Analysis
-
max time kernel
12s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
08-07-2021 12:01
Static task
static1
Behavioral task
behavioral1
Sample
F487F870FDF6550C4CA3241481FD49DC.exe
Resource
win7v20210410
General
-
Target
F487F870FDF6550C4CA3241481FD49DC.exe
-
Size
3.7MB
-
MD5
f487f870fdf6550c4ca3241481fd49dc
-
SHA1
f5f4a37e432c551b67508a74861e2f6e70ec2d4d
-
SHA256
b138c67994648f1784c8263e0af703662e2bd8e55d9d8a1189dcf243f2bff657
-
SHA512
6e5d57fdbe36492955df7b50ab40b7a1466cd225126eabbd36cebbdb1696e7bd560e1728cf2b697861b5c59be58bab6f1f4f868c00ef32b38e4fa4d84fb3bb6f
Malware Config
Extracted
redline
Cana
176.111.174.254:56328
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1372 2780 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-191-0x00000000009C0000-0x00000000009DB000-memory.dmp family_redline behavioral1/memory/2020-198-0x0000000002270000-0x0000000002289000-memory.dmp family_redline behavioral1/memory/2252-236-0x0000000000400000-0x0000000000438000-memory.dmp family_redline behavioral1/memory/2308-262-0x0000000000417E9E-mapping.dmp family_redline behavioral1/memory/2072-282-0x0000000000417E22-mapping.dmp family_redline behavioral1/memory/1652-285-0x0000000000417E8A-mapping.dmp family_redline behavioral1/memory/1396-266-0x0000000000417E8E-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 15 IoCs
Processes:
setup_installer.exesetup_install.exesonia_2.exesonia_4.exesonia_5.exesonia_1.exesonia_6.exesonia_7.exesonia_9.exesonia_10.exesonia_8.exesonia_5.tmpjfiag3g_gg.exeTXO4drQ58aMe70ZUYgdyIbyP.exejIfucVNNZvU19BtyQYplpXMv.exepid process 1564 setup_installer.exe 1956 setup_install.exe 320 sonia_2.exe 1368 sonia_4.exe 436 sonia_5.exe 1116 sonia_1.exe 924 sonia_6.exe 1900 sonia_7.exe 2016 sonia_9.exe 1548 sonia_10.exe 2020 sonia_8.exe 1880 sonia_5.tmp 1780 jfiag3g_gg.exe 772 TXO4drQ58aMe70ZUYgdyIbyP.exe 2052 jIfucVNNZvU19BtyQYplpXMv.exe -
Loads dropped DLL 50 IoCs
Processes:
F487F870FDF6550C4CA3241481FD49DC.exesetup_installer.exesetup_install.execmd.execmd.exesonia_2.execmd.execmd.exesonia_4.execmd.execmd.exesonia_5.execmd.execmd.execmd.exesonia_7.exesonia_9.exesonia_8.exesonia_5.tmpjfiag3g_gg.exeTXO4drQ58aMe70ZUYgdyIbyP.exesonia_10.exepid process 2020 F487F870FDF6550C4CA3241481FD49DC.exe 1564 setup_installer.exe 1564 setup_installer.exe 1564 setup_installer.exe 1564 setup_installer.exe 1564 setup_installer.exe 1564 setup_installer.exe 1956 setup_install.exe 1956 setup_install.exe 1956 setup_install.exe 1956 setup_install.exe 1956 setup_install.exe 1956 setup_install.exe 1956 setup_install.exe 1956 setup_install.exe 1080 cmd.exe 1080 cmd.exe 980 cmd.exe 320 sonia_2.exe 320 sonia_2.exe 604 cmd.exe 1520 cmd.exe 1368 sonia_4.exe 1368 sonia_4.exe 1540 cmd.exe 992 cmd.exe 436 sonia_5.exe 436 sonia_5.exe 1096 cmd.exe 1056 cmd.exe 1516 cmd.exe 1516 cmd.exe 1900 sonia_7.exe 1900 sonia_7.exe 2016 sonia_9.exe 2016 sonia_9.exe 436 sonia_5.exe 2020 sonia_8.exe 2020 sonia_8.exe 1880 sonia_5.tmp 1880 sonia_5.tmp 1880 sonia_5.tmp 320 sonia_2.exe 1368 sonia_4.exe 1368 sonia_4.exe 1780 jfiag3g_gg.exe 1780 jfiag3g_gg.exe 772 TXO4drQ58aMe70ZUYgdyIbyP.exe 772 TXO4drQ58aMe70ZUYgdyIbyP.exe 1548 sonia_10.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com 212 ip-api.com 274 ipinfo.io 276 ipinfo.io 2 ipinfo.io 5 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sonia_2.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 2604 timeout.exe 3992 timeout.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 2460 taskkill.exe 3368 taskkill.exe 3692 taskkill.exe -
Processes:
sonia_10.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 sonia_10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sonia_10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C sonia_10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 sonia_10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 sonia_10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_10.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_10.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 275 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 280 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
