03bf8adb495686

                                                                                                                                          SHA1

                                                                                                                                          010626025ca791720f85984a842c893b78f439d2

                                                                                                                                          SHA256

                                                                                                                                          5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                          SHA512

                                                                                                                                          8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_6.exe
                                                                                                                                          MD5

                                                                                                                                          f00d26715ea4204e39ac326f5fe7d02f

                                                                                                                                          SHA1

                                                                                                                                          fdd1cb88e7bf740ac4828680ec148b26d94a8d90

                                                                                                                                          SHA256

                                                                                                                                          2eaa130a8eb6598a51f8a98ef4603773414771664082b93a7489432c663d9de3

                                                                                                                                          SHA512

                                                                                                                                          5cae1b110f065d6ee179eb6431bcbf36b84ba5d053e05bbdc0ae1ebcb5584be1780003ad183c3d3fba1951e1c1881d51f46fb41087fec74a9ee9bde704ee9caa

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_6.txt
                                                                                                                                          MD5

                                                                                                                                          f00d26715ea4204e39ac326f5fe7d02f

                                                                                                                                          SHA1

                                                                                                                                          fdd1cb88e7bf740ac4828680ec148b26d94a8d90

                                                                                                                                          SHA256

                                                                                                                                          2eaa130a8eb6598a51f8a98ef4603773414771664082b93a7489432c663d9de3

                                                                                                                                          SHA512

                                                                                                                                          5cae1b110f065d6ee179eb6431bcbf36b84ba5d053e05bbdc0ae1ebcb5584be1780003ad183c3d3fba1951e1c1881d51f46fb41087fec74a9ee9bde704ee9caa

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_7.exe
                                                                                                                                          MD5

                                                                                                                                          a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                          SHA1

                                                                                                                                          7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                          SHA256

                                                                                                                                          c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                          SHA512

                                                                                                                                          2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_7.txt
                                                                                                                                          MD5

                                                                                                                                          a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                          SHA1

                                                                                                                                          7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                          SHA256

                                                                                                                                          c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                          SHA512

                                                                                                                                          2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_8.txt
                                                                                                                                          MD5

                                                                                                                                          27d0e919bf3cabada69daf9e1ce05f21

                                                                                                                                          SHA1

                                                                                                                                          13d2adc3fa9cd72f5228fe2f75db407fe0ec8bbf

                                                                                                                                          SHA256

                                                                                                                                          4cda72edadc15097c758dd5eb3bd5c6d66bb206672bafbe2ed9e57d5dd1c21f5

                                                                                                                                          SHA512

                                                                                                                                          af3953f0f4d2b06f5ba0f6cc8a89ce5775d2f2c7ee551afb3c895a2dd7ce69d14ce80ce4b1185e834570387b6334d3c3a5b83ba53e36ceee7656fd9e03bc6e9c

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                          MD5

                                                                                                                                          b189061476b1ba11e31db9e3bbfe98e2

                                                                                                                                          SHA1

                                                                                                                                          c429646ce666aabb42b372e80898c4874b7c3090

                                                                                                                                          SHA256

                                                                                                                                          b176236b8b45c7d80560b784945d43fa7710ad197db64843673d0df33caaa69b

                                                                                                                                          SHA512

                                                                                                                                          d13305f9ce2673329a0510085a047790498fc8b93943503868aba8e923fc1f808aa65f05f9b00357b08fc180bc01c059ac9682798efaafe9e01ef26c246b2571

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.txt
                                                                                                                                          MD5

                                                                                                                                          b189061476b1ba11e31db9e3bbfe98e2

                                                                                                                                          SHA1

                                                                                                                                          c429646ce666aabb42b372e80898c4874b7c3090

                                                                                                                                          SHA256

                                                                                                                                          b176236b8b45c7d80560b784945d43fa7710ad197db64843673d0df33caaa69b

                                                                                                                                          SHA512

                                                                                                                                          d13305f9ce2673329a0510085a047790498fc8b93943503868aba8e923fc1f808aa65f05f9b00357b08fc180bc01c059ac9682798efaafe9e01ef26c246b2571

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-R82OC.tmp\sotema_5.tmp
                                                                                                                                          MD5

