Resubmissions

18-07-2021 23:15

210718-8mclhk3vee 10

18-07-2021 12:39

210718-kbyfzfwmz6 10

17-07-2021 14:35

210717-3g56vnsqx6 10

17-07-2021 03:02

210717-tl7wh7rk7a 10

17-07-2021 01:17

210717-jcjcez4sga 10

17-07-2021 01:17

210717-2sh9r7npcs 10

16-07-2021 23:01

210716-mql5d5v4ba 10

Analysis

  • max time kernel
    1805s
  • max time network
    1811s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    18-07-2021 23:15

General

  • Target

    FD3E3 (22).exe

  • Size

    2.7MB

  • MD5

    fd3e375cbd09c6e1260ce52d3fe91b9c

  • SHA1

    59eac2602d5955b8d846fb337665bfc43934c87e

  • SHA256

    036d1b5b7a9bc9526fb0825cebe7b937ef0a8e00428a4ffc15eeb41858efc854

  • SHA512

    f9ee4e85f1f7ea23c7c51b72fa43c87bb06168856c4dfead982c64dcba3c11a5129a045c510c15fad213e808f476e7d56848d249d639bed1dd4353749e337810

Malware Config

Extracted

Path

C:\_readme.txt

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-mNr1oio2P6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: managerhelper@airmail.cc Your personal ID: 0316ewgfDdNcBG8wI6Q1WFhUNlCRyjmrWGeGew2vvCKtJgKot1
Emails

