Analysis

  • max time kernel
    150s
  • max time network
    164s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    16-07-2021 23:03

General

  • Target

    5A28EEFCFDB9731DAAE5968C928A75E1.exe

  • Size

    2.6MB

  • MD5

    5a28eefcfdb9731daae5968c928a75e1

  • SHA1

    4a71af60e5a1fc2f4b231311f2e92018d46297d8

  • SHA256

    613be114eabd4a3dc4ea9c304a33ff110671101999837885390e91a605b7bcce

  • SHA512

    c77f285f72c51612a35a43b2d52c5ae4202f25d1010d036d1d7dac2f61b50228134d2a024580e0f7e6c0109f27a0cff83acc93c0e9dc289de2bbe062c9b0a5f0

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: udacha123@mail2tor.com and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: udacha123@mail2tor.com telegram @udacha123yes 100$=24 hour Attention !!! in 24 hours the price will increase 3 times !!! have time to pay Your personal ID: 207-64B-AB3 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

udacha123@mail2tor.com

Extracted

Family

vidar

Version

39.5

Botnet

933

C2

https://olegf9844.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

Cana01

C2

176.111.174.254:56328

Extracted

Family

vidar

Version

39.6

Botnet

865

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    865

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 5 IoCs
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 56 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 25 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2556
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2536
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2316
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2300
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1916
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1404
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1236
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1192
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1064
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:824
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:984
                      • C:\Users\Admin\AppData\Local\Temp\5A28EEFCFDB9731DAAE5968C928A75E1.exe
                        "C:\Users\Admin\AppData\Local\Temp\5A28EEFCFDB9731DAAE5968C928A75E1.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3980
                        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:1724
                          • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\setup_install.exe
                            "C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\setup_install.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:2652
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sonia_5.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3788
                              • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_5.exe
                                sonia_5.exe
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:1412
                                • C:\Users\Admin\AppData\Roaming\1310755.exe
                                  "C:\Users\Admin\AppData\Roaming\1310755.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2772
                                • C:\Users\Admin\AppData\Roaming\2680875.exe
                                  "C:\Users\Admin\AppData\Roaming\2680875.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4128
                                • C:\Users\Admin\AppData\Roaming\2959807.exe
                                  "C:\Users\Admin\AppData\Roaming\2959807.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Checks BIOS information in registry
                                  • Checks whether UAC is enabled
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:2956
                                • C:\Users\Admin\AppData\Roaming\3875848.exe
                                  "C:\Users\Admin\AppData\Roaming\3875848.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  PID:1316
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c sonia_6.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3364
                              • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_6.exe
                                sonia_6.exe
                                5⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                PID:3712
                                • C:\Users\Admin\Documents\3AWZ31utCRI_thSsS1E7UhLr.exe
                                  "C:\Users\Admin\Documents\3AWZ31utCRI_thSsS1E7UhLr.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:5068
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    7⤵
                                      PID:4296
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        8⤵
                                        • Kills process with taskkill
                                        PID:5080
                                  • C:\Users\Admin\Documents\4bz3bLzWc_VCCnWOU8HL4hPc.exe
                                    "C:\Users\Admin\Documents\4bz3bLzWc_VCCnWOU8HL4hPc.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks BIOS information in registry
                                    • Checks whether UAC is enabled
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:4172
                                  • C:\Users\Admin\Documents\M3WIy_bZZy5_oJc6MEbtyvFl.exe
                                    "C:\Users\Admin\Documents\M3WIy_bZZy5_oJc6MEbtyvFl.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks BIOS information in registry
                                    • Checks whether UAC is enabled
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:5040
                                  • C:\Users\Admin\Documents\4pm0_hnsRUqWzDik8oiLMv3Q.exe
                                    "C:\Users\Admin\Documents\4pm0_hnsRUqWzDik8oiLMv3Q.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:2624
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 2624 -s 1036
                                      7⤵
                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                      • Program crash
                                      PID:4564
                                  • C:\Users\Admin\Documents\weUvTAgqTwQRgu8G9n4wlehW.exe
                                    "C:\Users\Admin\Documents\weUvTAgqTwQRgu8G9n4wlehW.exe"
                                    6⤵
                                      PID:2344
                                      • C:\Users\Admin\Documents\weUvTAgqTwQRgu8G9n4wlehW.exe
                                        "C:\Users\Admin\Documents\weUvTAgqTwQRgu8G9n4wlehW.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks SCSI registry key(s)
                                        • Suspicious behavior: MapViewOfSection
                                        PID:1384
                                    • C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                      "C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2120
                                      • C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                        C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:3612
                                      • C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                        C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4816
                                      • C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                        C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4632
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 24
                                          8⤵
                                          • Program crash
                                          PID:4212
                                    • C:\Users\Admin\Documents\xyLOivfO_wXnS2dFMNtWksKi.exe
                                      "C:\Users\Admin\Documents\xyLOivfO_wXnS2dFMNtWksKi.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4908
                                      • C:\Users\Admin\Documents\xyLOivfO_wXnS2dFMNtWksKi.exe
                                        C:\Users\Admin\Documents\xyLOivfO_wXnS2dFMNtWksKi.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:2168
                                    • C:\Users\Admin\Documents\WXmu3AHkkyazb65LKr9naMyL.exe
                                      "C:\Users\Admin\Documents\WXmu3AHkkyazb65LKr9naMyL.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4780
                                      • C:\Users\Admin\Documents\WXmu3AHkkyazb65LKr9naMyL.exe
                                        C:\Users\Admin\Documents\WXmu3AHkkyazb65LKr9naMyL.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:3428
                                    • C:\Users\Admin\Documents\JKHcMZR_APWcuHsnyQVL2wSt.exe
                                      "C:\Users\Admin\Documents\JKHcMZR_APWcuHsnyQVL2wSt.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4864
                                      • C:\Users\Admin\Documents\JKHcMZR_APWcuHsnyQVL2wSt.exe
                                        "C:\Users\Admin\Documents\JKHcMZR_APWcuHsnyQVL2wSt.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Modifies data under HKEY_USERS
                                        PID:1412
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 776
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Program crash
                                        PID:2344
                                    • C:\Users\Admin\Documents\gUa_u0OFYN_YiYTHHkCugEKx.exe
                                      "C:\Users\Admin\Documents\gUa_u0OFYN_YiYTHHkCugEKx.exe"
                                      6⤵
                                        PID:4616
                                        • C:\Users\Admin\Documents\gUa_u0OFYN_YiYTHHkCugEKx.exe
                                          C:\Users\Admin\Documents\gUa_u0OFYN_YiYTHHkCugEKx.exe
                                          7⤵
                                          • Executes dropped EXE
                                          PID:484
                                      • C:\Users\Admin\Documents\jgdZDn7vsoIwww5EOLFuw6qH.exe
                                        "C:\Users\Admin\Documents\jgdZDn7vsoIwww5EOLFuw6qH.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        PID:196
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /im jgdZDn7vsoIwww5EOLFuw6qH.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\jgdZDn7vsoIwww5EOLFuw6qH.exe" & del C:\ProgramData\*.dll & exit
                                          7⤵
                                            PID:416
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /im jgdZDn7vsoIwww5EOLFuw6qH.exe /f
                                              8⤵
                                              • Kills process with taskkill
                                              PID:4804
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout /t 6
                                              8⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Delays execution with timeout.exe
                                              PID:4616
                                        • C:\Users\Admin\Documents\YoA5hTqO4IUvPwuWrm2v4x3M.exe
                                          "C:\Users\Admin\Documents\YoA5hTqO4IUvPwuWrm2v4x3M.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:4312
                                          • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                            "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4428
                                          • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                            "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Drops file in Program Files directory
                                            PID:628
                                          • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                            "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            • Checks computer location settings
                                            • Modifies registry class
                                            PID:4680
                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                              8⤵
                                              • Loads dropped DLL
                                              • Modifies registry class