                                                                                                                                          ace50bc58251a21ff708c2a45b166905

                                                                                                                                          SHA1

                                                                                                                                          3acac0fbed800fe76722b781b7add2cbb7510849

                                                                                                                                          SHA256

                                                                                                                                          af5dd65e23533ed506a34f3a98f1255fccb480c88615ed7cfd0c157fb3f21f9d

                                                                                                                                          SHA512

                                                                                                                                          b484af4387dc5f149b785db515521e10f6a9047cd838130f45745dac000c822766a163c8e988d3763a1a79e93b7436c8cb0ba5cb38e175b8e49b523677746514

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-R82OC.tmp\sotema_5.tmp
                                                                                                                                          MD5

                                                                                                                                          ace50bc58251a21ff708c2a45b166905

                                                                                                                                          SHA1

                                                                                                                                          3acac0fbed800fe76722b781b7add2cbb7510849

                                                                                                                                          SHA256

                                                                                                                                          af5dd65e23533ed506a34f3a98f1255fccb480c88615ed7cfd0c157fb3f21f9d

                                                                                                                                          SHA512

                                                                                                                                          b484af4387dc5f149b785db515521e10f6a9047cd838130f45745dac000c822766a163c8e988d3763a1a79e93b7436c8cb0ba5cb38e175b8e49b523677746514

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\libcurl.dll
                                                                                                                                          MD5

                                                                                                                                          d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                          SHA1

                                                                                                                                          028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                          SHA256

                                                                                                                                          0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                          SHA512

                                                                                                                                          857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\libcurlpp.dll
                                                                                                                                          MD5

                                                                                                                                          e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                          SHA1

                                                                                                                                          b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                          SHA256

                                                                                                                                          43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                          SHA512

                                                                                                                                          9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\libgcc_s_dw2-1.dll
                                                                                                                                          MD5

                                                                                                                                          9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                          SHA1

                                                                                                                                          64264300801a353db324d11738ffed876550e1d3

                                                                                                                                          SHA256

                                                                                                                                          59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                          SHA512

                                                                                                                                          0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\libstdc++-6.dll
                                                                                                                                          MD5

                                                                                                                                          5e279950775baae5fea04d2cc4526bcc

                                                                                                                                          SHA1

                                                                                                                                          8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                          SHA256

                                                                                                                                          97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                          SHA512

                                                                                                                                          666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\libwinpthread-1.dll
                                                                                                                                          MD5

                                                                                                                                          1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                          SHA1

                                                                                                                                          fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                          SHA256

                                                                                                                                          509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                          SHA512

                                                                                                                                          3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\setup_install.exe
                                                                                                                                          MD5

                                                                                                                                          8c34c209cefe8f8685a45658050ac7a6

                                                                                                                                          SHA1

                                                                                                                                          10ba9966cb0c37f3bdfdef2a955082530e0afb08

                                                                                                                                          SHA256

                                                                                                                                          3748d8875fa4d5c0bcdfb5623bab3338497516a3999859125d976c84f76532d0

                                                                                                                                          SHA512

                                                                                                                                          5a1b0c125cf63ca0fd90f264a0182abe8ab88f1282e49346b1676c4f6827270a4d93a3ef61875499218ef70469e394ffd1b1f4190a453b8ebe071dcc3f818bcf

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_1.exe
                                                                                                                                          MD5

                                                                                                                                          6e487aa1b2d2b9ef05073c11572925f2

                                                                                                                                          SHA1

                                                                                                                                          b2b58a554b75029cd8bdf5ffd012611b1bfe430b

                                                                                                                                          SHA256

                                                                                                                                          77eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597

                                                                                                                                          SHA512

                                                                                                                                          b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_1.exe
                                                                                                                                          MD5

                                                                                                                                          6e487aa1b2d2b9ef05073c11572925f2

                                                                                                                                          SHA1

                                                                                                                                          b2b58a554b75029cd8bdf5ffd012611b1bfe430b

                                                                                                                                          SHA256

                                                                                                                                          77eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597

                                                                                                                                          SHA512

                                                                                                                                          b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_1.exe
                                                                                                                                          MD5

                                                                                                                                          6e487aa1b2d2b9ef05073c11572925f2

                                                                                                                                          SHA1

                                                                                                                                          b2b58a554b75029cd8bdf5ffd012611b1bfe430b

                                                                                                                                          SHA256

                                                                                                                                          77eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597

                                                                                                                                          SHA512

                                                                                                                                          b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_2.exe
                                                                                                                                          MD5