manager@mailtemp.ch

managerhelper@airmail.cc

URLs

https://we.tl/t-mNr1oio2P6

Extracted

Family

vidar

Version

39.4

Botnet

933

C2

https://sergeevih43.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

redline

Botnet

Cana

C2

176.111.174.254:56328

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.6

Botnet

865

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    865

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 5 IoCs
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 28 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 13 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 24 IoCs
  • autoit_exe 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
      PID:1120
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
      1⤵
        PID:1896
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2760
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:2752
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Browser
          1⤵
            PID:2596
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2484
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2416
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1448
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1316
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1268
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1032
                      • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                        C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                        2⤵
                        • Suspicious use of SetThreadContext
                        PID:5436
                        • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                          C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                          3⤵
                            PID:5840
                        • C:\Users\Admin\AppData\Roaming\cjjusva
                          C:\Users\Admin\AppData\Roaming\cjjusva
                          2⤵
                          • Loads dropped DLL
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:5488
                        • C:\Users\Admin\AppData\Roaming\rijusva
                          C:\Users\Admin\AppData\Roaming\rijusva
                          2⤵
                          • Suspicious use of SetThreadContext
                          PID:4876
                          • C:\Users\Admin\AppData\Roaming\rijusva
                            C:\Users\Admin\AppData\Roaming\rijusva
                            3⤵
                            • Loads dropped DLL
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: MapViewOfSection
                            PID:5128
                        • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                          C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                          2⤵
                          • Suspicious use of SetThreadContext
                          PID:5968
                          • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                            C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                            3⤵
                              PID:4488
                          • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                            C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                            2⤵
                            • Suspicious use of SetThreadContext
                            PID:2624
                            • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                              C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                              3⤵
                                PID:2740
                            • C:\Users\Admin\AppData\Roaming\cjjusva
                              C:\Users\Admin\AppData\Roaming\cjjusva
                              2⤵
                              • Loads dropped DLL
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: MapViewOfSection
                              PID:3320
                            • C:\Users\Admin\AppData\Roaming\rijusva
                              C:\Users\Admin\AppData\Roaming\rijusva
                              2⤵
                              • Suspicious use of SetThreadContext
                              PID:3776
                              • C:\Users\Admin\AppData\Roaming\rijusva
                                C:\Users\Admin\AppData\Roaming\rijusva
                                3⤵
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: MapViewOfSection
                                PID:5696
                            • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                              C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                              2⤵
                              • Suspicious use of SetThreadContext
                              PID:4260
                              • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                                C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                                3⤵
                                  PID:2120
                              • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                                C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                                2⤵
                                • Suspicious use of SetThreadContext
                                PID:3156
                                • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                                  C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                                  3⤵
                                    PID:6096
                                • C:\Users\Admin\AppData\Roaming\cjjusva
                                  C:\Users\Admin\AppData\Roaming\cjjusva
                                  2⤵
                                  • Loads dropped DLL
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: MapViewOfSection
                                  PID:5968
                                • C:\Users\Admin\AppData\Roaming\rijusva
                                  C:\Users\Admin\AppData\Roaming\rijusva
                                  2⤵
                                  • Suspicious use of SetThreadContext
                                  PID:2288
                                  • C:\Users\Admin\AppData\Roaming\rijusva
                                    C:\Users\Admin\AppData\Roaming\rijusva
                                    3⤵
                                    • Loads dropped DLL
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: MapViewOfSection
                                    PID:4916
                                • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                                  C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                                  2⤵
                                  • Suspicious use of SetThreadContext
                                  PID:5024
                                  • C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe
                                    C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8\EC74.exe --Task
                                    3⤵
                                      PID:1820
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                  1⤵
                                    PID:68
                                  • C:\Users\Admin\AppData\Local\Temp\FD3E3 (22).exe
                                    "C:\Users\Admin\AppData\Local\Temp\FD3E3 (22).exe"
                                    1⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3628
                                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:3860
                                      • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\setup_install.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zS41F50854\setup_install.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of WriteProcessMemory
                                        PID:1252
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sonia_1.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3760
                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_1.exe
                                            sonia_1.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2796
                                            • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_1.exe
                                              "C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_1.exe" -a
                                              6⤵
                                              • Executes dropped EXE
                                              PID:3500
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sonia_3.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1076
                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_3.exe
                                            sonia_3.exe
                                            5⤵
                                            • Executes dropped EXE
                                            PID:2876
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 1692
                                              6⤵
                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                              • Program crash
                                              PID:5092
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sonia_4.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3980
                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_4.exe
                                            sonia_4.exe
                                            5⤵
                                            • Executes dropped EXE
                                            PID:3628
                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              6⤵
                                              • Executes dropped EXE
                                              PID:4944
                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              6⤵
                                              • Executes dropped EXE
                                              PID:3760
                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              6⤵
                                                PID:5708
                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                6⤵
                                                  PID:3044
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sonia_2.exe
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1080
                                              • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_2.exe
                                                sonia_2.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Checks SCSI registry key(s)
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: MapViewOfSection
                                                PID:2504
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sonia_5.exe
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3348
                                              • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_5.exe
                                                sonia_5.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:3944
                                                • C:\Users\Admin\AppData\Roaming\7470346.exe
                                                  "C:\Users\Admin\AppData\Roaming\7470346.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1216
                                                • C:\Users\Admin\AppData\Roaming\4294558.exe
                                                  "C:\Users\Admin\AppData\Roaming\4294558.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  PID:2676
                                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                    7⤵
                                                    • Executes dropped EXE
                                                    PID:4476
                                                • C:\Users\Admin\AppData\Roaming\8229145.exe
                                                  "C:\Users\Admin\AppData\Roaming\8229145.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Checks BIOS information in registry
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:4108
                                                • C:\Users\Admin\AppData\Roaming\2375528.exe
                                                  "C:\Users\Admin\AppData\Roaming\2375528.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4176
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sonia_6.exe
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3852
                                              • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_6.exe
                                                sonia_6.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Checks computer location settings
                                                PID:2764
                                                • C:\Users\Admin\Documents\UCuRJgGKng8bNMFAza8pqTEd.exe
                                                  "C:\Users\Admin\Documents\UCuRJgGKng8bNMFAza8pqTEd.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:4976
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svehost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\svehost.exe"
                                                    7⤵
                                                      PID:4692
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svehost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\svehost.exe"
                                                        8⤵
                                                        • Adds Run key to start application
                                                        PID:3376
                                                    • C:\Users\Admin\AppData\Local\svehost.exe
                                                      "C:\Users\Admin\AppData\Local\svehost.exe"
                                                      7⤵
                                                      • Suspicious use of SetThreadContext
                                                      PID:5140
                                                      • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                                                        8⤵
                                                          PID:212
                                                    • C:\Users\Admin\Documents\h3Jpm22Gxiqwi2mMTNI6ysY4.exe
                                                      "C:\Users\Admin\Documents\h3Jpm22Gxiqwi2mMTNI6ysY4.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:5004
                                                      • C:\Users\Admin\Documents\h3Jpm22Gxiqwi2mMTNI6ysY4.exe
                                                        C:\Users\Admin\Documents\h3Jpm22Gxiqwi2mMTNI6ysY4.exe
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:4424
                                                    • C:\Users\Admin\Documents\uSCcY3WbxmEUg7z_bm0uKtMC.exe
                                                      "C:\Users\Admin\Documents\uSCcY3WbxmEUg7z_bm0uKtMC.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Checks BIOS information in registry
                                                      • Checks whether UAC is enabled
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      PID:1756
                                                    • C:\Users\Admin\Documents\5CJj5T2bZVVRKKqlQXEpkP3A.exe
                                                      "C:\Users\Admin\Documents\5CJj5T2bZVVRKKqlQXEpkP3A.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      PID:5076
                                                      • C:\Users\Admin\AppData\Local\Temp\1033385943.exe
                                                        C:\Users\Admin\AppData\Local\Temp\1033385943.exe
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:3144
                                                        • C:\Users\Admin\AppData\Local\Temp\1033385943.exe
                                                          C:\Users\Admin\AppData\Local\Temp\1033385943.exe
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:5636
                                                      • C:\Users\Admin\AppData\Local\Temp\1682185869.exe
                                                        C:\Users\Admin\AppData\Local\Temp\1682185869.exe
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Checks BIOS information in registry
                                                        • Checks whether UAC is enabled
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious use of SetThreadContext
                                                        PID:5000
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\5CJj5T2bZVVRKKqlQXEpkP3A.exe & exit
                                                        7⤵
                                                          PID:5700
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping 0
                                                            8⤵
                                                            • Runs ping.exe
                                                            PID:5660
                                                      • C:\Users\Admin\Documents\SeRZ5yLCWy4kAsQ1ZjLYnZRT.exe
                                                        "C:\Users\Admin\Documents\SeRZ5yLCWy4kAsQ1ZjLYnZRT.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:4920
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:2796
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im chrome.exe
                                                            8⤵
                                                            • Kills process with taskkill
                                                            PID:5280
                                                      • C:\Users\Admin\Documents\bMewF9Z_LxrbfOZDWvw945xa.exe
                                                        "C:\Users\Admin\Documents\bMewF9Z_LxrbfOZDWvw945xa.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:5016
                                                        • C:\Windows\system32\WerFault.exe
                                                          C:\Windows\system32\WerFault.exe -u -p 5016 -s 1364
                                                          7⤵
                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                          • Program crash
                                                          PID:2884
                                                      • C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe
                                                        "C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:5020
                                                        • C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe
                                                          C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:212
                                                        • C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe
                                                          C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:4212
                                                      • C:\Users\Admin\Documents\J0gxE9i2QldAh7nEVElA54f0.exe
                                                        "C:\Users\Admin\Documents\J0gxE9i2QldAh7nEVElA54f0.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:5000
                                                        • C:\Users\Admin\Documents\J0gxE9i2QldAh7nEVElA54f0.exe
                                                          "C:\Users\Admin\Documents\J0gxE9i2QldAh7nEVElA54f0.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:4592
                                                      • C:\Users\Admin\Documents\hi0qOwC_5PR0mChGHX8FjYEC.exe
                                                        "C:\Users\Admin\Documents\hi0qOwC_5PR0mChGHX8FjYEC.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4964
                                                        • C:\Users\Admin\Documents\hi0qOwC_5PR0mChGHX8FjYEC.exe
                                                          C:\Users\Admin\Documents\hi0qOwC_5PR0mChGHX8FjYEC.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:3912
                                                        • C:\Users\Admin\Documents\hi0qOwC_5PR0mChGHX8FjYEC.exe
                                                          C:\Users\Admin\Documents\hi0qOwC_5PR0mChGHX8FjYEC.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:4516
                                                      • C:\Users\Admin\Documents\8Aqb8mOvFa1JGG3oGHK1sjdp.exe
                                                        "C:\Users\Admin\Documents\8Aqb8mOvFa1JGG3oGHK1sjdp.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4792
                                                        • C:\Users\Admin\Documents\8Aqb8mOvFa1JGG3oGHK1sjdp.exe
                                                          C:\Users\Admin\Documents\8Aqb8mOvFa1JGG3oGHK1sjdp.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:2428
                                                        • C:\Users\Admin\Documents\8Aqb8mOvFa1JGG3oGHK1sjdp.exe
                                                          C:\Users\Admin\Documents\8Aqb8mOvFa1JGG3oGHK1sjdp.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:496
                                                      • C:\Users\Admin\Documents\tHbOxgPZdxF2lhtVZFAbXFJk.exe
                                                        "C:\Users\Admin\Documents\tHbOxgPZdxF2lhtVZFAbXFJk.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks processor information in registry