                                              PID:2116
                                          • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                            "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4448
                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              8⤵
                                              • Executes dropped EXE
                                              PID:4620
                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              8⤵
                                              • Executes dropped EXE
                                              PID:4148
                                        • C:\Users\Admin\Documents\VLnvmXHY04D_mqtREkezXak0.exe
                                          "C:\Users\Admin\Documents\VLnvmXHY04D_mqtREkezXak0.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:4724
                                          • C:\Users\Admin\Documents\VLnvmXHY04D_mqtREkezXak0.exe
                                            "C:\Users\Admin\Documents\VLnvmXHY04D_mqtREkezXak0.exe" -a
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4636
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sonia_7.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:500
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_7.exe
                                        sonia_7.exe
                                        5⤵
                                        • Executes dropped EXE
                                        PID:3080
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sonia_4.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3992
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sonia_3.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3400
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sonia_2.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:764
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sonia_1.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3740
                              • \??\c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                1⤵
                                • Suspicious use of SetThreadContext
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3636
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                  2⤵
                                  • Drops file in System32 directory
                                  • Checks processor information in registry
                                  • Modifies data under HKEY_USERS
                                  • Modifies registry class
                                  PID:2828
                              • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_2.exe
                                sonia_2.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:3064
                              • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_1.exe
                                sonia_1.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2392
                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_1.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_1.exe" -a
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2516
                              • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_3.exe
                                sonia_3.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1864
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1612
                                  2⤵
                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                  • Program crash
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5056
                              • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_4.exe
                                sonia_4.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1220
                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4560
                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                  C:\Users\Admin\AppData\Local\Temp\22222.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3880
                              • C:\Windows\SysWOW64\rundll32.exe
                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                1⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2600
                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4420
                              • C:\Windows\system32\rUNdlL32.eXe
                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                1⤵
                                • Process spawned unexpected child process
                                • Suspicious use of WriteProcessMemory
                                PID:2624
                              • C:\Windows\system32\rUNdlL32.eXe
                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                1⤵
                                • Process spawned unexpected child process
                                PID:732
                                • C:\Windows\SysWOW64\rundll32.exe
                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                  2⤵
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  PID:2904
                              • \??\c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                1⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                PID:1392
                              • C:\Users\Admin\AppData\Local\Temp\DF55.exe
                                C:\Users\Admin\AppData\Local\Temp\DF55.exe
                                1⤵
                                • Executes dropped EXE
                                PID:4572
                              • C:\Users\Admin\AppData\Local\Temp\19AF.exe
                                C:\Users\Admin\AppData\Local\Temp\19AF.exe
                                1⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Checks whether UAC is enabled
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                PID:4956
                              • C:\Users\Admin\AppData\Local\Temp\5736.exe
                                C:\Users\Admin\AppData\Local\Temp\5736.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4120
                                • C:\Users\Admin\AppData\Local\Temp\5736.exe
                                  C:\Users\Admin\AppData\Local\Temp\5736.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4048
                              • C:\Users\Admin\AppData\Local\Temp\6020.exe
                                C:\Users\Admin\AppData\Local\Temp\6020.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3236
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6020.exe"
                                  2⤵
                                    PID:4616
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /T 10 /NOBREAK
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:4980
                                • C:\Users\Admin\AppData\Local\Temp\6225.exe
                                  C:\Users\Admin\AppData\Local\Temp\6225.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2612
                                • C:\Users\Admin\AppData\Local\Temp\668B.exe
                                  C:\Users\Admin\AppData\Local\Temp\668B.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: MapViewOfSection
                                  PID:4804
                                • C:\Users\Admin\AppData\Local\Temp\6B9D.exe
                                  C:\Users\Admin\AppData\Local\Temp\6B9D.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:4268
                                • C:\Users\Admin\AppData\Local\Temp\72C2.exe
                                  C:\Users\Admin\AppData\Local\Temp\72C2.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4768
                                • C:\Users\Admin\AppData\Local\Temp\75D0.exe
                                  C:\Users\Admin\AppData\Local\Temp\75D0.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Enumerates connected drives
                                  PID:1292
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                    2⤵
                                      PID:2064
                                      • C:\Windows\SysWOW64\vssadmin.exe
                                        vssadmin delete shadows /all /quiet
                                        3⤵
                                        • Interacts with shadow copies
                                        PID:3784
                                    • C:\Users\Admin\AppData\Local\Temp\75D0.exe
                                      "C:\Users\Admin\AppData\Local\Temp\75D0.exe" -agent 0
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      PID:4652
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                      2⤵
                                        PID:8
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                        2⤵
                                          PID:4636
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                          2⤵
                                            PID:4620
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                            2⤵
                                              PID:204
                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                wmic shadowcopy delete
                                                3⤵
                                                  PID:4972
                                            • C:\Windows\SysWOW64\explorer.exe
                                              C:\Windows\SysWOW64\explorer.exe
                                              1⤵
                                                PID:356
                                              • C:\Windows\explorer.exe
                                                C:\Windows\explorer.exe
                                                1⤵
                                                  PID:3880
                                                • C:\Windows\SysWOW64\explorer.exe
                                                  C:\Windows\SysWOW64\explorer.exe
                                                  1⤵
                                                    PID:5032
                                                  • C:\Windows\explorer.exe
                                                    C:\Windows\explorer.exe
                                                    1⤵
                                                      PID:2124
                                                    • C:\Windows\SysWOW64\explorer.exe
                                                      C:\Windows\SysWOW64\explorer.exe
                                                      1⤵
                                                        PID:1904
                                                      • C:\Windows\explorer.exe
                                                        C:\Windows\explorer.exe
                                                        1⤵
                                                          PID:4472
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          C:\Windows\SysWOW64\explorer.exe
                                                          1⤵
                                                            PID:2160
                                                          • C:\Windows\explorer.exe
                                                            C:\Windows\explorer.exe
                                                            1⤵
                                                              PID:920
                                                            • C:\Windows\SysWOW64\explorer.exe
                                                              C:\Windows\SysWOW64\explorer.exe
                                                              1⤵
                                                                PID:4160
                                                              • C:\Windows\system32\vssvc.exe
                                                                C:\Windows\system32\vssvc.exe
                                                                1⤵
                                                                  PID:4176