sonia_2.exepid process 320 sonia_2.exe 320 sonia_2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sonia_10.exesonia_6.exedescription pid process Token: SeDebugPrivilege 1548 sonia_10.exe Token: SeDebugPrivilege 924 sonia_6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
F487F870FDF6550C4CA3241481FD49DC.exesetup_installer.exesetup_install.execmd.exedescription pid process target process PID 2020 wrote to memory of 1564 2020 F487F870FDF6550C4CA3241481FD49DC.exe setup_installer.exe PID 2020 wrote to memory of 1564 2020 F487F870FDF6550C4CA3241481FD49DC.exe setup_installer.exe PID 2020 wrote to memory of 1564 2020 F487F870FDF6550C4CA3241481FD49DC.exe setup_installer.exe PID 2020 wrote to memory of 1564 2020 F487F870FDF6550C4CA3241481FD49DC.exe setup_installer.exe PID 2020 wrote to memory of 1564 2020 F487F870FDF6550C4CA3241481FD49DC.exe setup_installer.exe PID 2020 wrote to memory of 1564 2020 F487F870FDF6550C4CA3241481FD49DC.exe setup_installer.exe PID 2020 wrote to memory of 1564 2020 F487F870FDF6550C4CA3241481FD49DC.exe setup_installer.exe PID 1564 wrote to memory of 1956 1564 setup_installer.exe setup_install.exe PID 1564 wrote to memory of 1956 1564 setup_installer.exe setup_install.exe PID 1564 wrote to memory of 1956 1564 setup_installer.exe setup_install.exe PID 1564 wrote to memory of 1956 1564 setup_installer.exe setup_install.exe PID 1564 wrote to memory of 1956 1564 setup_installer.exe setup_install.exe PID 1564 wrote to memory of 1956 1564 setup_installer.exe setup_install.exe PID 1564 wrote to memory of 1956 1564 setup_installer.exe setup_install.exe PID 1956 wrote to memory of 604 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 604 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 604 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 604 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 604 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 604 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 604 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1080 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1080 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1080 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1080 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1080 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1080 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1080 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 2004 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 2004 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 2004 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 2004 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 2004 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 2004 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 2004 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 980 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 980 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 980 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 980 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 980 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 980 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 980 1956 setup_install.exe cmd.exe PID 1080 wrote to memory of 320 1080 cmd.exe sonia_2.exe PID 1080 wrote to memory of 320 1080 cmd.exe sonia_2.exe PID 1080 wrote to memory of 320 1080 cmd.exe sonia_2.exe PID 1080 wrote to memory of 320 1080 cmd.exe sonia_2.exe PID 1080 wrote to memory of 320 1080 cmd.exe sonia_2.exe PID 1080 wrote to memory of 320 1080 cmd.exe sonia_2.exe PID 1080 wrote to memory of 320 1080 cmd.exe sonia_2.exe PID 1956 wrote to memory of 1520 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1520 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1520 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1520 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1520 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1520 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1520 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1540 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1540 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1540 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1540 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1540 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1540 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 1540 1956 setup_install.exe cmd.exe PID 1956 wrote to memory of 992 1956 setup_install.