                                                        PID:5040
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im tHbOxgPZdxF2lhtVZFAbXFJk.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\tHbOxgPZdxF2lhtVZFAbXFJk.exe" & del C:\ProgramData\*.dll & exit
                                                          7⤵
                                                            PID:5620
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /im tHbOxgPZdxF2lhtVZFAbXFJk.exe /f
                                                              8⤵
                                                              • Kills process with taskkill
                                                              PID:5796
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout /t 6
                                                              8⤵
                                                              • Delays execution with timeout.exe
                                                              PID:5568
                                                        • C:\Users\Admin\Documents\3mKLvlcTu54u6Oh8qRxn3tkr.exe
                                                          "C:\Users\Admin\Documents\3mKLvlcTu54u6Oh8qRxn3tkr.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Checks BIOS information in registry
                                                          • Checks whether UAC is enabled
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          PID:4296
                                                        • C:\Users\Admin\Documents\uQKOtv2UKyGDPDTi0APdwmZR.exe
                                                          "C:\Users\Admin\Documents\uQKOtv2UKyGDPDTi0APdwmZR.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          PID:4184
                                                        • C:\Users\Admin\Documents\ekkBW0FPcuiFTpvqlrz82xS7.exe
                                                          "C:\Users\Admin\Documents\ekkBW0FPcuiFTpvqlrz82xS7.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:3348
                                                          • C:\Users\Admin\Documents\ekkBW0FPcuiFTpvqlrz82xS7.exe
                                                            "C:\Users\Admin\Documents\ekkBW0FPcuiFTpvqlrz82xS7.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Modifies data under HKEY_USERS
                                                            PID:5612
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 628
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Program crash
                                                            PID:4652
                                                        • C:\Users\Admin\Documents\q8zTb7iwduEeY9w8No5aiDgV.exe
                                                          "C:\Users\Admin\Documents\q8zTb7iwduEeY9w8No5aiDgV.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:4684
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 656
                                                            7⤵
                                                            • Program crash
                                                            PID:196
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 668
                                                            7⤵
                                                            • Program crash
                                                            PID:2376
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 672
                                                            7⤵
                                                            • Program crash
                                                            PID:4364
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 680
                                                            7⤵
                                                            • Program crash
                                                            PID:4396
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 1076
                                                            7⤵
                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                            • Program crash
                                                            PID:2648
                                                        • C:\Users\Admin\Documents\ndJVbythz5JY4aCg8o19Bvsq.exe
                                                          "C:\Users\Admin\Documents\ndJVbythz5JY4aCg8o19Bvsq.exe"
                                                          6⤵
                                                            PID:4652
                                                            • C:\Users\Admin\Documents\ndJVbythz5JY4aCg8o19Bvsq.exe
                                                              "C:\Users\Admin\Documents\ndJVbythz5JY4aCg8o19Bvsq.exe" -a
                                                              7⤵
                                                                PID:2796
                                                            • C:\Users\Admin\Documents\pqViKIjVEMPu8ocEX6m3TWAD.exe
                                                              "C:\Users\Admin\Documents\pqViKIjVEMPu8ocEX6m3TWAD.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              PID:184
                                                              • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                7⤵
                                                                  PID:4516
                                                                • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                  "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  PID:2636
                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    PID:2880
                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    PID:5908
                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                    8⤵
                                                                      PID:5036
                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      8⤵
                                                                        PID:4456
                                                                    • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                      "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                      7⤵
                                                                        PID:4240
                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                          8⤵
                                                                          • Loads dropped DLL
                                                                          • Modifies registry class
                                                                          PID:2136
                                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                        7⤵
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • Drops file in Program Files directory
                                                                        PID:4352
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                  4⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1544
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_7.exe
                                                                    sonia_7.exe
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    PID:1904
                                                          • \??\c:\windows\system32\svchost.exe
                                                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                            1⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3008
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Checks processor information in registry
                                                              • Modifies data under HKEY_USERS
                                                              • Modifies registry class
                                                              PID:2180
                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                            1⤵
                                                            • Process spawned unexpected child process
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2544
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                              2⤵
                                                              • Loads dropped DLL
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3156
                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                            1⤵
                                                            • Process spawned unexpected child process
                                                            PID:2784
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Checks computer location settings
                                                              • Loads dropped DLL
                                                              PID:4240
                                                          • C:\Users\Admin\AppData\Local\Temp\EC74.exe
                                                            C:\Users\Admin\AppData\Local\Temp\EC74.exe
                                                            1⤵
                                                              PID:5284
                                                              • C:\Users\Admin\AppData\Local\Temp\EC74.exe
                                                                C:\Users\Admin\AppData\Local\Temp\EC74.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                PID:5720
                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                  icacls "C:\Users\Admin\AppData\Local\3e7ffc88-cd2e-48a2-82d1-6f6ed42e8be8" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  PID:5240
                                                                • C:\Users\Admin\AppData\Local\Temp\EC74.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\EC74.exe" --Admin IsNotAutoStart IsNotTask
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:5456
                                                                  • C:\Users\Admin\AppData\Local\Temp\EC74.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\EC74.exe" --Admin IsNotAutoStart IsNotTask
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    • Modifies extensions of user files
                                                                    PID:5644
                                                                    • C:\Users\Admin\AppData\Local\77229995-4b24-404e-a8f9-0d79ce1c531a\build2.exe
                                                                      "C:\Users\Admin\AppData\Local\77229995-4b24-404e-a8f9-0d79ce1c531a\build2.exe"
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:6100
                                                                      • C:\Users\Admin\AppData\Local\77229995-4b24-404e-a8f9-0d79ce1c531a\build2.exe
                                                                        "C:\Users\Admin\AppData\Local\77229995-4b24-404e-a8f9-0d79ce1c531a\build2.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks processor information in registry
                                                                        PID:5228
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\77229995-4b24-404e-a8f9-0d79ce1c531a\build2.exe" & del C:\ProgramData\*.dll & exit
                                                                          7⤵
                                                                            PID:3876
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im build2.exe /f
                                                                              8⤵
                                                                              • Kills process with taskkill
                                                                              PID:5292
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 6
                                                                              8⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:5696
                                                              • \??\c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                1⤵
                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                PID:6016
                                                              • C:\Users\Admin\AppData\Local\Temp\7BD.exe
                                                                C:\Users\Admin\AppData\Local\Temp\7BD.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:4000
                                                              • C:\Users\Admin\AppData\Local\Temp\4295.exe
                                                                C:\Users\Admin\AppData\Local\Temp\4295.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Checks processor information in registry
                                                                • NTFS ADS
                                                                PID:5364
                                                                • C:\ProgramData\OLQGM9RJVDF4VTAC.exe
                                                                  "C:\ProgramData\OLQGM9RJVDF4VTAC.exe"
                                                                  2⤵
                                                                    PID:5768
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im 4295.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4295.exe" & del C:\ProgramData\*.dll & exit
                                                                    2⤵
                                                                    • Blocklisted process makes network request
                                                                    PID:2764
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /im 4295.exe /f
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • Kills process with taskkill
                                                                      PID:5284
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout /t 6
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:4956
                                                                • C:\Users\Admin\AppData\Local\Temp\4C4A.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\4C4A.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:2284
                                                                  • C:\Users\Admin\AppData\Local\Temp\4C4A.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\4C4A.exe
                                                                    2⤵
                                                                      PID:5816
                                                                    • C:\Users\Admin\AppData\Local\Temp\4C4A.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\4C4A.exe
                                                                      2⤵
                                                                        PID:3156
                                                                    • C:\Users\Admin\AppData\Local\Temp\4F78.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\4F78.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:5796
                                                                      • C:\Users\Admin\AppData\Local\Temp\4F78.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\4F78.exe
                                                                        2⤵
                                                                          PID:4960
                                                                      • C:\Users\Admin\AppData\Local\Temp\50E0.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\50E0.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:5340
                                                                      • C:\Users\Admin\AppData\Local\Temp\51FA.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\51FA.exe
                                                                        1⤵
                                                                          PID:5656
                                                                        • C:\Users\Admin\AppData\Local\Temp\548C.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\548C.exe
                                                                          1⤵
                                                                            PID:5344
                                                                          • C:\Users\Admin\AppData\Local\Temp\57C9.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\57C9.exe
                                                                            1⤵
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:2432
                                                                            • C:\Users\Admin\AppData\Local\Temp\57C9.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\57C9.exe
                                                                              2⤵
                                                                                PID:1756
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 164
                                                                                  3⤵
                                                                                  • Program crash
                                                                                  PID:2256
                                                                            • C:\Users\Admin\AppData\Local\Temp\5A98.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\5A98.exe
                                                                              1⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:4980
                                                                              • C:\Users\Admin\AppData\Local\Temp\5A98.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\5A98.exe
                                                                                2⤵
                                                                                  PID:5592
                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                1⤵
                                                                                  PID:5148
                                                                                • C:\Windows\explorer.exe
                                                                                  C:\Windows\explorer.exe
                                                                                  1⤵
                                                                                    PID:5580
                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                    1⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:5752
                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                    1⤵
                                                                                    • Modifies Internet Explorer settings
                                                                                    PID:5944
                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                    1⤵
                                                                                      PID:4812
                                                                                    • C:\Windows\explorer.exe
                                                                                      C:\Windows\explorer.exe
                                                                                      1⤵
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      PID:4420
                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                      1⤵
                                                                                        PID:5820
                                                                                      • C:\Windows\explorer.exe
                                                                                        C:\Windows\explorer.exe
                                                                                        1⤵
                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                        PID:4520
                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                        1⤵
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:5672
                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                        1⤵
                                                                                        • Modifies Internet Explorer settings
                                                                                        • Modifies registry class
                                                                                        PID:4344
                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                        1⤵
                                                                                          PID:2368
                                                                                        • C:\Windows\explorer.exe
                                                                                          C:\Windows\explorer.exe
                                                                                          1⤵
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          PID:4552
                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                          1⤵
                                                                                            PID:4600
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            PID:5212
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            PID:5980
                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            PID:5544