                                                                                                                                          f66da6e8da0511113af4d902350a0dfb

                                                                                                                                          SHA1

                                                                                                                                          33f2af62b47a992dd8fa793420942f3ed7f905dc

                                                                                                                                          SHA256

                                                                                                                                          c320eb412a415d869030e0aa3a5a25c17d34d198ab1b4404ffb9deaf3b4e2a5f

                                                                                                                                          SHA512

                                                                                                                                          eef1cad0b2380a065c44307a08e1742da11d467a21492a4cd1dcc0aec10ef8cd79fcf2d7f7f413edeb8ab484fc1262ed593abdb09d7f56f6f4f29b0f9f3d40e5

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_2.exe
                                                                                                                                          MD5

                                                                                                                                          f66da6e8da0511113af4d902350a0dfb

                                                                                                                                          SHA1

                                                                                                                                          33f2af62b47a992dd8fa793420942f3ed7f905dc

                                                                                                                                          SHA256

                                                                                                                                          c320eb412a415d869030e0aa3a5a25c17d34d198ab1b4404ffb9deaf3b4e2a5f

                                                                                                                                          SHA512

                                                                                                                                          eef1cad0b2380a065c44307a08e1742da11d467a21492a4cd1dcc0aec10ef8cd79fcf2d7f7f413edeb8ab484fc1262ed593abdb09d7f56f6f4f29b0f9f3d40e5

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_2.exe
                                                                                                                                          MD5

                                                                                                                                          f66da6e8da0511113af4d902350a0dfb

                                                                                                                                          SHA1

                                                                                                                                          33f2af62b47a992dd8fa793420942f3ed7f905dc

                                                                                                                                          SHA256

                                                                                                                                          c320eb412a415d869030e0aa3a5a25c17d34d198ab1b4404ffb9deaf3b4e2a5f

                                                                                                                                          SHA512

                                                                                                                                          eef1cad0b2380a065c44307a08e1742da11d467a21492a4cd1dcc0aec10ef8cd79fcf2d7f7f413edeb8ab484fc1262ed593abdb09d7f56f6f4f29b0f9f3d40e5

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_2.exe
                                                                                                                                          MD5

                                                                                                                                          f66da6e8da0511113af4d902350a0dfb

                                                                                                                                          SHA1

                                                                                                                                          33f2af62b47a992dd8fa793420942f3ed7f905dc

                                                                                                                                          SHA256

                                                                                                                                          c320eb412a415d869030e0aa3a5a25c17d34d198ab1b4404ffb9deaf3b4e2a5f

                                                                                                                                          SHA512

                                                                                                                                          eef1cad0b2380a065c44307a08e1742da11d467a21492a4cd1dcc0aec10ef8cd79fcf2d7f7f413edeb8ab484fc1262ed593abdb09d7f56f6f4f29b0f9f3d40e5

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_3.exe
                                                                                                                                          MD5

                                                                                                                                          5b41f469c10147f4203de9ccf153ffab

                                                                                                                                          SHA1

                                                                                                                                          bd2829615c350b5856b73242232df0e43c1b93bf

                                                                                                                                          SHA256

                                                                                                                                          803b50725bf88f35f41ead18c55dbb57d30ada81e3ce63757505fce5efb60140

                                                                                                                                          SHA512

                                                                                                                                          465d58c448b4fca450eb7d69d2c2d953b85bab6d176378f5caa7dac0017dcecb66db65d5c1b1fefbe80bbccb05981c6b2328ef1dfc5d5c33a6d9a243df938ca6

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_3.exe
                                                                                                                                          MD5

                                                                                                                                          5b41f469c10147f4203de9ccf153ffab

                                                                                                                                          SHA1

                                                                                                                                          bd2829615c350b5856b73242232df0e43c1b93bf

                                                                                                                                          SHA256

                                                                                                                                          803b50725bf88f35f41ead18c55dbb57d30ada81e3ce63757505fce5efb60140

                                                                                                                                          SHA512

                                                                                                                                          465d58c448b4fca450eb7d69d2c2d953b85bab6d176378f5caa7dac0017dcecb66db65d5c1b1fefbe80bbccb05981c6b2328ef1dfc5d5c33a6d9a243df938ca6