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\F487F870FDF6550C4CA3241481FD49DC.exe"C:\Users\Admin\AppData\Local\Temp\F487F870FDF6550C4CA3241481FD49DC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8973356.exe"C:\Users\Admin\AppData\Roaming\8973356.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7385462.exe"C:\Users\Admin\AppData\Roaming\7385462.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\7804172.exe"C:\Users\Admin\AppData\Roaming\7804172.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_10.exe4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_9.exe4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_8.exe4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_7.exesonia_7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Documents\lz_OLq738Rofbh3MXUoqEkXU.exe"C:\Users\Admin\Documents\lz_OLq738Rofbh3MXUoqEkXU.exe"2⤵
-
C:\Users\Admin\Documents\FH4TR48883FjJLML9TzirbU9.exe"C:\Users\Admin\Documents\FH4TR48883FjJLML9TzirbU9.exe"2⤵
-
C:\Users\Admin\Documents\FH4TR48883FjJLML9TzirbU9.exeC:\Users\Admin\Documents\FH4TR48883FjJLML9TzirbU9.exe3⤵
-
C:\Users\Admin\Documents\nIlpM6F1jx2DzdzUwwlNIjRd.exe"C:\Users\Admin\Documents\nIlpM6F1jx2DzdzUwwlNIjRd.exe"2⤵
-
C:\Users\Admin\Documents\gipqcOVLR_qCDKpmMBA2ylC9.exe"C:\Users\Admin\Documents\gipqcOVLR_qCDKpmMBA2ylC9.exe"2⤵
-
C:\Users\Admin\Documents\gipqcOVLR_qCDKpmMBA2ylC9.exeC:\Users\Admin\Documents\gipqcOVLR_qCDKpmMBA2ylC9.exe3⤵
-
C:\Users\Admin\Documents\aLyoK7TInm5KlgvysYqNlMpz.exe"C:\Users\Admin\Documents\aLyoK7TInm5KlgvysYqNlMpz.exe"2⤵
-
C:\Users\Admin\Documents\aLyoK7TInm5KlgvysYqNlMpz.exe"C:\Users\Admin\Documents\aLyoK7TInm5KlgvysYqNlMpz.exe"3⤵
-
C:\Users\Admin\Documents\m11T53OJRdcR0qxPX2a0ci85.exe"C:\Users\Admin\Documents\m11T53OJRdcR0qxPX2a0ci85.exe"2⤵
-
C:\Users\Admin\Documents\m11T53OJRdcR0qxPX2a0ci85.exeC:\Users\Admin\Documents\m11T53OJRdcR0qxPX2a0ci85.exe3⤵
-
C:\Users\Admin\Documents\sGFSa_TMg5sZ32dw7QQqAKUj.exe"C:\Users\Admin\Documents\sGFSa_TMg5sZ32dw7QQqAKUj.exe"2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1220.0.491509050\1682063241" -parentBuildID 20200403170909 -prefsHandle 1172 -prefMapHandle 1168 -prefsLen 1 -prefMapSize 219622 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1220 "\\.\pipe\gecko-crash-server-pipe.1220" 1240 gpu5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef3454f50,0x7fef3454f60,0x7fef3454f704⤵
-
C:\Users\Admin\Documents\lDNVk2WgFzjUtQQ7Ctmdatp_.exe"C:\Users\Admin\Documents\lDNVk2WgFzjUtQQ7Ctmdatp_.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nss2BF2.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nss2BF2.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nss2BF2.tmp\tempfile.ps1"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nss2BF2.tmp\tempfile.ps1"3⤵
-
C:\Users\Admin\Documents\FU4634NW4VrWWQwOT0WZboJ3.exe"C:\Users\Admin\Documents\FU4634NW4VrWWQwOT0WZboJ3.exe"2⤵
-
C:\Users\Admin\Documents\Nzmd_nBfFOnCtOfkyCcBjrg6.exe"C:\Users\Admin\Documents\Nzmd_nBfFOnCtOfkyCcBjrg6.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\N5hkoU68TSXAczKHhoXhz31h.exe"C:\Users\Admin\Documents\N5hkoU68TSXAczKHhoXhz31h.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im N5hkoU68TSXAczKHhoXhz31h.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\N5hkoU68TSXAczKHhoXhz31h.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im N5hkoU68TSXAczKHhoXhz31h.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\OBlpFzkn6KgEf3bLCHgaGM3Y.exe"C:\Users\Admin\Documents\OBlpFzkn6KgEf3bLCHgaGM3Y.exe"2⤵
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"3⤵
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"3⤵
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"4⤵
-
C:\Users\Admin\Documents\oPHPuF27bJb_Bc5SOVYzvPaN.exe"C:\Users\Admin\Documents\oPHPuF27bJb_Bc5SOVYzvPaN.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_8.exesonia_8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-1LSR6.tmp\sonia_5.tmp"C:\Users\Admin\AppData\Local\Temp\is-1LSR6.tmp\sonia_5.tmp" /SL5="$5001C,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_5.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-UGEAI.tmp\JFHGSFGSIUGFSUIG.exe"C:\Users\Admin\AppData\Local\Temp\is-UGEAI.tmp\JFHGSFGSIUGFSUIG.exe" /S /UID=burnerch22⤵