                                                                                          Network

                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                          Persistence

                                                                                          Modify Existing Service

                                                                                          1
                                                                                          T1031

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1060

                                                                                          Defense Evasion

                                                                                          Modify Registry

                                                                                          3
                                                                                          T1112

                                                                                          Disabling Security Tools

                                                                                          1
                                                                                          T1089

                                                                                          Virtualization/Sandbox Evasion

                                                                                          1
                                                                                          T1497

                                                                                          File Permissions Modification

                                                                                          1
                                                                                          T1222

                                                                                          Credential Access

                                                                                          Credentials in Files

                                                                                          4
                                                                                          T1081

                                                                                          Discovery

                                                                                          Query Registry

                                                                                          6
                                                                                          T1012

                                                                                          Virtualization/Sandbox Evasion

                                                                                          1
                                                                                          T1497

                                                                                          System Information Discovery

                                                                                          6
                                                                                          T1082

                                                                                          Peripheral Device Discovery

                                                                                          1
                                                                                          T1120

                                                                                          Remote System Discovery

                                                                                          1
                                                                                          T1018

                                                                                          Collection

                                                                                          Data from Local System

                                                                                          4
                                                                                          T1005

                                                                                          Command and Control

                                                                                          Web Service

                                                                                          1
                                                                                          T1102

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                            MD5

                                                                                            c5a9ce1892a98121935b43ab8222c4f3

                                                                                            SHA1

                                                                                            a7a34c4fce1d81749cd6cfe23d4b94ed7d15a6e6

                                                                                            SHA256

                                                                                            fd47bf675ebaeb26df49153964585bacfbced2be231e1d735f0292b3e23f01a3

                                                                                            SHA512

                                                                                            8ba453e5cffa76c9bbb5b600a0748fe0ca45999154fe5f193c42f66219f482aad405c8253226b0209f5b986d56ba6cd934a5760b98b095d80b75d823660beccc

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                            MD5

                                                                                            56b4f062e2c9a365f28f984300b5b9cf

                                                                                            SHA1

                                                                                            890578ed31bcf59ef7e1bea7a73ddb67a8d685d1

                                                                                            SHA256

                                                                                            f9e924ff62882b2683fa735a99737aa8c1c912c9f38653274c516b6ef09ea637

                                                                                            SHA512

                                                                                            b17e48599ef7d86fe41757aa589a704ab186125927fc76e8df89012a12834b19d0748d72362f6527cc65ca5cd03324f7c4c23eb12350a390d4f620cf80b1e59f

                                                                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                            MD5

                                                                                            cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                            SHA1

                                                                                            b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                            SHA256

                                                                                            0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                            SHA512

                                                                                            4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                            MD5

                                                                                            cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                            SHA1

                                                                                            b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                            SHA256

                                                                                            0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                            SHA512

                                                                                            4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                            MD5

                                                                                            cccf90ef6caa1c720eb17ccba041b365

                                                                                            SHA1

                                                                                            55e66eca9cf8e2fb2e2b1cc80907d14e617a13f8

                                                                                            SHA256

                                                                                            252dd54cd72c470bd4dc0011f8937e5075b32ee666fd3a76e8e5cab97ff52855

                                                                                            SHA512

                                                                                            92114fa395e62d6aa675253c3373eadc1d21370e1af4d73fe2eee22c26bcf1c7641af860707162a975a71cbff14a285e7aa9b26260717d5a850f4cced8d39202

                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                            MD5

                                                                                            cccf90ef6caa1c720eb17ccba041b365

                                                                                            SHA1

                                                                                            55e66eca9cf8e2fb2e2b1cc80907d14e617a13f8

                                                                                            SHA256

                                                                                            252dd54cd72c470bd4dc0011f8937e5075b32ee666fd3a76e8e5cab97ff52855

                                                                                            SHA512

                                                                                            92114fa395e62d6aa675253c3373eadc1d21370e1af4d73fe2eee22c26bcf1c7641af860707162a975a71cbff14a285e7aa9b26260717d5a850f4cced8d39202

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\libcurl.dll
                                                                                            MD5

                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                            SHA1

                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                            SHA256

                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                            SHA512

                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\libcurlpp.dll
                                                                                            MD5

                                                                                            e6e578373c2e416289a8da55f1dc5e8e

                                                                                            SHA1

                                                                                            b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                            SHA256

                                                                                            43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                            SHA512

                                                                                            9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\libgcc_s_dw2-1.dll
                                                                                            MD5

                                                                                            9aec524b616618b0d3d00b27b6f51da1

                                                                                            SHA1

                                                                                            64264300801a353db324d11738ffed876550e1d3

                                                                                            SHA256

                                                                                            59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                            SHA512

                                                                                            0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\libstdc++-6.dll
                                                                                            MD5

                                                                                            5e279950775baae5fea04d2cc4526bcc

                                                                                            SHA1

                                                                                            8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                            SHA256

                                                                                            97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                            SHA512

                                                                                            666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\libwinpthread-1.dll
                                                                                            MD5

                                                                                            1e0d62c34ff2e649ebc5c372065732ee

                                                                                            SHA1

                                                                                            fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                            SHA256

                                                                                            509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                            SHA512

                                                                                            3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\setup_install.exe
                                                                                            MD5