                                                                Network

                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                Persistence

                                                                Modify Existing Service

                                                                1
                                                                T1031

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1060

                                                                Defense Evasion

                                                                Modify Registry

                                                                2
                                                                T1112

                                                                Disabling Security Tools

                                                                1
                                                                T1089

                                                                File Deletion

                                                                2
                                                                T1107

                                                                Virtualization/Sandbox Evasion

                                                                1
                                                                T1497

                                                                Credential Access

                                                                Credentials in Files

                                                                4
                                                                T1081

                                                                Discovery

                                                                Query Registry

                                                                7
                                                                T1012

                                                                Virtualization/Sandbox Evasion

                                                                1
                                                                T1497

                                                                System Information Discovery

                                                                7
                                                                T1082

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Collection

                                                                Data from Local System

                                                                4
                                                                T1005

                                                                Command and Control

                                                                Web Service

                                                                1
                                                                T1102

                                                                Impact

                                                                Inhibit System Recovery

                                                                2
                                                                T1490

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                  MD5

                                                                  bdb9a4789b7f3f2f47beaeaa777e7f2f

                                                                  SHA1

                                                                  0a4f1359a9ed362f4e1acb7969524764be1db0d7

                                                                  SHA256

                                                                  89f65efc3afe76abd72ff30fdb7ac4ab2741004019dc58a7f216567335921921

                                                                  SHA512

                                                                  3c95eb7c815a14d839cd83f654251f08d2a07d7edd7c775dfd2cdd5e52656606df4d1dd348b9074b24bd26643a2c691f51cdd341e0c08d75600e7ba5eb642ffa

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                  MD5

                                                                  0b155975f1ffe228888b108046b8063c

                                                                  SHA1

                                                                  b60ac69cb46e7a78737d989d8383658d04d35224

                                                                  SHA256

                                                                  933a7b63193aebb9b0b49b3ada22f6ddd011d3fcbf2b7b7740c59fc51b0e0d97

                                                                  SHA512

                                                                  2a8c7dfdf0ba79a1fe2d19507a35b0df7dfcdce3102ff293cd8e2ceb25bd14ebd8255d906b9f6f26345b7b4100afe6ad5ec7ff675c0b8cfafb633f2b372d4a6d

                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                  MD5

                                                                  cc0d6b6813f92dbf5be3ecacf44d662a

                                                                  SHA1

                                                                  b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                  SHA256

                                                                  0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                  SHA512

                                                                  4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                  MD5

                                                                  cc0d6b6813f92dbf5be3ecacf44d662a

                                                                  SHA1

                                                                  b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                  SHA256

                                                                  0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                  SHA512

                                                                  4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                  MD5

                                                                  cccf90ef6caa1c720eb17ccba041b365

                                                                  SHA1

                                                                  55e66eca9cf8e2fb2e2b1cc80907d14e617a13f8

                                                                  SHA256

                                                                  252dd54cd72c470bd4dc0011f8937e5075b32ee666fd3a76e8e5cab97ff52855

                                                                  SHA512

                                                                  92114fa395e62d6aa675253c3373eadc1d21370e1af4d73fe2eee22c26bcf1c7641af860707162a975a71cbff14a285e7aa9b26260717d5a850f4cced8d39202

                                                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                  MD5

                                                                  cccf90ef6caa1c720eb17ccba041b365

                                                                  SHA1

                                                                  55e66eca9cf8e2fb2e2b1cc80907d14e617a13f8

                                                                  SHA256

                                                                  252dd54cd72c470bd4dc0011f8937e5075b32ee666fd3a76e8e5cab97ff52855

                                                                  SHA512

                                                                  92114fa395e62d6aa675253c3373eadc1d21370e1af4d73fe2eee22c26bcf1c7641af860707162a975a71cbff14a285e7aa9b26260717d5a850f4cced8d39202

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\libcurl.dll
                                                                  MD5

                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                  SHA1

                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                  SHA256

                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                  SHA512

                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\libcurlpp.dll
                                                                  MD5

                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                  SHA1

                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                  SHA256

                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                  SHA512

                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\libgcc_s_dw2-1.dll
                                                                  MD5

                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                  SHA1

                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                  SHA256

                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                  SHA512

                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\libstdc++-6.dll
                                                                  MD5

                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                  SHA1

                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                  SHA256

                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                  SHA512

                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\libwinpthread-1.dll
                                                                  MD5

                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                  SHA1

                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                  SHA256

                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                  SHA512

                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\setup_install.exe
                                                                  MD5

                                                                  86f77f44607418677aa8c0e9109f2b74

                                                                  SHA1

                                                                  2f28f091b38b82e3c1c25a0dc7b4f509abc52941

                                                                  SHA256

                                                                  9eb5a966a3c758b07ea73681c5349d83f02f1e04abd339e974153e4b5f39d42b

                                                                  SHA512

                                                                  85a0a3a467bf53b549ebfa998dded3e27a6d5ed3e1ec9a4d584e0470973428a771511eb38ebff4ce9579e979da165cd255ab372d4a90d7fc63c74a13c89601d0

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\setup_install.exe
                                                                  MD5

                                                                  86f77f44607418677aa8c0e9109f2b74

                                                                  SHA1

                                                                  2f28f091b38b82e3c1c25a0dc7b4f509abc52941

                                                                  SHA256

                                                                  9eb5a966a3c758b07ea73681c5349d83f02f1e04abd339e974153e4b5f39d42b

                                                                  SHA512

                                                                  85a0a3a467bf53b549ebfa998dded3e27a6d5ed3e1ec9a4d584e0470973428a771511eb38ebff4ce9579e979da165cd255ab372d4a90d7fc63c74a13c89601d0

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_1.exe
                                                                  MD5

                                                                  6e43430011784cff369ea5a5ae4b000f

                                                                  SHA1

                                                                  5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                  SHA256

                                                                  a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                  SHA512

                                                                  33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_1.exe
                                                                  MD5

                                                                  6e43430011784cff369ea5a5ae4b000f

                                                                  SHA1

                                                                  5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                  SHA256

                                                                  a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                  SHA512

                                                                  33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_1.txt
                                                                  MD5

                                                                  6e43430011784cff369ea5a5ae4b000f

                                                                  SHA1

                                                                  5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                  SHA256

                                                                  a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                  SHA512

                                                                  33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_2.exe
                                                                  MD5

                                                                  651dea02d27200d86859f0f88c5828e1

                                                                  SHA1

                                                                  9f96d946d3cb446fcec66ece28ee934bc077a3f8

                                                                  SHA256

                                                                  b9a4d56ff28ef2a866181275227920d1c7201c9d373a176ae9b728515a9d53ac

                                                                  SHA512

                                                                  104305338ab63f0a58256d0153100fa5b3dec595770aefcfd8fa67241cc4231e5807b25b4d0ca4386212a2e8116ad1f63ebbb6f1a242a52a11a6f1d46a398a6f

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_2.txt
                                                                  MD5

                                                                  651dea02d27200d86859f0f88c5828e1

                                                                  SHA1

                                                                  9f96d946d3cb446fcec66ece28ee934bc077a3f8

                                                                  SHA256

                                                                  b9a4d56ff28ef2a866181275227920d1c7201c9d373a176ae9b728515a9d53ac

                                                                  SHA512

                                                                  104305338ab63f0a58256d0153100fa5b3dec595770aefcfd8fa67241cc4231e5807b25b4d0ca4386212a2e8116ad1f63ebbb6f1a242a52a11a6f1d46a398a6f

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_3.exe
                                                                  MD5