-
C:\Program Files\Windows NT\QWEMTFPIBG\ultramediaburner.exe"C:\Program Files\Windows NT\QWEMTFPIBG\ultramediaburner.exe" /VERYSILENT3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7R8FA.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-7R8FA.tmp\ultramediaburner.tmp" /SL5="$202AC,281924,62464,C:\Program Files\Windows NT\QWEMTFPIBG\ultramediaburner.exe" /VERYSILENT4⤵
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu5⤵
-
C:\Users\Admin\AppData\Local\Temp\51-f1bbc-052-49fa0-d6705a662e697\Qaezhokylaetu.exe"C:\Users\Admin\AppData\Local\Temp\51-f1bbc-052-49fa0-d6705a662e697\Qaezhokylaetu.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e64⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3348 CREDAT:275457 /prefetch:25⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3348 CREDAT:1192973 /prefetch:25⤵
-
C:\Users\Admin\AppData\Local\Temp\e3-6d8eb-734-dbe93-301bcdbd68ee3\Bobaboduqi.exe"C:\Users\Admin\AppData\Local\Temp\e3-6d8eb-734-dbe93-301bcdbd68ee3\Bobaboduqi.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cwntdj0g.kv1\GcleanerEU.exe /eufive & exit4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o2wwyzms.egy\installer.exe /qn CAMPAIGN="654" & exit4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x40wmv2l.o55\Setup3310.exe /Verysilent /subid=623 & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\x40wmv2l.o55\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\x40wmv2l.o55\Setup3310.exe /Verysilent /subid=6235⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BTC61.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-BTC61.tmp\Setup3310.tmp" /SL5="$20398,138429,56832,C:\Users\Admin\AppData\Local\Temp\x40wmv2l.o55\Setup3310.exe" /Verysilent /subid=6236⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\levxjr1c.4mi\google-game.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_10.exesonia_10.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\TXO4drQ58aMe70ZUYgdyIbyP.exe"C:\Users\Admin\AppData\Roaming\TXO4drQ58aMe70ZUYgdyIbyP.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "owegj" /tr '"C:\Users\Admin\AppData\Roaming\owegj.exe"' & exit3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "owegj" /tr '"C:\Users\Admin\AppData\Roaming\owegj.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5F6E.tmp.bat""3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\owegj.exe"C:\Users\Admin\AppData\Roaming\owegj.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\jIfucVNNZvU19BtyQYplpXMv.exe"C:\Users\Admin\AppData\Roaming\jIfucVNNZvU19BtyQYplpXMv.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe3⤵
-
C:\Users\Admin\AppData\Roaming\5BXqTBOB2n4BjuFVYJZbVNTr.exe"C:\Users\Admin\AppData\Roaming\5BXqTBOB2n4BjuFVYJZbVNTr.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\5BXqTBOB2n4BjuFVYJZbVNTr.exe"C:\Users\Admin\AppData\Roaming\5BXqTBOB2n4BjuFVYJZbVNTr.exe" -a3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "sonia_10.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_10.exe" & exit2⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "sonia_10.exe" /f3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.exesonia_9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.exeC:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_5.exesonia_5.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_1.exesonia_1.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_2.exesonia_2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {76603C07-5719-469A-AE11-D977DFAAECFB} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\tcsesdiC:\Users\Admin\AppData\Roaming\tcsesdi2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_1.exeMD5
151ac4868889bf34489fec00289e2b68
SHA12e7b27cf334c64b0b28c5ca5742b4d920fa0434b
SHA2560c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0
SHA512e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_1.txtMD5
151ac4868889bf34489fec00289e2b68
SHA12e7b27cf334c64b0b28c5ca5742b4d920fa0434b
SHA2560c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0
SHA512e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_10.exeMD5
4b7b7040e382433933113af4f7796f68
SHA1842983d7b1c47c2a7485d82ed9c549882af13ab2