                                                                                            aa775ed5f04a52df52e0ec398276a122

                                                                                            SHA1

                                                                                            99dcdcae4d2bec213f4122880dd17940a97e1f59

                                                                                            SHA256

                                                                                            a21481507b9ac77467fb98509b8e73fa9075be0d8d991fcedc3de92970974a10

                                                                                            SHA512

                                                                                            6ba38e8b12acb3adeec8112d7f9cde94349a728e6cf0f82f3a33351521eb8048e255993d5c5e639b787e394223d1fa65325030aa099228f3455d20f5eb01f880

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\setup_install.exe
                                                                                            MD5

                                                                                            aa775ed5f04a52df52e0ec398276a122

                                                                                            SHA1

                                                                                            99dcdcae4d2bec213f4122880dd17940a97e1f59

                                                                                            SHA256

                                                                                            a21481507b9ac77467fb98509b8e73fa9075be0d8d991fcedc3de92970974a10

                                                                                            SHA512

                                                                                            6ba38e8b12acb3adeec8112d7f9cde94349a728e6cf0f82f3a33351521eb8048e255993d5c5e639b787e394223d1fa65325030aa099228f3455d20f5eb01f880

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_1.exe
                                                                                            MD5

                                                                                            6e43430011784cff369ea5a5ae4b000f

                                                                                            SHA1

                                                                                            5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                            SHA256

                                                                                            a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                            SHA512

                                                                                            33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_1.exe
                                                                                            MD5

                                                                                            6e43430011784cff369ea5a5ae4b000f

                                                                                            SHA1

                                                                                            5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                            SHA256

                                                                                            a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                            SHA512

                                                                                            33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_1.txt
                                                                                            MD5

                                                                                            6e43430011784cff369ea5a5ae4b000f

                                                                                            SHA1

                                                                                            5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                            SHA256

                                                                                            a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                            SHA512

                                                                                            33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_2.exe
                                                                                            MD5

                                                                                            73b25a1df7b899dc895a51f63059aaea

                                                                                            SHA1

                                                                                            c3453f5a27c813eca881caf317c64e378a516b32

                                                                                            SHA256

                                                                                            4271895bc34e027775ed0ba6db549bbdd9e07876891dcea4e64e39f6a69fe3c4

                                                                                            SHA512

                                                                                            b28880894a099eb43512ecf4150a78ab56b6506a4755d543e191f84ff362b410059fdad0dbf12cd5b3bdb704a058442f3d2e42d555a507ccdb1af6b16adb0564

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_2.txt
                                                                                            MD5

                                                                                            73b25a1df7b899dc895a51f63059aaea

                                                                                            SHA1

                                                                                            c3453f5a27c813eca881caf317c64e378a516b32

                                                                                            SHA256

                                                                                            4271895bc34e027775ed0ba6db549bbdd9e07876891dcea4e64e39f6a69fe3c4

                                                                                            SHA512

                                                                                            b28880894a099eb43512ecf4150a78ab56b6506a4755d543e191f84ff362b410059fdad0dbf12cd5b3bdb704a058442f3d2e42d555a507ccdb1af6b16adb0564

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_3.exe
                                                                                            MD5

                                                                                            00996c214aeb5463404df95cfff787a5

                                                                                            SHA1

                                                                                            2384434b6eee76929b62cef81803464d72516e8f

                                                                                            SHA256

                                                                                            a239b576f0840e2a6c54f09cb5d16ea2eafd77e3cdd86db59003c92fa77de80c

                                                                                            SHA512

                                                                                            98d3e3f2b0756d4b39fb19ee1836e52ff74badbe9203c09df662aa1bfc58ed36afa5b2910be39cfd8f835c885e9ebee6bd53913a063107d1b1de2a61007fd957

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_3.txt
                                                                                            MD5

                                                                                            00996c214aeb5463404df95cfff787a5

                                                                                            SHA1

                                                                                            2384434b6eee76929b62cef81803464d72516e8f

                                                                                            SHA256

                                                                                            a239b576f0840e2a6c54f09cb5d16ea2eafd77e3cdd86db59003c92fa77de80c

                                                                                            SHA512

                                                                                            98d3e3f2b0756d4b39fb19ee1836e52ff74badbe9203c09df662aa1bfc58ed36afa5b2910be39cfd8f835c885e9ebee6bd53913a063107d1b1de2a61007fd957

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_4.exe
                                                                                            MD5

                                                                                            ac61c0d63e190c508da8e014f5e7ecf2

                                                                                            SHA1

                                                                                            708ca131d026fe7ea94ce4f9a1e73c4e6921987f

                                                                                            SHA256

                                                                                            ee1743d72713eda5495824eaa24d0c3e82abba7cb546839149d55cf4526f4134

                                                                                            SHA512

                                                                                            cfea97d59b5163e7dbeb2759b6698b7d64527b897f51d9613a4f0f2d418f28e61e44c6bf301fbe788edbad01ddbdd3a1f9b3fc51fdcdc3af8b93c257f96082f7

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_4.txt
                                                                                            MD5

                                                                                            ac61c0d63e190c508da8e014f5e7ecf2

                                                                                            SHA1

                                                                                            708ca131d026fe7ea94ce4f9a1e73c4e6921987f

                                                                                            SHA256

                                                                                            ee1743d72713eda5495824eaa24d0c3e82abba7cb546839149d55cf4526f4134

                                                                                            SHA512

                                                                                            cfea97d59b5163e7dbeb2759b6698b7d64527b897f51d9613a4f0f2d418f28e61e44c6bf301fbe788edbad01ddbdd3a1f9b3fc51fdcdc3af8b93c257f96082f7

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_5.exe
                                                                                            MD5

                                                                                            b2fd5e3d293e5c8df255a228e39b8be0

                                                                                            SHA1

                                                                                            ed7bc19526f186228adcfa2a3a85244c4d01287d

                                                                                            SHA256

                                                                                            2c511d8e8e2330bab9c00df609a8197deb32e36943c023b4d87de387e42cb94a

                                                                                            SHA512

                                                                                            10fade88dd3109292f71f09d4df1bfaf54b99f8443ed4cf0996d0c74aa9e27f811f111867bbddc66310f0d10e405d2ec3410942652fa977e27bc7b7cc3c3c164

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_5.txt
                                                                                            MD5

                                                                                            b2fd5e3d293e5c8df255a228e39b8be0

                                                                                            SHA1

                                                                                            ed7bc19526f186228adcfa2a3a85244c4d01287d

                                                                                            SHA256

                                                                                            2c511d8e8e2330bab9c00df609a8197deb32e36943c023b4d87de387e42cb94a

                                                                                            SHA512

                                                                                            10fade88dd3109292f71f09d4df1bfaf54b99f8443ed4cf0996d0c74aa9e27f811f111867bbddc66310f0d10e405d2ec3410942652fa977e27bc7b7cc3c3c164

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_6.exe
                                                                                            MD5

                                                                                            503702e08c6aa1f3ff5d1136be1d984b

                                                                                            SHA1

                                                                                            5ef3a7e0518a08f10cebbdb70ed6c833f939fafe

                                                                                            SHA256

                                                                                            959b21542215b93dafb6df217039027b81bf0954de1c2ae08f9c68ef6cad526e

                                                                                            SHA512

                                                                                            d14f0c0bb14cfdd9c5832746bf31de3cbbff242bb4076639b4efc5f1b3ab9fda7e3a47c2f259881d7c2c4173297005f90055672a46487c7989f9e31f57e8c095