                                                                  218d979a8eb952aa91a129286a0f271a

                                                                  SHA1

                                                                  564e6d1e64e82894ccad34f7c716e4f02f5488b7

                                                                  SHA256

                                                                  04c7d3e2704437305b1d13303e5580fb86358ec3faf3dba5b753587a9f9e3db5

                                                                  SHA512

                                                                  e899d7b49c9697b9600f09923573d4c6522017e6b5a881af60aeaf1320e1f46be376a60bc3d13b3214b42007d22d9cbc54c620156cfd3067c415e42488476168

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_3.txt
                                                                  MD5

                                                                  218d979a8eb952aa91a129286a0f271a

                                                                  SHA1

                                                                  564e6d1e64e82894ccad34f7c716e4f02f5488b7

                                                                  SHA256

                                                                  04c7d3e2704437305b1d13303e5580fb86358ec3faf3dba5b753587a9f9e3db5

                                                                  SHA512

                                                                  e899d7b49c9697b9600f09923573d4c6522017e6b5a881af60aeaf1320e1f46be376a60bc3d13b3214b42007d22d9cbc54c620156cfd3067c415e42488476168

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_4.exe
                                                                  MD5

                                                                  6dd6b9daeae7c39271871d45aeab87fd

                                                                  SHA1

                                                                  c81749759f18dd37b0c6a9408cce543a191b3b8b

                                                                  SHA256

                                                                  6445789f365629e8299083ef609dec06b2464fa0624e63f09298b1605fd9d3a0

                                                                  SHA512

                                                                  a4828c904160459436b131cec604b28429964134cc595680be1ef3527674fe7fe1cdb13f84358d3d43b15113028effae7c45a8f8ddf0a6ac2423e79c2f872032

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_4.txt
                                                                  MD5

                                                                  6dd6b9daeae7c39271871d45aeab87fd

                                                                  SHA1

                                                                  c81749759f18dd37b0c6a9408cce543a191b3b8b

                                                                  SHA256

                                                                  6445789f365629e8299083ef609dec06b2464fa0624e63f09298b1605fd9d3a0

                                                                  SHA512

                                                                  a4828c904160459436b131cec604b28429964134cc595680be1ef3527674fe7fe1cdb13f84358d3d43b15113028effae7c45a8f8ddf0a6ac2423e79c2f872032

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_5.exe
                                                                  MD5

                                                                  6938ae13183f8d12a8eb9ee99559ed04

                                                                  SHA1

                                                                  77b724111fa370128250c7c8daba697c4caa63c7

                                                                  SHA256

                                                                  c5fa22693b9948ab89c33e70cbabe1f9083c05d9f2fe17ab7cf2a69a1b92a672

                                                                  SHA512

                                                                  a83e47a71aee10ef3fe7c41be49a2c8b13e73f83952cd16f43d30e833184e64c2ddcdd5ed626f680990a99a35621009e1130e0d11d58ce961d6e1fba17e2fd83

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_5.txt
                                                                  MD5

                                                                  6938ae13183f8d12a8eb9ee99559ed04

                                                                  SHA1

                                                                  77b724111fa370128250c7c8daba697c4caa63c7

                                                                  SHA256

                                                                  c5fa22693b9948ab89c33e70cbabe1f9083c05d9f2fe17ab7cf2a69a1b92a672

                                                                  SHA512

                                                                  a83e47a71aee10ef3fe7c41be49a2c8b13e73f83952cd16f43d30e833184e64c2ddcdd5ed626f680990a99a35621009e1130e0d11d58ce961d6e1fba17e2fd83

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_6.exe
                                                                  MD5

                                                                  ec149486075982428b9d394c1a5375fd

                                                                  SHA1

                                                                  63c94ed4abc8aff9001293045bc4d8ce549a47b8

                                                                  SHA256

                                                                  53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9

                                                                  SHA512

                                                                  c8267ac9e08816a476f5bf7d3177057ff9a8e4e30aea3abdf2fa4fb4281623d3d11bd8751bff917fbea73763790ea8b95d03fd2e37168872a903cfd70b155b4d

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_6.txt
                                                                  MD5

                                                                  ec149486075982428b9d394c1a5375fd

                                                                  SHA1

                                                                  63c94ed4abc8aff9001293045bc4d8ce549a47b8

                                                                  SHA256

                                                                  53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9

                                                                  SHA512

                                                                  c8267ac9e08816a476f5bf7d3177057ff9a8e4e30aea3abdf2fa4fb4281623d3d11bd8751bff917fbea73763790ea8b95d03fd2e37168872a903cfd70b155b4d

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_7.exe
                                                                  MD5

                                                                  cfecd242616c7a9f5d33beb63f6fbd6f

                                                                  SHA1

                                                                  e96cefcdf0cf5fa401a17763b61fcbdac00efda4

                                                                  SHA256

                                                                  c17c25d65c31182ee0f1943a0e3f162e40bbea083668f6959bc53afe010be11d

                                                                  SHA512

                                                                  c638888b46827cf32a4f63bbaf7f90c4e2529fc2a624daf144a33fb22f91da367e4018b88cf1a4f3a85f01f1c66c2e86581691a0bfc9656f2a567501645e6618

                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCB696A74\sonia_7.txt
                                                                  MD5

                                                                  cfecd242616c7a9f5d33beb63f6fbd6f

                                                                  SHA1

                                                                  e96cefcdf0cf5fa401a17763b61fcbdac00efda4

                                                                  SHA256

                                                                  c17c25d65c31182ee0f1943a0e3f162e40bbea083668f6959bc53afe010be11d

                                                                  SHA512

                                                                  c638888b46827cf32a4f63bbaf7f90c4e2529fc2a624daf144a33fb22f91da367e4018b88cf1a4f3a85f01f1c66c2e86581691a0bfc9656f2a567501645e6618

                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                  MD5

                                                                  99ab358c6f267b09d7a596548654a6ba

                                                                  SHA1

                                                                  d5a643074b69be2281a168983e3f6bef7322f676

                                                                  SHA256

                                                                  586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380

                                                                  SHA512

                                                                  952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b

                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                  MD5

                                                                  1c7be730bdc4833afb7117d48c3fd513

                                                                  SHA1

                                                                  dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                  SHA256

                                                                  8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                  SHA512

                                                                  7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  MD5

                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                  SHA1

                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                  SHA256

                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                  SHA512

                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  MD5

                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                  SHA1

                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                  SHA256

                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                  SHA512

                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                  MD5

                                                                  9b0aa8a5cb5f6b49918e8e8f54176e7f

                                                                  SHA1

                                                                  ec63496dc851e5129841a712d7753fb8accfc46d

                                                                  SHA256

                                                                  16ae5fec23f0db171bc882b07106c428fd7c51caf9c201a9f9b41dbe1dfd6118

                                                                  SHA512

                                                                  1653ea31e89a64c27a4d046b0b1ce61c2d706d3858b897fe0d03742b059eb99fcf10b1a83752223f148b6fa6b986fd0877c5e2c894deba71e2ed0a0dab913f09