SHA256efac214c4a49b1b33601b95dc8ef6b54eea4b772b52ad490fa18fb9df9621772
SHA51257a6e8e857dd3d051f75c3214a541ecff61bd51ef011d1bf0cf60868545f0bf070cd2ff0f9b65f0eec77ba4c076ea0a26544f642d036e296ba6e34391683c079
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_10.txtMD5
4b7b7040e382433933113af4f7796f68
SHA1842983d7b1c47c2a7485d82ed9c549882af13ab2
SHA256efac214c4a49b1b33601b95dc8ef6b54eea4b772b52ad490fa18fb9df9621772
SHA51257a6e8e857dd3d051f75c3214a541ecff61bd51ef011d1bf0cf60868545f0bf070cd2ff0f9b65f0eec77ba4c076ea0a26544f642d036e296ba6e34391683c079
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_2.exeMD5
aca23edc97a7065dd632e96f897e9273
SHA17e87ae9dea4bb86df66a86f89b5425e8d0d32587
SHA25697101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf
SHA512c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_2.txtMD5
aca23edc97a7065dd632e96f897e9273
SHA17e87ae9dea4bb86df66a86f89b5425e8d0d32587
SHA25697101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf
SHA512c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_3.txtMD5
a2d08ecb52301e2a0c90527443431e13
SHA15811f5baf3d67bafc6f46036dd5deebd00f0ab96
SHA256e6c638f913e9137efc3b2b126d32dc7ea9bd03561df0213d1da137c4128636e9
SHA5121009795b15c3db597872e3562d3ccdee338ea36a9eec550676cfd060b921b6fcb000dce594ca4f9365d5c7baad214e6ee6057b9a3e47c8f4e3ae0c5a339e2a75
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_4.txtMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_5.exeMD5
8c4df9d37195987ede03bf8adb495686
SHA1010626025ca791720f85984a842c893b78f439d2
SHA2565207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185
SHA5128fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_5.txtMD5
8c4df9d37195987ede03bf8adb495686
SHA1010626025ca791720f85984a842c893b78f439d2
SHA2565207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185
SHA5128fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_6.exeMD5
7515023169169d938797c15228e42ae7
SHA18a325c2efaad6a7f25a4cd10182fcdf8298fb3d6
SHA256f2b5f5689c084ad0a75f43f6ca4f40799afe96219c22593c48f4aaac475d98bb
SHA51208ebc51e052ebbee41a9d4b6d5719e79962b5a288db6502fb6fc3dcb5276e57b578c9a794039be1106d694a8cb551892cc65820c439925d92f59d0e324990aea
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_6.txtMD5
7515023169169d938797c15228e42ae7
SHA18a325c2efaad6a7f25a4cd10182fcdf8298fb3d6
SHA256f2b5f5689c084ad0a75f43f6ca4f40799afe96219c22593c48f4aaac475d98bb
SHA51208ebc51e052ebbee41a9d4b6d5719e79962b5a288db6502fb6fc3dcb5276e57b578c9a794039be1106d694a8cb551892cc65820c439925d92f59d0e324990aea
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_7.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_7.txtMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_8.exeMD5
e66579343220149dc555cbcce3086a34
SHA16fcb3cff21746a9a10b5e7c17d98277eaad170af
SHA2565bd43e92faa6951a007253361a6092e1a242a29c0febc47f7bc7628bc70f6819
SHA5122088d29a90e4040c44bd7233838f55ea7d74bad0e3e3589e37c498dd25fba4ea8058c2f77280d24d892b0589acfeeb84f54ab45e14c17791af8af1d3e43618b1
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_8.txtMD5
e66579343220149dc555cbcce3086a34
SHA16fcb3cff21746a9a10b5e7c17d98277eaad170af
SHA2565bd43e92faa6951a007253361a6092e1a242a29c0febc47f7bc7628bc70f6819
SHA5122088d29a90e4040c44bd7233838f55ea7d74bad0e3e3589e37c498dd25fba4ea8058c2f77280d24d892b0589acfeeb84f54ab45e14c17791af8af1d3e43618b1
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.exeMD5
3e2c8ab8ed50cf8e9a4fe433965e8f60
SHA1d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520
SHA256b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6
SHA512eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4
-
C:\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.txtMD5
3e2c8ab8ed50cf8e9a4fe433965e8f60
SHA1d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520
SHA256b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6
SHA512eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
de093b24aed5680332f78ac8b9203eba
SHA1ea8ab27911999b8586bc1a6fa31d8049212f6803
SHA256cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc
SHA5124afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
de093b24aed5680332f78ac8b9203eba
SHA1ea8ab27911999b8586bc1a6fa31d8049212f6803
SHA256cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc
SHA5124afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\setup_install.exeMD5