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_6.txt
                                                                                            MD5

                                                                                            503702e08c6aa1f3ff5d1136be1d984b

                                                                                            SHA1

                                                                                            5ef3a7e0518a08f10cebbdb70ed6c833f939fafe

                                                                                            SHA256

                                                                                            959b21542215b93dafb6df217039027b81bf0954de1c2ae08f9c68ef6cad526e

                                                                                            SHA512

                                                                                            d14f0c0bb14cfdd9c5832746bf31de3cbbff242bb4076639b4efc5f1b3ab9fda7e3a47c2f259881d7c2c4173297005f90055672a46487c7989f9e31f57e8c095

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_7.exe
                                                                                            MD5

                                                                                            cc8401952b633c9ad84d8e882e5c5d35

                                                                                            SHA1

                                                                                            09e8632349fcc21d534d3f02fdf00b3854573625

                                                                                            SHA256

                                                                                            eaa800ccf2f985da9e9b4c1103d199dc176165b86d3efec027f8606cfecaf2fb

                                                                                            SHA512

                                                                                            3a21435c77e01d72b463585c7aa6e62d53dd0a96124a642f457953e8c8e289a8bf0f9405127635d38abcd9776c720006033422c5882740826d340f14d4786ad7

                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS41F50854\sonia_7.txt
                                                                                            MD5

                                                                                            cc8401952b633c9ad84d8e882e5c5d35

                                                                                            SHA1

                                                                                            09e8632349fcc21d534d3f02fdf00b3854573625

                                                                                            SHA256

                                                                                            eaa800ccf2f985da9e9b4c1103d199dc176165b86d3efec027f8606cfecaf2fb

                                                                                            SHA512

                                                                                            3a21435c77e01d72b463585c7aa6e62d53dd0a96124a642f457953e8c8e289a8bf0f9405127635d38abcd9776c720006033422c5882740826d340f14d4786ad7

                                                                                          • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                            MD5

                                                                                            99ab358c6f267b09d7a596548654a6ba

                                                                                            SHA1

                                                                                            d5a643074b69be2281a168983e3f6bef7322f676

                                                                                            SHA256

                                                                                            586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380

                                                                                            SHA512

                                                                                            952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b

                                                                                          • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                            MD5

                                                                                            1c7be730bdc4833afb7117d48c3fd513

                                                                                            SHA1

                                                                                            dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                            SHA256

                                                                                            8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                            SHA512

                                                                                            7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                          • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                            MD5

                                                                                            b7161c0845a64ff6d7345b67ff97f3b0

                                                                                            SHA1

                                                                                            d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                            SHA256

                                                                                            fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                            SHA512

                                                                                            98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                          • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                            MD5

                                                                                            b7161c0845a64ff6d7345b67ff97f3b0

                                                                                            SHA1

                                                                                            d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                            SHA256

                                                                                            fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                            SHA512

                                                                                            98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                            MD5

                                                                                            8ecbad7f6f7bcdd0efee75004a57f6fb

                                                                                            SHA1

                                                                                            1035dd1026611d85f512a23409059af7984e8d2f

                                                                                            SHA256

                                                                                            1e9aef78c5ffd33473c354c4373c7b2b4383cfe0a25287dd92aae8fcb5c7fd4b

                                                                                            SHA512

                                                                                            5a8c23198fe6f4dfb46c8277b0ef6a319af34df2ee772a9259072797832d77fd1a013cb556a9b4edbcd362c9f093cf14b45624eb135a080a2a565cc74dda1c08

                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                            MD5

                                                                                            8ecbad7f6f7bcdd0efee75004a57f6fb

                                                                                            SHA1

                                                                                            1035dd1026611d85f512a23409059af7984e8d2f

                                                                                            SHA256

                                                                                            1e9aef78c5ffd33473c354c4373c7b2b4383cfe0a25287dd92aae8fcb5c7fd4b

                                                                                            SHA512

                                                                                            5a8c23198fe6f4dfb46c8277b0ef6a319af34df2ee772a9259072797832d77fd1a013cb556a9b4edbcd362c9f093cf14b45624eb135a080a2a565cc74dda1c08

                                                                                          • C:\Users\Admin\AppData\Roaming\2375528.exe
                                                                                            MD5

                                                                                            815618bf8376e04f8ff39f0a243f0681

                                                                                            SHA1

                                                                                            279240de60049ed8176f02642a9a05f6df3c2328

                                                                                            SHA256

                                                                                            7248dd8fac08b0e76020a1d0896f0cbe10824c8e12109bc1e8f3eb7ebb308d84

                                                                                            SHA512

                                                                                            4b66f76bcdf1707eebdb8b7fa7ddc6b4d1b06d23c77d0d132cd52a4de16a88cff86c8881715dbdeccab6bd1209cc809c07da07a445482bb2c97ed72509c6149c

                                                                                          • C:\Users\Admin\AppData\Roaming\2375528.exe
                                                                                            MD5

                                                                                            815618bf8376e04f8ff39f0a243f0681

                                                                                            SHA1

                                                                                            279240de60049ed8176f02642a9a05f6df3c2328

                                                                                            SHA256

                                                                                            7248dd8fac08b0e76020a1d0896f0cbe10824c8e12109bc1e8f3eb7ebb308d84

                                                                                            SHA512

                                                                                            4b66f76bcdf1707eebdb8b7fa7ddc6b4d1b06d23c77d0d132cd52a4de16a88cff86c8881715dbdeccab6bd1209cc809c07da07a445482bb2c97ed72509c6149c

                                                                                          • C:\Users\Admin\AppData\Roaming\4294558.exe
                                                                                            MD5

                                                                                            c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                            SHA1

                                                                                            5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                            SHA256

                                                                                            2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                            SHA512

                                                                                            d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                          • C:\Users\Admin\AppData\Roaming\4294558.exe
                                                                                            MD5

                                                                                            c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                            SHA1

                                                                                            5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                            SHA256

                                                                                            2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                            SHA512

                                                                                            d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                          • C:\Users\Admin\AppData\Roaming\7470346.exe
                                                                                            MD5

                                                                                            a6104f77447bed23087ba9cbd066ea28

                                                                                            SHA1

                                                                                            1c357a9aa5c6e4f827aa02d74ac2f4304ac0cb71

                                                                                            SHA256

                                                                                            f107e9a29912585166cbfdfe3b986d6462542f989b6e3a46f931eba0409731a8

                                                                                            SHA512

                                                                                            f7de98105fcd859f2038c06b423dd0aa3de5017d43223167740167754571289708ca504eea7cd8fcd8f77cfad41eeca25d9c7101a9b92b55187b8cfed0b85d5d

                                                                                          • C:\Users\Admin\AppData\Roaming\7470346.exe
                                                                                            MD5

                                                                                            a6104f77447bed23087ba9cbd066ea28

                                                                                            SHA1

                                                                                            1c357a9aa5c6e4f827aa02d74ac2f4304ac0cb71

                                                                                            SHA256

                                                                                            f107e9a29912585166cbfdfe3b986d6462542f989b6e3a46f931eba0409731a8

                                                                                            SHA512

                                                                                            f7de98105fcd859f2038c06b423dd0aa3de5017d43223167740167754571289708ca504eea7cd8fcd8f77cfad41eeca25d9c7101a9b92b55187b8cfed0b85d5d