                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                  MD5

                                                                  9b0aa8a5cb5f6b49918e8e8f54176e7f

                                                                  SHA1

                                                                  ec63496dc851e5129841a712d7753fb8accfc46d

                                                                  SHA256

                                                                  16ae5fec23f0db171bc882b07106c428fd7c51caf9c201a9f9b41dbe1dfd6118

                                                                  SHA512

                                                                  1653ea31e89a64c27a4d046b0b1ce61c2d706d3858b897fe0d03742b059eb99fcf10b1a83752223f148b6fa6b986fd0877c5e2c894deba71e2ed0a0dab913f09

                                                                • C:\Users\Admin\AppData\Roaming\1310755.exe
                                                                  MD5

                                                                  a6104f77447bed23087ba9cbd066ea28

                                                                  SHA1

                                                                  1c357a9aa5c6e4f827aa02d74ac2f4304ac0cb71

                                                                  SHA256

                                                                  f107e9a29912585166cbfdfe3b986d6462542f989b6e3a46f931eba0409731a8

                                                                  SHA512

                                                                  f7de98105fcd859f2038c06b423dd0aa3de5017d43223167740167754571289708ca504eea7cd8fcd8f77cfad41eeca25d9c7101a9b92b55187b8cfed0b85d5d

                                                                • C:\Users\Admin\AppData\Roaming\1310755.exe
                                                                  MD5

                                                                  a6104f77447bed23087ba9cbd066ea28

                                                                  SHA1

                                                                  1c357a9aa5c6e4f827aa02d74ac2f4304ac0cb71

                                                                  SHA256

                                                                  f107e9a29912585166cbfdfe3b986d6462542f989b6e3a46f931eba0409731a8

                                                                  SHA512

                                                                  f7de98105fcd859f2038c06b423dd0aa3de5017d43223167740167754571289708ca504eea7cd8fcd8f77cfad41eeca25d9c7101a9b92b55187b8cfed0b85d5d

                                                                • C:\Users\Admin\AppData\Roaming\2680875.exe
                                                                  MD5

                                                                  815618bf8376e04f8ff39f0a243f0681

                                                                  SHA1

                                                                  279240de60049ed8176f02642a9a05f6df3c2328

                                                                  SHA256

                                                                  7248dd8fac08b0e76020a1d0896f0cbe10824c8e12109bc1e8f3eb7ebb308d84

                                                                  SHA512

                                                                  4b66f76bcdf1707eebdb8b7fa7ddc6b4d1b06d23c77d0d132cd52a4de16a88cff86c8881715dbdeccab6bd1209cc809c07da07a445482bb2c97ed72509c6149c

                                                                • C:\Users\Admin\AppData\Roaming\2680875.exe
                                                                  MD5

                                                                  815618bf8376e04f8ff39f0a243f0681

                                                                  SHA1

                                                                  279240de60049ed8176f02642a9a05f6df3c2328

                                                                  SHA256

                                                                  7248dd8fac08b0e76020a1d0896f0cbe10824c8e12109bc1e8f3eb7ebb308d84

                                                                  SHA512

                                                                  4b66f76bcdf1707eebdb8b7fa7ddc6b4d1b06d23c77d0d132cd52a4de16a88cff86c8881715dbdeccab6bd1209cc809c07da07a445482bb2c97ed72509c6149c

                                                                • C:\Users\Admin\AppData\Roaming\2959807.exe
                                                                  MD5

                                                                  f99305041531b93f102045d22b1ae302

                                                                  SHA1

                                                                  50c81b7bf6021b2ad099e7070869d02ac4370307

                                                                  SHA256

                                                                  b00c3f42c6d90d55c426114ae37b05c46062fc5d265eea3744b56dbb2d58ebb2

                                                                  SHA512

                                                                  98c99f4b4725d39d43af2db6cd364c3bf451e67e10ccef53e92164c96411b9c2d12b9f121e3e93431b47f0a1f0dcb2dc23e6ef71c637c75e37226a81f3b49802

                                                                • C:\Users\Admin\AppData\Roaming\2959807.exe
                                                                  MD5

                                                                  f99305041531b93f102045d22b1ae302

                                                                  SHA1

                                                                  50c81b7bf6021b2ad099e7070869d02ac4370307

                                                                  SHA256

                                                                  b00c3f42c6d90d55c426114ae37b05c46062fc5d265eea3744b56dbb2d58ebb2

                                                                  SHA512

                                                                  98c99f4b4725d39d43af2db6cd364c3bf451e67e10ccef53e92164c96411b9c2d12b9f121e3e93431b47f0a1f0dcb2dc23e6ef71c637c75e37226a81f3b49802

                                                                • C:\Users\Admin\AppData\Roaming\3875848.exe
                                                                  MD5

                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                  SHA1

                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                  SHA256

                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                  SHA512

                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                • C:\Users\Admin\AppData\Roaming\3875848.exe
                                                                  MD5

                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                  SHA1

                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                  SHA256

                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                  SHA512

                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                  MD5

                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                  SHA1

                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                  SHA256

                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                  SHA512

                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                  MD5

                                                                  c75cf058fa1b96eab7f838bc5baa4b4e

                                                                  SHA1

                                                                  5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                  SHA256

                                                                  2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                  SHA512

                                                                  d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                • C:\Users\Admin\Documents\4bz3bLzWc_VCCnWOU8HL4hPc.exe
                                                                  MD5

                                                                  022d93e734cfb3dff2b02b04f2be3805

                                                                  SHA1

                                                                  cddf99f5f9ac0433a89157f5b2a0b0d59760f05b

                                                                  SHA256

                                                                  af0432bcfb1335a630536f390cee089b44fe786e44615adf9b7114f10ee96d28

                                                                  SHA512

                                                                  8dd6bc034ab5fe670423bed63443b89d4dd4fc13f4862d87a83520697e95130270acaa6f7274b7687f6889191b4f2ea5e2f221723f86bfa98f6a822925302ea1

                                                                • C:\Users\Admin\Documents\4bz3bLzWc_VCCnWOU8HL4hPc.exe
                                                                  MD5

                                                                  022d93e734cfb3dff2b02b04f2be3805

                                                                  SHA1

                                                                  cddf99f5f9ac0433a89157f5b2a0b0d59760f05b

                                                                  SHA256

                                                                  af0432bcfb1335a630536f390cee089b44fe786e44615adf9b7114f10ee96d28

                                                                  SHA512

                                                                  8dd6bc034ab5fe670423bed63443b89d4dd4fc13f4862d87a83520697e95130270acaa6f7274b7687f6889191b4f2ea5e2f221723f86bfa98f6a822925302ea1

                                                                • C:\Users\Admin\Documents\4pm0_hnsRUqWzDik8oiLMv3Q.exe
                                                                  MD5

                                                                  dc19f186b7e84db19238ca682cf4abc1

                                                                  SHA1

                                                                  a1a7a9b422ef32ce02d0c8bd12331add66267e7b

                                                                  SHA256

                                                                  71c962d119bbb3b9e80cdf5ed6e6dee4ddb4b178b461beff2a9c61d2729a4549

                                                                  SHA512

                                                                  585017263fe8d7022a7f67808234daf51447fbbf10a032f118bcaf01c371a6d927e9ed27c9f74e69f26244df31a8e8bbfef5ec4f0b5e6296b043c09fbec172ce

                                                                • C:\Users\Admin\Documents\M3WIy_bZZy5_oJc6MEbtyvFl.exe
                                                                  MD5