6ee3a69de86ae9cc58f74ba2aeddce38
SHA1ed53ce3f4329e618823a5a0c789877a29ced0d97
SHA25614f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2
SHA512264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_1.exeMD5
151ac4868889bf34489fec00289e2b68
SHA12e7b27cf334c64b0b28c5ca5742b4d920fa0434b
SHA2560c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0
SHA512e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_10.exeMD5
4b7b7040e382433933113af4f7796f68
SHA1842983d7b1c47c2a7485d82ed9c549882af13ab2
SHA256efac214c4a49b1b33601b95dc8ef6b54eea4b772b52ad490fa18fb9df9621772
SHA51257a6e8e857dd3d051f75c3214a541ecff61bd51ef011d1bf0cf60868545f0bf070cd2ff0f9b65f0eec77ba4c076ea0a26544f642d036e296ba6e34391683c079
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_2.exeMD5
aca23edc97a7065dd632e96f897e9273
SHA17e87ae9dea4bb86df66a86f89b5425e8d0d32587
SHA25697101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf
SHA512c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_2.exeMD5
aca23edc97a7065dd632e96f897e9273
SHA17e87ae9dea4bb86df66a86f89b5425e8d0d32587
SHA25697101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf
SHA512c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_2.exeMD5
aca23edc97a7065dd632e96f897e9273
SHA17e87ae9dea4bb86df66a86f89b5425e8d0d32587
SHA25697101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf
SHA512c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_2.exeMD5
aca23edc97a7065dd632e96f897e9273
SHA17e87ae9dea4bb86df66a86f89b5425e8d0d32587
SHA25697101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf
SHA512c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_5.exeMD5
8c4df9d37195987ede03bf8adb495686
SHA1010626025ca791720f85984a842c893b78f439d2
SHA2565207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185
SHA5128fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_5.exeMD5
8c4df9d37195987ede03bf8adb495686
SHA1010626025ca791720f85984a842c893b78f439d2
SHA2565207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185
SHA5128fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_5.exeMD5
8c4df9d37195987ede03bf8adb495686
SHA1010626025ca791720f85984a842c893b78f439d2
SHA2565207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185
SHA5128fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_6.exeMD5
7515023169169d938797c15228e42ae7
SHA18a325c2efaad6a7f25a4cd10182fcdf8298fb3d6
SHA256f2b5f5689c084ad0a75f43f6ca4f40799afe96219c22593c48f4aaac475d98bb
SHA51208ebc51e052ebbee41a9d4b6d5719e79962b5a288db6502fb6fc3dcb5276e57b578c9a794039be1106d694a8cb551892cc65820c439925d92f59d0e324990aea
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_7.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_7.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_7.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_8.exeMD5
e66579343220149dc555cbcce3086a34
SHA16fcb3cff21746a9a10b5e7c17d98277eaad170af
SHA2565bd43e92faa6951a007253361a6092e1a242a29c0febc47f7bc7628bc70f6819
SHA5122088d29a90e4040c44bd7233838f55ea7d74bad0e3e3589e37c498dd25fba4ea8058c2f77280d24d892b0589acfeeb84f54ab45e14c17791af8af1d3e43618b1
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_8.exeMD5
e66579343220149dc555cbcce3086a34
SHA16fcb3cff21746a9a10b5e7c17d98277eaad170af
SHA2565bd43e92faa6951a007253361a6092e1a242a29c0febc47f7bc7628bc70f6819
SHA5122088d29a90e4040c44bd7233838f55ea7d74bad0e3e3589e37c498dd25fba4ea8058c2f77280d24d892b0589acfeeb84f54ab45e14c17791af8af1d3e43618b1
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.exeMD5
3e2c8ab8ed50cf8e9a4fe433965e8f60
SHA1d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520
SHA256b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6
SHA512eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.exeMD5
3e2c8ab8ed50cf8e9a4fe433965e8f60
SHA1d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520
SHA256b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6
SHA512eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4
-
\Users\Admin\AppData\Local\Temp\7zSC1666634\sonia_9.exeMD5
3e2c8ab8ed50cf8e9a4fe433965e8f60
SHA1d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520
SHA256b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6
SHA512eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
de093b24aed5680332f78ac8b9203eba