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_3.exe
                                                                                                                                          MD5

                                                                                                                                          5b41f469c10147f4203de9ccf153ffab

                                                                                                                                          SHA1

                                                                                                                                          bd2829615c350b5856b73242232df0e43c1b93bf

                                                                                                                                          SHA256

                                                                                                                                          803b50725bf88f35f41ead18c55dbb57d30ada81e3ce63757505fce5efb60140

                                                                                                                                          SHA512

                                                                                                                                          465d58c448b4fca450eb7d69d2c2d953b85bab6d176378f5caa7dac0017dcecb66db65d5c1b1fefbe80bbccb05981c6b2328ef1dfc5d5c33a6d9a243df938ca6

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_3.exe
                                                                                                                                          MD5

                                                                                                                                          5b41f469c10147f4203de9ccf153ffab

                                                                                                                                          SHA1

                                                                                                                                          bd2829615c350b5856b73242232df0e43c1b93bf

                                                                                                                                          SHA256

                                                                                                                                          803b50725bf88f35f41ead18c55dbb57d30ada81e3ce63757505fce5efb60140

                                                                                                                                          SHA512

                                                                                                                                          465d58c448b4fca450eb7d69d2c2d953b85bab6d176378f5caa7dac0017dcecb66db65d5c1b1fefbe80bbccb05981c6b2328ef1dfc5d5c33a6d9a243df938ca6

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_4.exe
                                                                                                                                          MD5

                                                                                                                                          5668cb771643274ba2c375ec6403c266

                                                                                                                                          SHA1

                                                                                                                                          dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                          SHA256

                                                                                                                                          d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                          SHA512

                                                                                                                                          135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_4.exe
                                                                                                                                          MD5

                                                                                                                                          5668cb771643274ba2c375ec6403c266

                                                                                                                                          SHA1

                                                                                                                                          dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                          SHA256

                                                                                                                                          d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                          SHA512

                                                                                                                                          135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_4.exe
                                                                                                                                          MD5

                                                                                                                                          5668cb771643274ba2c375ec6403c266

                                                                                                                                          SHA1

                                                                                                                                          dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                          SHA256

                                                                                                                                          d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                          SHA512

                                                                                                                                          135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_5.exe
                                                                                                                                          MD5

                                                                                                                                          8c4df9d37195987ede03bf8adb495686

                                                                                                                                          SHA1

                                                                                                                                          010626025ca791720f85984a842c893b78f439d2

                                                                                                                                          SHA256

                                                                                                                                          5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                          SHA512

                                                                                                                                          8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_5.exe
                                                                                                                                          MD5

                                                                                                                                          8c4df9d37195987ede03bf8adb495686

                                                                                                                                          SHA1

                                                                                                                                          010626025ca791720f85984a842c893b78f439d2

                                                                                                                                          SHA256

                                                                                                                                          5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                          SHA512

                                                                                                                                          8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_5.exe
                                                                                                                                          MD5

                                                                                                                                          8c4df9d37195987ede03bf8adb495686

                                                                                                                                          SHA1

                                                                                                                                          010626025ca791720f85984a842c893b78f439d2

                                                                                                                                          SHA256

                                                                                                                                          5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                          SHA512

                                                                                                                                          8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_6.exe
                                                                                                                                          MD5

                                                                                                                                          f00d26715ea4204e39ac326f5fe7d02f

                                                                                                                                          SHA1

                                                                                                                                          fdd1cb88e7bf740ac4828680ec148b26d94a8d90

                                                                                                                                          SHA256

                                                                                                                                          2eaa130a8eb6598a51f8a98ef4603773414771664082b93a7489432c663d9de3

                                                                                                                                          SHA512

                                                                                                                                          5cae1b110f065d6ee179eb6431bcbf36b84ba5d053e05bbdc0ae1ebcb5584be1780003ad183c3d3fba1951e1c1881d51f46fb41087fec74a9ee9bde704ee9caa

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_7.exe
                                                                                                                                          MD5

                                                                                                                                          a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                          SHA1

                                                                                                                                          7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                          SHA256

                                                                                                                                          c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                          SHA512

                                                                                                                                          2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_7.exe
                                                                                                                                          MD5

                                                                                                                                          a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                          SHA1