                                                                  5317edc2e3ee4bfd9331797d6c90745d

                                                                  SHA1

                                                                  8c202292538acdc62e7bbc8ffcdd03aada4e7fed

                                                                  SHA256

                                                                  14955afa5282a05a2fd1f91e6aaeba6f5443c5a93f46f24280fca2f947b08d6b

                                                                  SHA512

                                                                  5d1add9fa5b9a1bcd1e884c5483ef4036181e3252c5607850f9362b26f2029d36ac19a284233d481237d04a725b4486925ad56eac76ddb299b100f7129fd46a4

                                                                • C:\Users\Admin\Documents\M3WIy_bZZy5_oJc6MEbtyvFl.exe
                                                                  MD5

                                                                  5317edc2e3ee4bfd9331797d6c90745d

                                                                  SHA1

                                                                  8c202292538acdc62e7bbc8ffcdd03aada4e7fed

                                                                  SHA256

                                                                  14955afa5282a05a2fd1f91e6aaeba6f5443c5a93f46f24280fca2f947b08d6b

                                                                  SHA512

                                                                  5d1add9fa5b9a1bcd1e884c5483ef4036181e3252c5607850f9362b26f2029d36ac19a284233d481237d04a725b4486925ad56eac76ddb299b100f7129fd46a4

                                                                • C:\Users\Admin\Documents\WXmu3AHkkyazb65LKr9naMyL.exe
                                                                  MD5

                                                                  337d3db995a6ffd8748aaa776138b171

                                                                  SHA1

                                                                  f3bc7c4836b926d2c29933bd004174cf8af1e6cb

                                                                  SHA256

                                                                  3659c9a886b9b3e08e4f5eeb08d40bf9f1729e0869114cd8d390d28e6120e3c4

                                                                  SHA512

                                                                  5d8c9456d4a1a417d6ea9e735bf5ceae8d3456a2acb3517820fae754238937f73ef92f692968ff1a6981617cd2eec019c50e6739e6a9d6179948d1dc47b5df35

                                                                • C:\Users\Admin\Documents\weUvTAgqTwQRgu8G9n4wlehW.exe
                                                                  MD5

                                                                  28aa230a57806766e1e8f76b9497f15b

                                                                  SHA1

                                                                  217cab3dfb23ef1b603711b57638dd6924b7c6ff

                                                                  SHA256

                                                                  6688eb8d2b5f7d211ccfe110f2d27ab6d48ce29b4cfca7551b74eec9c72971c8

                                                                  SHA512

                                                                  d910de1cd07c46c26199a5f94a7eaadb823838181bc103ebe95ec8e254b26e8ada012ed15d56fb2fcdd885282b892b5e5621f990108df3f855e993ba25e37bf4

                                                                • C:\Users\Admin\Documents\weUvTAgqTwQRgu8G9n4wlehW.exe
                                                                  MD5

                                                                  28aa230a57806766e1e8f76b9497f15b

                                                                  SHA1

                                                                  217cab3dfb23ef1b603711b57638dd6924b7c6ff

                                                                  SHA256

                                                                  6688eb8d2b5f7d211ccfe110f2d27ab6d48ce29b4cfca7551b74eec9c72971c8

                                                                  SHA512

                                                                  d910de1cd07c46c26199a5f94a7eaadb823838181bc103ebe95ec8e254b26e8ada012ed15d56fb2fcdd885282b892b5e5621f990108df3f855e993ba25e37bf4

                                                                • C:\Users\Admin\Documents\wrG5BnuIkdvINnunI4467ZlD.exe
                                                                  MD5

                                                                  452a06ffcf043e23c1fb7bdb9bfa5cc4

                                                                  SHA1

                                                                  dba22cb78a25b8bb99ec3ec4b5281ea2b871fb32

                                                                  SHA256

                                                                  6d891aa7e6103eaaf87f072f0ed4e7ca03743d7744acc98610d5d51756f5aab9

                                                                  SHA512

                                                                  c67ce026c249bd12590cfd8ca10149878a1b3f38c60daf91da3cfd0fb0bdaaf12ee26cc36b3b242cbad816632c3922ffd7ebc973155ba42bb75a56affd23747d

                                                                • C:\Users\Admin\Documents\xyLOivfO_wXnS2dFMNtWksKi.exe
                                                                  MD5

                                                                  9c1bfc90d73c761f922a7a39812a8f97

                                                                  SHA1

                                                                  fa913dfc833aa3a91244cc6e982cc1e1ed2ef1fd

                                                                  SHA256

                                                                  349d4a44c8f68f89aedf97b1fb081433dfee27215e4c16ae3bef4915a99d6d62

                                                                  SHA512

                                                                  72293089f884f33e33b574f6d895c869df3371f083cce90243d13dbf497ed25ced99b09c79e6ffc69543b57ecbf8254988207e45948867f97b118c7da9fbc73b

                                                                • C:\Users\Admin\Documents\xyLOivfO_wXnS2dFMNtWksKi.exe
                                                                  MD5

                                                                  9c1bfc90d73c761f922a7a39812a8f97

                                                                  SHA1

                                                                  fa913dfc833aa3a91244cc6e982cc1e1ed2ef1fd

                                                                  SHA256

                                                                  349d4a44c8f68f89aedf97b1fb081433dfee27215e4c16ae3bef4915a99d6d62

                                                                  SHA512

                                                                  72293089f884f33e33b574f6d895c869df3371f083cce90243d13dbf497ed25ced99b09c79e6ffc69543b57ecbf8254988207e45948867f97b118c7da9fbc73b

                                                                • \Users\Admin\AppData\Local\Temp\7zSCB696A74\libcurl.dll
                                                                  MD5

                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                  SHA1

                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                  SHA256

                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                  SHA512

                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                • \Users\Admin\AppData\Local\Temp\7zSCB696A74\libcurlpp.dll
                                                                  MD5

                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                  SHA1

                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                  SHA256

                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                  SHA512

                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                • \Users\Admin\AppData\Local\Temp\7zSCB696A74\libgcc_s_dw2-1.dll
                                                                  MD5

                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                  SHA1

                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                  SHA256

                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                  SHA512

                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                • \Users\Admin\AppData\Local\Temp\7zSCB696A74\libgcc_s_dw2-1.dll
                                                                  MD5

                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                  SHA1

                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                  SHA256

                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                  SHA512

                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                • \Users\Admin\AppData\Local\Temp\7zSCB696A74\libgcc_s_dw2-1.dll
                                                                  MD5

                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                  SHA1

                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                  SHA256

                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                  SHA512

                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                • \Users\Admin\AppData\Local\Temp\7zSCB696A74\libstdc++-6.dll
                                                                  MD5

                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                  SHA1

                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                  SHA256

                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                  SHA512

                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                • \Users\Admin\AppData\Local\Temp\7zSCB696A74\libwinpthread-1.dll
                                                                  MD5

                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                  SHA1

                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                  SHA256

                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                  SHA512

                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                  MD5

                                                                  50741b3f2d7debf5d2bed63d88404029

                                                                  SHA1

                                                                  56210388a627b926162b36967045be06ffb1aad3

                                                                  SHA256

                                                                  f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                  SHA512

                                                                  fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                  MD5

                                                                  1c7be730bdc4833afb7117d48c3fd513

                                                                  SHA1

                                                                  dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                  SHA256

                                                                  8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                  SHA512

                                                                  7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                • memory/196-389-0x0000000000400000-0x0000000000A01000-memory.dmp
                                                                  Filesize