                                                                                          • C:\Users\Admin\AppData\Roaming\8229145.exe
                                                                                            MD5

                                                                                            f99305041531b93f102045d22b1ae302

                                                                                            SHA1

                                                                                            50c81b7bf6021b2ad099e7070869d02ac4370307

                                                                                            SHA256

                                                                                            b00c3f42c6d90d55c426114ae37b05c46062fc5d265eea3744b56dbb2d58ebb2

                                                                                            SHA512

                                                                                            98c99f4b4725d39d43af2db6cd364c3bf451e67e10ccef53e92164c96411b9c2d12b9f121e3e93431b47f0a1f0dcb2dc23e6ef71c637c75e37226a81f3b49802

                                                                                          • C:\Users\Admin\AppData\Roaming\8229145.exe
                                                                                            MD5

                                                                                            f99305041531b93f102045d22b1ae302

                                                                                            SHA1

                                                                                            50c81b7bf6021b2ad099e7070869d02ac4370307

                                                                                            SHA256

                                                                                            b00c3f42c6d90d55c426114ae37b05c46062fc5d265eea3744b56dbb2d58ebb2

                                                                                            SHA512

                                                                                            98c99f4b4725d39d43af2db6cd364c3bf451e67e10ccef53e92164c96411b9c2d12b9f121e3e93431b47f0a1f0dcb2dc23e6ef71c637c75e37226a81f3b49802

                                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                            MD5

                                                                                            c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                            SHA1

                                                                                            5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                            SHA256

                                                                                            2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                            SHA512

                                                                                            d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                            MD5

                                                                                            c75cf058fa1b96eab7f838bc5baa4b4e

                                                                                            SHA1

                                                                                            5a4dc73ca19d26359d8bb74763bc8b19a0541ab9

                                                                                            SHA256

                                                                                            2b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c

                                                                                            SHA512

                                                                                            d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214

                                                                                          • C:\Users\Admin\Documents\5CJj5T2bZVVRKKqlQXEpkP3A.exe
                                                                                            MD5

                                                                                            ec079fbd394ed8838d2c8d062bbf1f39

                                                                                            SHA1

                                                                                            2679b62510d9e8e14ec6c9aa3fc4950e9dc57a70

                                                                                            SHA256

                                                                                            d4318bfc9c962824b9254a8eecaa7f30c5e6cc3a209a6d8ef84395aeab2403b7

                                                                                            SHA512

                                                                                            4594d95705f5d1b0ec4c12474f14f3b96b60fe6f51a3619b630a3749b4f2cab0e47be751847e8480456b9db036f5db71d49fedc1cbd90434a77c6a4f89bb1e23

                                                                                          • C:\Users\Admin\Documents\8Aqb8mOvFa1JGG3oGHK1sjdp.exe
                                                                                            MD5

                                                                                            637862922ea040811a79adf327863e15

                                                                                            SHA1

                                                                                            cd9f3fa9a64e1f1283121c0d02ec4ecde47a4de5

                                                                                            SHA256

                                                                                            2cbe0812081f1c8676e8fb96d9e4e08e6ac092c38982586030bd7302ed2b9a2d

                                                                                            SHA512

                                                                                            b49a749fa554595b5c85ea778de056378555326cdd2c57a7c1e5d2f3e932730a6375f31247d6c8771838c7c791e097b9b83baf09578feb81b0fb3946796e9e29

                                                                                          • C:\Users\Admin\Documents\J0gxE9i2QldAh7nEVElA54f0.exe
                                                                                            MD5

                                                                                            3eef52f6fbd66e5349726b0650276a38

                                                                                            SHA1

                                                                                            6d3229bdc650789a7f1959a0a7dc5d0fa3be81f3

                                                                                            SHA256

                                                                                            8f27a981e44cc3595009f7e78dde8ed1a13f1404b266d8277dab71237384d2a9

                                                                                            SHA512

                                                                                            e487d02c99dfe409d8e851f1408f96d34876c9471583be96efd294b4b7239998f57ed8501424f4d4a56b0b51ba3a34056078216c44dad6892a0d7cc5443640e0

                                                                                          • C:\Users\Admin\Documents\J0gxE9i2QldAh7nEVElA54f0.exe
                                                                                            MD5

                                                                                            3eef52f6fbd66e5349726b0650276a38

                                                                                            SHA1

                                                                                            6d3229bdc650789a7f1959a0a7dc5d0fa3be81f3

                                                                                            SHA256

                                                                                            8f27a981e44cc3595009f7e78dde8ed1a13f1404b266d8277dab71237384d2a9

                                                                                            SHA512

                                                                                            e487d02c99dfe409d8e851f1408f96d34876c9471583be96efd294b4b7239998f57ed8501424f4d4a56b0b51ba3a34056078216c44dad6892a0d7cc5443640e0

                                                                                          • C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe
                                                                                            MD5

                                                                                            60e3ca1e10c2929907013227e4c2ee8b

                                                                                            SHA1

                                                                                            6974ad76364616b4cf536f50d38a755a6629f00d

                                                                                            SHA256

                                                                                            6ef43fdaf44a341da6d558d5cd906b3f75e5504d6fe2538146117f788483ea6c

                                                                                            SHA512

                                                                                            8a5fb51ad90f45be3d5fc6c45ca353307e58411bb925afbfc12a953ac9eb33754457358667c8f2385b891078bda432f9b9e8de886a7a70ecba6d4f29b79aca12

                                                                                          • C:\Users\Admin\Documents\Jdxn66dus2GNx0O8zns_dMHz.exe
                                                                                            MD5

                                                                                            60e3ca1e10c2929907013227e4c2ee8b

                                                                                            SHA1

                                                                                            6974ad76364616b4cf536f50d38a755a6629f00d

                                                                                            SHA256

                                                                                            6ef43fdaf44a341da6d558d5cd906b3f75e5504d6fe2538146117f788483ea6c

                                                                                            SHA512

                                                                                            8a5fb51ad90f45be3d5fc6c45ca353307e58411bb925afbfc12a953ac9eb33754457358667c8f2385b891078bda432f9b9e8de886a7a70ecba6d4f29b79aca12

                                                                                          • C:\Users\Admin\Documents\SeRZ5yLCWy4kAsQ1ZjLYnZRT.exe
                                                                                            MD5

                                                                                            5f396405a7b59a50f88500a902a6eed0

                                                                                            SHA1

                                                                                            881e08477363bf59adbea69ea2c005d5f042cd58

                                                                                            SHA256

                                                                                            d2795ef3b6e6be4d8cef9d9a234c58eeabf381775675143b1edd45eaff5a27a5

                                                                                            SHA512

                                                                                            ddd7fda5a5506f6f3528e606632d895afd5f8e5450be1bd22cbb4beffb9711122d385778b8db42fdef804c69c7949a53df1a2d4497a79e6fa4748e014bb4a7e0

                                                                                          • C:\Users\Admin\Documents\SeRZ5yLCWy4kAsQ1ZjLYnZRT.exe
                                                                                            MD5