                                                                                                                                          7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                          SHA256

                                                                                                                                          c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                          SHA512

                                                                                                                                          2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_7.exe
                                                                                                                                          MD5

                                                                                                                                          a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                          SHA1

                                                                                                                                          7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                          SHA256

                                                                                                                                          c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                          SHA512

                                                                                                                                          2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                          MD5

                                                                                                                                          b189061476b1ba11e31db9e3bbfe98e2

                                                                                                                                          SHA1

                                                                                                                                          c429646ce666aabb42b372e80898c4874b7c3090

                                                                                                                                          SHA256

                                                                                                                                          b176236b8b45c7d80560b784945d43fa7710ad197db64843673d0df33caaa69b

                                                                                                                                          SHA512

                                                                                                                                          d13305f9ce2673329a0510085a047790498fc8b93943503868aba8e923fc1f808aa65f05f9b00357b08fc180bc01c059ac9682798efaafe9e01ef26c246b2571

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                          MD5

                                                                                                                                          b189061476b1ba11e31db9e3bbfe98e2

                                                                                                                                          SHA1

                                                                                                                                          c429646ce666aabb42b372e80898c4874b7c3090

                                                                                                                                          SHA256

                                                                                                                                          b176236b8b45c7d80560b784945d43fa7710ad197db64843673d0df33caaa69b

                                                                                                                                          SHA512

                                                                                                                                          d13305f9ce2673329a0510085a047790498fc8b93943503868aba8e923fc1f808aa65f05f9b00357b08fc180bc01c059ac9682798efaafe9e01ef26c246b2571

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                          MD5

                                                                                                                                          b189061476b1ba11e31db9e3bbfe98e2

                                                                                                                                          SHA1

                                                                                                                                          c429646ce666aabb42b372e80898c4874b7c3090

                                                                                                                                          SHA256

                                                                                                                                          b176236b8b45c7d80560b784945d43fa7710ad197db64843673d0df33caaa69b

                                                                                                                                          SHA512

                                                                                                                                          d13305f9ce2673329a0510085a047790498fc8b93943503868aba8e923fc1f808aa65f05f9b00357b08fc180bc01c059ac9682798efaafe9e01ef26c246b2571

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\7zS88694054\sotema_9.exe
                                                                                                                                          MD5

                                                                                                                                          b189061476b1ba11e31db9e3bbfe98e2

                                                                                                                                          SHA1

                                                                                                                                          c429646ce666aabb42b372e80898c4874b7c3090

                                                                                                                                          SHA256

                                                                                                                                          b176236b8b45c7d80560b784945d43fa7710ad197db64843673d0df33caaa69b

                                                                                                                                          SHA512

                                                                                                                                          d13305f9ce2673329a0510085a047790498fc8b93943503868aba8e923fc1f808aa65f05f9b00357b08fc180bc01c059ac9682798efaafe9e01ef26c246b2571

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                                                                                          MD5

                                                                                                                                          d124f55b9393c976963407dff51ffa79

                                                                                                                                          SHA1

                                                                                                                                          2c7bbedd79791bfb866898c85b504186db610b5d

                                                                                                                                          SHA256

                                                                                                                                          ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                                                                                                                                          SHA512

                                                                                                                                          278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                                                                                                                                        • \Users\Admin\AppData\Local\Temp\is-R82OC.tmp\sotema_5.tmp
                                                                                                                                          MD5

                                                                                                                                          ace50bc58251a21ff708c2a45b166905

                                                                                                                                          SHA1

                                                                                                                                          3acac0fbed800fe76722b781b7add2cbb7510849

                                                                                                                                          SHA256

                                                                                                                                          af5dd65e23533ed506a34f3a98f1255fccb480c88615ed7cfd0c157fb3f21f9d

                                                                                                                                          SHA512

                                                                                                                                          b484af4387dc5f149b785db515521e10f6a9047cd838130f45745dac000c822766a163c8e988d3763a1a79e93b7436c8cb0ba5cb38e175b8e49b523677746514

                                                                                                                                        • memory/188-291-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/524-106-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/768-108-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/856-110-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/872-227-0x0000000000800000-0x000000000084C000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          304KB

                                                                                                                                        • memory/872-228-0x0000000001810000-0x0000000001881000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          452KB