                                                                  6.0MB

                                                                • memory/196-422-0x00000000026C0000-0x000000000275D000-memory.dmp
                                                                  Filesize

                                                                  628KB

                                                                • memory/196-329-0x0000000000000000-mapping.dmp
                                                                • memory/416-512-0x0000000000000000-mapping.dmp
                                                                • memory/484-390-0x0000000000417E1E-mapping.dmp
                                                                • memory/484-416-0x00000000054B0000-0x0000000005AB6000-memory.dmp
                                                                  Filesize

                                                                  6.0MB

                                                                • memory/500-149-0x0000000000000000-mapping.dmp
                                                                • memory/628-357-0x0000000000000000-mapping.dmp
                                                                • memory/764-144-0x0000000000000000-mapping.dmp
                                                                • memory/824-282-0x000001ACA4E40000-0x000001ACA4EB1000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/984-421-0x000001C6CD9F0000-0x000001C6CDA60000-memory.dmp
                                                                  Filesize

                                                                  448KB

                                                                • memory/984-231-0x000001C6CD900000-0x000001C6CD971000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/1064-279-0x0000026D4F9B0000-0x0000026D4FA21000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/1192-291-0x000002156EDA0000-0x000002156EE11000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/1220-204-0x0000015868D10000-0x0000015868DDF000-memory.dmp
                                                                  Filesize

                                                                  828KB

                                                                • memory/1220-198-0x0000015868A80000-0x0000015868AEE000-memory.dmp
                                                                  Filesize

                                                                  440KB

                                                                • memory/1220-156-0x0000000000000000-mapping.dmp
                                                                • memory/1236-283-0x0000019979240000-0x00000199792B1000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/1316-217-0x00000000055E0000-0x00000000055E1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1316-225-0x0000000001480000-0x0000000001481000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1316-182-0x0000000000000000-mapping.dmp
                                                                • memory/1316-197-0x00000000013D0000-0x00000000013D1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1316-206-0x00000000013E0000-0x00000000013EE000-memory.dmp
                                                                  Filesize

                                                                  56KB

                                                                • memory/1316-191-0x0000000000B80000-0x0000000000B81000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1384-396-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                  Filesize

                                                                  48KB

                                                                • memory/1384-385-0x0000000000402F68-mapping.dmp
                                                                • memory/1404-284-0x00000261A62A0000-0x00000261A6311000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/1412-175-0x000000001B1A0000-0x000000001B1A2000-memory.dmp
                                                                  Filesize

                                                                  8KB

                                                                • memory/1412-170-0x0000000000BA0000-0x0000000000BA1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1412-165-0x0000000000480000-0x0000000000481000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1412-155-0x0000000000000000-mapping.dmp
                                                                • memory/1412-173-0x0000000000BB0000-0x0000000000BCE000-memory.dmp
                                                                  Filesize

                                                                  120KB

                                                                • memory/1412-174-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1412-552-0x0000000000000000-mapping.dmp
                                                                • memory/1724-114-0x0000000000000000-mapping.dmp
                                                                • memory/1864-243-0x0000000000400000-0x0000000002C4B000-memory.dmp
                                                                  Filesize

                                                                  40.3MB

                                                                • memory/1864-154-0x0000000000000000-mapping.dmp
                                                                • memory/1864-181-0x0000000002CF0000-0x0000000002D9E000-memory.dmp
                                                                  Filesize

                                                                  696KB

                                                                • memory/1916-292-0x000001F260A40000-0x000001F260AB1000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/2116-406-0x0000000004A0B000-0x0000000004B0C000-memory.dmp
                                                                  Filesize

                                                                  1.0MB

                                                                • memory/2116-414-0x0000000001040000-0x000000000109C000-memory.dmp
                                                                  Filesize

                                                                  368KB

                                                                • memory/2116-387-0x0000000000000000-mapping.dmp
                                                                • memory/2120-344-0x0000000000D80000-0x0000000000D81000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2120-372-0x0000000005760000-0x0000000005761000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2120-317-0x0000000000000000-mapping.dmp
                                                                • memory/2168-511-0x0000000000417E0E-mapping.dmp
                                                                • memory/2300-248-0x000002127BCC0000-0x000002127BD31000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/2316-239-0x0000018276600000-0x0000018276671000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/2344-393-0x0000000000AA0000-0x0000000000AAC000-memory.dmp
                                                                  Filesize

                                                                  48KB

                                                                • memory/2344-318-0x0000000000000000-mapping.dmp
                                                                • memory/2392-151-0x0000000000000000-mapping.dmp
                                                                • memory/2504-289-0x0000000000A80000-0x0000000000A95000-memory.dmp
                                                                  Filesize

                                                                  84KB

                                                                • memory/2516-171-0x0000000000000000-mapping.dmp
                                                                • memory/2536-415-0x000001EA0B0C0000-0x000001EA0B130000-memory.dmp
                                                                  Filesize

                                                                  448KB

                                                                • memory/2536-222-0x000001EA0B040000-0x000001EA0B0B1000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/2548-296-0x000002689CE00000-0x000002689CE71000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/2556-302-0x00000244DEB70000-0x00000244DEBE1000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/2600-186-0x0000000000000000-mapping.dmp
                                                                • memory/2600-240-0x0000000003120000-0x000000000317D000-memory.dmp
                                                                  Filesize

                                                                  372KB

                                                                • memory/2600-238-0x0000000004A29000-0x0000000004B2A000-memory.dmp
                                                                  Filesize

                                                                  1.0MB

                                                                • memory/2612-670-0x0000000000000000-mapping.dmp
                                                                • memory/2624-319-0x0000000000000000-mapping.dmp
                                                                • memory/2624-386-0x0000015F36E00000-0x0000015F36E70000-memory.dmp
                                                                  Filesize

                                                                  448KB

                                                                • memory/2652-134-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                  Filesize

                                                                  152KB

                                                                • memory/2652-135-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                  Filesize

                                                                  1.1MB

                                                                • memory/2652-117-0x0000000000000000-mapping.dmp
                                                                • memory/2652-132-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                  Filesize

                                                                  572KB

                                                                • memory/2652-162-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                  Filesize

                                                                  100KB

                                                                • memory/2652-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                  Filesize

                                                                  1.5MB

                                                                • memory/2652-169-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                  Filesize

                                                                  100KB

                                                                • memory/2652-164-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                  Filesize

                                                                  100KB

                                                                • memory/2652-166-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                  Filesize

                                                                  100KB

                                                                • memory/2772-190-0x0000000000E40000-0x0000000000E41000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2772-234-0x0000000005790000-0x0000000005791000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2772-178-0x0000000000000000-mapping.dmp
                                                                • memory/2772-307-0x0000000008BC0000-0x0000000008BC1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2772-300-0x0000000008550000-0x0000000008551000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2772-232-0x0000000003090000-0x00000000030B8000-memory.dmp
                                                                  Filesize

                                                                  160KB

                                                                • memory/2828-403-0x000001E696000000-0x000001E696106000-memory.dmp
                                                                  Filesize