SHA1ea8ab27911999b8586bc1a6fa31d8049212f6803
SHA256cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc
SHA5124afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
de093b24aed5680332f78ac8b9203eba
SHA1ea8ab27911999b8586bc1a6fa31d8049212f6803
SHA256cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc
SHA5124afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
de093b24aed5680332f78ac8b9203eba
SHA1ea8ab27911999b8586bc1a6fa31d8049212f6803
SHA256cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc
SHA5124afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
de093b24aed5680332f78ac8b9203eba
SHA1ea8ab27911999b8586bc1a6fa31d8049212f6803
SHA256cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc
SHA5124afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7
-
memory/320-194-0x0000000000400000-0x00000000005D5000-memory.dmpFilesize
1.8MB
-
memory/320-120-0x0000000000000000-mapping.dmp
-
memory/320-192-0x0000000000240000-0x0000000000249000-memory.dmpFilesize
36KB
-
memory/436-159-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/436-141-0x0000000000000000-mapping.dmp
-
memory/604-108-0x0000000000000000-mapping.dmp
-
memory/772-207-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/772-247-0x00000000007A0000-0x00000000007A1000-memory.dmpFilesize
4KB
-
memory/772-205-0x0000000000000000-mapping.dmp
-
memory/924-193-0x000000001B060000-0x000000001B062000-memory.dmpFilesize
8KB
-
memory/924-180-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/924-188-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/924-149-0x0000000000000000-mapping.dmp
-
memory/924-189-0x0000000000150000-0x0000000000171000-memory.dmpFilesize
132KB
-
memory/924-190-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/952-264-0x0000000000000000-mapping.dmp
-
memory/980-116-0x0000000000000000-mapping.dmp
-
memory/992-127-0x0000000000000000-mapping.dmp
-
memory/1056-139-0x0000000000000000-mapping.dmp
-
memory/1080-110-0x0000000000000000-mapping.dmp
-
memory/1096-135-0x0000000000000000-mapping.dmp
-
memory/1116-142-0x0000000000000000-mapping.dmp
-
memory/1272-232-0x0000000002A70000-0x0000000002A85000-memory.dmpFilesize
84KB
-
memory/1368-130-0x0000000000000000-mapping.dmp
-
memory/1396-266-0x0000000000417E8E-mapping.dmp
-
memory/1516-129-0x0000000000000000-mapping.dmp
-
memory/1520-121-0x0000000000000000-mapping.dmp
-
memory/1540-122-0x0000000000000000-mapping.dmp
-
memory/1548-187-0x000000001AF00000-0x000000001AF02000-memory.dmpFilesize
8KB
-
memory/1548-164-0x0000000000000000-mapping.dmp
-
memory/1548-174-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/1564-62-0x0000000000000000-mapping.dmp
-
memory/1652-285-0x0000000000417E8A-mapping.dmp
-
memory/1780-199-0x0000000000000000-mapping.dmp
-
memory/1796-273-0x0000000000000000-mapping.dmp
-
memory/1880-186-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1880-179-0x0000000000000000-mapping.dmp
-
memory/1900-151-0x0000000000000000-mapping.dmp
-
memory/1904-278-0x0000000000000000-mapping.dmp
-
memory/1956-91-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1956-97-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1956-90-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1956-109-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1956-72-0x0000000000000000-mapping.dmp
-
memory/1956-113-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1956-111-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1956-92-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1956-95-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1956-96-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1956-93-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1956-94-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1956-89-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2004-112-0x0000000000000000-mapping.dmp
-
memory/2016-204-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/2016-184-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/2016-158-0x0000000000000000-mapping.dmp
-
memory/2020-167-0x0000000000000000-mapping.dmp
-
memory/2020-201-0x0000000004BB2000-0x0000000004BB3000-memory.dmpFilesize
4KB
-
memory/2020-202-0x0000000004BB4000-0x0000000004BB6000-memory.dmpFilesize
8KB
-
memory/2020-191-0x00000000009C0000-0x00000000009DB000-memory.dmpFilesize