                                                                                                                                        • memory/900-137-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/904-294-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/924-271-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/924-120-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/928-146-0x00000000010C0000-0x00000000010C1000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/928-203-0x000000001AF50000-0x000000001AF52000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/928-190-0x0000000000340000-0x0000000000341000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/928-194-0x0000000000370000-0x0000000000371000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/928-132-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/928-191-0x0000000000350000-0x0000000000370000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                        • memory/944-115-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1124-216-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/1124-205-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1172-104-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1180-192-0x0000000003BB0000-0x0000000003BC5000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          84KB

                                                                                                                                        • memory/1224-186-0x00000000022A0000-0x00000000023A1000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.0MB

                                                                                                                                        • memory/1224-187-0x0000000000510000-0x000000000056D000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          372KB

                                                                                                                                        • memory/1224-184-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1248-101-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1284-195-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1284-199-0x00000000009A0000-0x00000000009A1000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1284-204-0x0000000000A90000-0x0000000000A91000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1284-206-0x0000000000300000-0x000000000032D000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          180KB

                                                                                                                                        • memory/1312-180-0x0000000000350000-0x00000000003ED000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          628KB

                                                                                                                                        • memory/1312-183-0x0000000000400000-0x0000000000636000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          2.2MB

                                                                                                                                        • memory/1312-128-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1324-214-0x0000000000D70000-0x0000000000D71000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1324-102-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1324-222-0x0000000000710000-0x000000000074F000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          252KB

                                                                                                                                        • memory/1324-201-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1324-225-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1444-114-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1444-177-0x0000000000340000-0x0000000000349000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          36KB

                                                                                                                                        • memory/1444-179-0x0000000000400000-0x00000000005DA000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.9MB

                                                                                                                                        • memory/1452-297-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/1552-212-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                        • memory/1552-210-0x0000000000417E3A-mapping.dmp
                                                                                                                                        • memory/1552-217-0x0000000000590000-0x0000000000591000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1552-209-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                        • memory/1600-178-0x0000000000100000-0x0000000000101000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1600-149-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1600-193-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1604-119-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1612-117-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1672-59-0x0000000075211000-0x0000000075213000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/1756-141-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1756-167-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          436KB

                                                                                                                                        • memory/1776-182-0x0000000000280000-0x0000000000281000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1776-172-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1784-207-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1784-208-0x0000000000B40000-0x0000000000B42000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/1892-188-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1932-284-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/1980-130-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1996-85-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          152KB

                                                                                                                                        • memory/1996-83-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/1996-80-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          572KB

                                                                                                                                        • memory/1996-82-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/1996-63-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/1996-84-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          152KB

                                                                                                                                        • memory/1996-90-0x0000000000400000-0x000000000051E000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.1MB

                                                                                                                                        • memory/1996-88-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          572KB

                                                                                                                                        • memory/1996-86-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/1996-89-0x0000000000400000-0x000000000051E000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.1MB

                                                                                                                                        • memory/1996-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.5MB

                                                                                                                                        • memory/1996-87-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/1996-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.5MB

                                                                                                                                        • memory/2040-223-0x00000000003A0000-0x00000000003B0000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/2040-230-0x00000000003B0000-0x00000000003B1000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2040-226-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2040-221-0x0000000000390000-0x0000000000391000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2040-197-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/2040-215-0x0000000000F40000-0x0000000000F41000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2116-295-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2132-220-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/2144-272-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2164-274-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2172-273-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2232-290-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2232-224-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/2236-289-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2256-287-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2264-229-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2264-233-0x00000000004A0000-0x0000000000511000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          452KB

                                                                                                                                        • memory/2292-288-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2388-243-0x0000000002900000-0x0000000002901000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2412-292-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2528-236-0x0000000000A80000-0x0000000000A81000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2528-244-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2528-234-0x0000000000000000-mapping.dmp
                                                                                                                                        • memory/2544-305-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2588-306-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2720-241-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2796-242-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2824-247-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2860-248-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2872-249-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2884-250-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2900-251-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2912-252-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2924-253-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2936-255-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/2960-259-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/3000-265-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/3012-266-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/3024-267-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/3036-268-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/3056-269-0x00000000FF0E246C-mapping.dmp
                                                                                                                                        • memory/3068-270-0x00000000FF0E246C-mapping.dmp