                                                                  1.0MB

                                                                • memory/2828-224-0x000001E693970000-0x000001E6939E1000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/2828-208-0x00007FF64FFA4060-mapping.dmp
                                                                • memory/2828-400-0x000001E6951A0000-0x000001E6951BB000-memory.dmp
                                                                  Filesize

                                                                  108KB

                                                                • memory/2904-440-0x0000000000000000-mapping.dmp
                                                                • memory/2956-290-0x00000000053C0000-0x00000000059C6000-memory.dmp
                                                                  Filesize

                                                                  6.0MB

                                                                • memory/2956-214-0x0000000000000000-mapping.dmp
                                                                • memory/2956-257-0x0000000000C60000-0x0000000000C61000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2956-247-0x0000000076F30000-0x00000000770BE000-memory.dmp
                                                                  Filesize

                                                                  1.6MB

                                                                • memory/3064-176-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/3064-179-0x0000000000400000-0x0000000002BF0000-memory.dmp
                                                                  Filesize

                                                                  39.9MB

                                                                • memory/3064-150-0x0000000000000000-mapping.dmp
                                                                • memory/3080-212-0x0000000007210000-0x0000000007211000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-229-0x00000000072F4000-0x00000000072F6000-memory.dmp
                                                                  Filesize

                                                                  8KB

                                                                • memory/3080-230-0x0000000007270000-0x0000000007271000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-207-0x00000000071F0000-0x00000000071F1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-255-0x0000000007F20000-0x0000000007F21000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-253-0x00000000072F3000-0x00000000072F4000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-200-0x0000000004C50000-0x0000000004C69000-memory.dmp
                                                                  Filesize

                                                                  100KB

                                                                • memory/3080-250-0x00000000072F2000-0x00000000072F3000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-215-0x00000000072F0000-0x00000000072F1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-203-0x0000000007800000-0x0000000007801000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-163-0x0000000000000000-mapping.dmp
                                                                • memory/3080-211-0x0000000000400000-0x0000000002C08000-memory.dmp
                                                                  Filesize

                                                                  40.0MB

                                                                • memory/3080-196-0x0000000007300000-0x0000000007301000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3080-177-0x0000000002C60000-0x0000000002D0E000-memory.dmp
                                                                  Filesize

                                                                  696KB

                                                                • memory/3080-194-0x0000000003070000-0x000000000308B000-memory.dmp
                                                                  Filesize

                                                                  108KB

                                                                • memory/3236-669-0x0000000000000000-mapping.dmp
                                                                • memory/3364-148-0x0000000000000000-mapping.dmp
                                                                • memory/3400-145-0x0000000000000000-mapping.dmp
                                                                • memory/3428-394-0x0000000000417E1A-mapping.dmp
                                                                • memory/3428-420-0x00000000056C0000-0x0000000005CC6000-memory.dmp
                                                                  Filesize

                                                                  6.0MB

                                                                • memory/3636-201-0x0000018630E20000-0x0000018630E6C000-memory.dmp
                                                                  Filesize

                                                                  304KB

                                                                • memory/3636-410-0x0000018631140000-0x000001863118B000-memory.dmp
                                                                  Filesize

                                                                  300KB

                                                                • memory/3636-205-0x00000186311B0000-0x0000018631221000-memory.dmp
                                                                  Filesize

                                                                  452KB

                                                                • memory/3636-412-0x0000018631400000-0x0000018631470000-memory.dmp
                                                                  Filesize

                                                                  448KB

                                                                • memory/3712-157-0x0000000000000000-mapping.dmp
                                                                • memory/3740-143-0x0000000000000000-mapping.dmp
                                                                • memory/3788-147-0x0000000000000000-mapping.dmp
                                                                • memory/3880-309-0x0000000000000000-mapping.dmp
                                                                • memory/3992-146-0x0000000000000000-mapping.dmp
                                                                • memory/4120-663-0x0000000000000000-mapping.dmp
                                                                • memory/4128-218-0x0000000000000000-mapping.dmp
                                                                • memory/4128-272-0x00000000055F0000-0x000000000562E000-memory.dmp
                                                                  Filesize

                                                                  248KB

                                                                • memory/4128-233-0x0000000000E20000-0x0000000000E21000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4128-286-0x0000000005670000-0x0000000005671000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4148-491-0x0000000000000000-mapping.dmp
                                                                • memory/4172-377-0x0000000005CF0000-0x0000000005CF1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4172-347-0x0000000076F30000-0x00000000770BE000-memory.dmp
                                                                  Filesize

                                                                  1.6MB

                                                                • memory/4172-321-0x0000000000000000-mapping.dmp
                                                                • memory/4296-489-0x0000000000000000-mapping.dmp
                                                                • memory/4312-338-0x0000000000000000-mapping.dmp
                                                                • memory/4420-241-0x0000000000000000-mapping.dmp
                                                                • memory/4420-280-0x0000000004F00000-0x0000000004F01000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4420-295-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4428-346-0x0000000000000000-mapping.dmp
                                                                • memory/4428-354-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                  Filesize

                                                                  64KB

                                                                • memory/4428-356-0x0000000000570000-0x00000000006BA000-memory.dmp
                                                                  Filesize

                                                                  1.3MB

                                                                • memory/4448-350-0x0000000000000000-mapping.dmp
                                                                • memory/4560-261-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                  Filesize

                                                                  340KB

                                                                • memory/4560-254-0x0000000000000000-mapping.dmp
                                                                • memory/4572-632-0x0000000000000000-mapping.dmp
                                                                • memory/4616-526-0x0000000000000000-mapping.dmp
                                                                • memory/4616-331-0x0000000000000000-mapping.dmp
                                                                • memory/4616-374-0x0000000004D00000-0x0000000004D01000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4616-340-0x0000000000210000-0x0000000000211000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4616-348-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4620-429-0x0000000000000000-mapping.dmp
                                                                • memory/4632-479-0x0000000000417E2A-mapping.dmp
                                                                • memory/4636-383-0x0000000000000000-mapping.dmp
                                                                • memory/4680-353-0x0000000000000000-mapping.dmp
                                                                • memory/4724-363-0x0000000000000000-mapping.dmp
                                                                • memory/4780-341-0x00000000003F0000-0x00000000003F1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4780-315-0x0000000000000000-mapping.dmp
                                                                • memory/4780-371-0x0000000004E50000-0x0000000004E51000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4804-521-0x0000000000000000-mapping.dmp
                                                                • memory/4864-330-0x0000000000000000-mapping.dmp
                                                                • memory/4908-316-0x0000000000000000-mapping.dmp
                                                                • memory/4908-333-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4956-652-0x0000000000000000-mapping.dmp
                                                                • memory/5040-380-0x0000000005700000-0x0000000005D06000-memory.dmp
                                                                  Filesize

                                                                  6.0MB

                                                                • memory/5040-351-0x0000000076F30000-0x00000000770BE000-memory.dmp
                                                                  Filesize

                                                                  1.6MB

                                                                • memory/5040-320-0x0000000000000000-mapping.dmp
                                                                • memory/5068-322-0x0000000000000000-mapping.dmp
                                                                • memory/5080-490-0x0000000000000000-mapping.dmp