108KB
-
memory/2020-198-0x0000000002270000-0x0000000002289000-memory.dmpFilesize
100KB
-
memory/2020-203-0x0000000004BB3000-0x0000000004BB4000-memory.dmpFilesize
4KB
-
memory/2020-197-0x0000000004BB1000-0x0000000004BB2000-memory.dmpFilesize
4KB
-
memory/2020-195-0x00000000003D0000-0x00000000003FF000-memory.dmpFilesize
188KB
-
memory/2020-60-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB
-
memory/2020-196-0x0000000000400000-0x00000000005EE000-memory.dmpFilesize
1.9MB
-
memory/2052-208-0x0000000000000000-mapping.dmp
-
memory/2052-210-0x000007FEFC141000-0x000007FEFC143000-memory.dmpFilesize
8KB
-
memory/2064-257-0x0000000000000000-mapping.dmp
-
memory/2072-282-0x0000000000417E22-mapping.dmp
-
memory/2096-211-0x0000000000000000-mapping.dmp
-
memory/2096-230-0x0000000000AC0000-0x0000000000AC2000-memory.dmpFilesize
8KB
-
memory/2108-235-0x0000000000AB0000-0x0000000000AB1000-memory.dmpFilesize
4KB
-
memory/2108-214-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/2108-212-0x0000000000000000-mapping.dmp
-
memory/2124-284-0x0000000000000000-mapping.dmp
-
memory/2160-242-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/2160-233-0x0000000000E40000-0x0000000000E41000-memory.dmpFilesize
4KB
-
memory/2160-221-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2160-238-0x0000000000560000-0x0000000000591000-memory.dmpFilesize
196KB
-
memory/2160-218-0x0000000001060000-0x0000000001061000-memory.dmpFilesize
4KB
-
memory/2160-216-0x0000000000000000-mapping.dmp
-
memory/2196-281-0x0000000000000000-mapping.dmp
-
memory/2212-237-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/2212-223-0x0000000001070000-0x0000000001071000-memory.dmpFilesize
4KB
-
memory/2212-229-0x00000000003F0000-0x00000000003FE000-memory.dmpFilesize
56KB
-
memory/2212-220-0x0000000000000000-mapping.dmp
-
memory/2212-227-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2252-236-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2252-224-0x0000000000000000-mapping.dmp
-
memory/2252-239-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/2252-234-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2252-245-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/2252-228-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2272-276-0x0000000000060000-0x00000000000AC000-memory.dmpFilesize
304KB
-
memory/2272-277-0x0000000000490000-0x0000000000501000-memory.dmpFilesize
452KB
-
memory/2272-271-0x00000000FFAC246C-mapping.dmp
-
memory/2276-258-0x0000000000000000-mapping.dmp
-
memory/2308-262-0x0000000000417E9E-mapping.dmp
-
memory/2376-260-0x0000000000000000-mapping.dmp
-
memory/2388-267-0x0000000000000000-mapping.dmp
-
memory/2400-240-0x0000000000000000-mapping.dmp
-
memory/2460-263-0x0000000000000000-mapping.dmp
-
memory/2544-241-0x0000000000000000-mapping.dmp
-
memory/2560-272-0x0000000002010000-0x0000000002111000-memory.dmpFilesize
1.0MB
-
memory/2560-261-0x0000000000000000-mapping.dmp
-
memory/2560-274-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2596-246-0x0000000000000000-mapping.dmp
-
memory/2604-283-0x0000000000000000-mapping.dmp
-
memory/2636-265-0x0000000000000000-mapping.dmp
-
memory/2764-286-0x0000000000000000-mapping.dmp
-
memory/2832-287-0x0000000000000000-mapping.dmp
-
memory/2864-288-0x0000000000000000-mapping.dmp
-
memory/2924-268-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/2924-248-0x0000000000000000-mapping.dmp
-
memory/2936-259-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/2936-249-0x0000000000000000-mapping.dmp
-
memory/2960-275-0x00000000002D0000-0x0000000000339000-memory.dmpFilesize
420KB
-
memory/2960-279-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2960-250-0x0000000000000000-mapping.dmp
-
memory/2960-280-0x0000000004B01000-0x0000000004B02000-memory.dmpFilesize
4KB
-
memory/2976-269-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/2976-251-0x0000000000000000-mapping.dmp
-
memory/2988-252-0x0000000000000000-mapping.dmp
-
memory/3008-253-0x0000000000000000-mapping.dmp
-
memory/3020-254-0x0000000000000000-mapping.dmp
-
memory/3020-270-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/3032-255-0x0000000000000000-mapping.dmp
-
memory/3044-256-0x0000000000000000-mapping.dmp
-
memory/3276-289-0x0000000000402F68-mapping.dmp