                                                                                            5f396405a7b59a50f88500a902a6eed0

                                                                                            SHA1

                                                                                            881e08477363bf59adbea69ea2c005d5f042cd58

                                                                                            SHA256

                                                                                            d2795ef3b6e6be4d8cef9d9a234c58eeabf381775675143b1edd45eaff5a27a5

                                                                                            SHA512

                                                                                            ddd7fda5a5506f6f3528e606632d895afd5f8e5450be1bd22cbb4beffb9711122d385778b8db42fdef804c69c7949a53df1a2d4497a79e6fa4748e014bb4a7e0

                                                                                          • C:\Users\Admin\Documents\bMewF9Z_LxrbfOZDWvw945xa.exe
                                                                                            MD5

                                                                                            6b5cd4878fec9628fbfc74a08b0d82e8

                                                                                            SHA1

                                                                                            91d5cad5884a26016facde0b0e4e41f03e223095

                                                                                            SHA256

                                                                                            1ba40bbc732d1868c0d19d40bd5427c7f6299f78f6bbb656c67e737526935329

                                                                                            SHA512

                                                                                            69792cabe12199a32ec8f029f44307942c2920306c0676d3602a576cf61198cd4bde10c502f9722eb5922efad6b60bbb7cd87a785ff6c70d03c0f795c8c36e01

                                                                                          • C:\Users\Admin\Documents\hi0qOwC_5PR0mChGHX8FjYEC.exe
                                                                                            MD5

                                                                                            fdd20f9a78a2cea297bdb77e5380d8b2

                                                                                            SHA1

                                                                                            aebffaa406c86f8664c7058f4529a1642cbb3d8e

                                                                                            SHA256

                                                                                            1fe0391aeb6d5c7e2b9e9fc02e24f970e5dba480e394ce66b363dfdd38e2ff20

                                                                                            SHA512

                                                                                            631a105cc14bbf8e381d3c43ce1dfa9a9a64815d53caf5c3bcc3e2f43803fad0e6cdff154c5dc0bcfe02aeb55415f2c5c441720b9f184c62a76351daf68466a4

                                                                                          • C:\Users\Admin\Documents\uSCcY3WbxmEUg7z_bm0uKtMC.exe
                                                                                            MD5

                                                                                            4981e563598d96b6fba4942f0c7705a0

                                                                                            SHA1

                                                                                            a6016d17432dc2f018b1d10490ddc1e38062b8ba

                                                                                            SHA256

                                                                                            1a413116ff7d8fc649002d93f2d0d2fc650a46da7d263973a11f3ea57099f04f

                                                                                            SHA512

                                                                                            d2081c4a903038d53cc47223152c85c525b78b33f9076ae7e0dc594e27bc3ad8945092f62676ab6b6ee0c380447f6beed0381bad75fe4c09e3eef8a47213ceb1

                                                                                          • C:\Users\Admin\Documents\uSCcY3WbxmEUg7z_bm0uKtMC.exe
                                                                                            MD5

                                                                                            4981e563598d96b6fba4942f0c7705a0

                                                                                            SHA1

                                                                                            a6016d17432dc2f018b1d10490ddc1e38062b8ba

                                                                                            SHA256

                                                                                            1a413116ff7d8fc649002d93f2d0d2fc650a46da7d263973a11f3ea57099f04f

                                                                                            SHA512

                                                                                            d2081c4a903038d53cc47223152c85c525b78b33f9076ae7e0dc594e27bc3ad8945092f62676ab6b6ee0c380447f6beed0381bad75fe4c09e3eef8a47213ceb1

                                                                                          • \Users\Admin\AppData\Local\Temp\7zS41F50854\libcurl.dll
                                                                                            MD5

                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                            SHA1

                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                            SHA256

                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                            SHA512

                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                          • \Users\Admin\AppData\Local\Temp\7zS41F50854\libcurl.dll
                                                                                            MD5

                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                            SHA1

                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                            SHA256

                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                            SHA512

                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                          • \Users\Admin\AppData\Local\Temp\7zS41F50854\libcurlpp.dll
                                                                                            MD5

                                                                                            e6e578373c2e416289a8da55f1dc5e8e

                                                                                            SHA1

                                                                                            b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                            SHA256

                                                                                            43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                            SHA512

                                                                                            9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                          • \Users\Admin\AppData\Local\Temp\7zS41F50854\libgcc_s_dw2-1.dll
                                                                                            MD5

                                                                                            9aec524b616618b0d3d00b27b6f51da1

                                                                                            SHA1

                                                                                            64264300801a353db324d11738ffed876550e1d3

                                                                                            SHA256

                                                                                            59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                            SHA512

                                                                                            0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                          • \Users\Admin\AppData\Local\Temp\7zS41F50854\libstdc++-6.dll
                                                                                            MD5

                                                                                            5e279950775baae5fea04d2cc4526bcc

                                                                                            SHA1

                                                                                            8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                            SHA256

                                                                                            97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                            SHA512

                                                                                            666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                          • \Users\Admin\AppData\Local\Temp\7zS41F50854\libwinpthread-1.dll
                                                                                            MD5

                                                                                            1e0d62c34ff2e649ebc5c372065732ee

                                                                                            SHA1

                                                                                            fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                            SHA256

                                                                                            509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                            SHA512

                                                                                            3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                          • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                                            MD5

                                                                                            50741b3f2d7debf5d2bed63d88404029

                                                                                            SHA1

                                                                                            56210388a627b926162b36967045be06ffb1aad3

                                                                                            SHA256

                                                                                            f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                            SHA512

                                                                                            fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                          • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                            MD5

                                                                                            1c7be730bdc4833afb7117d48c3fd513

                                                                                            SHA1

                                                                                            dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                            SHA256

                                                                                            8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                            SHA512

                                                                                            7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                          • memory/68-236-0x000001F5A3030000-0x000001F5A30A1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/184-353-0x0000000000000000-mapping.dmp
                                                                                          • memory/212-423-0x0000000000417DDE-mapping.dmp
                                                                                          • memory/212-431-0x0000000005360000-0x0000000005966000-memory.dmp
                                                                                            Filesize

                                                                                            6.0MB

                                                                                          • memory/496-434-0x0000000000417E1E-mapping.dmp
                                                                                          • memory/1032-273-0x00000229A8860000-0x00000229A88D1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/1076-144-0x0000000000000000-mapping.dmp
                                                                                          • memory/1080-143-0x0000000000000000-mapping.dmp
                                                                                          • memory/1120-266-0x0000022DEB750000-0x0000022DEB7C1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/1216-231-0x0000000005050000-0x0000000005051000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1216-221-0x0000000002910000-0x0000000002938000-memory.dmp
                                                                                            Filesize

                                                                                            160KB

                                                                                          • memory/1216-188-0x00000000006D0000-0x00000000006D1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1216-297-0x0000000007DE0000-0x0000000007DE1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1216-179-0x0000000000000000-mapping.dmp
                                                                                          • memory/1252-152-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                            Filesize

                                                                                            100KB

                                                                                          • memory/1252-147-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                            Filesize

                                                                                            100KB

                                                                                          • memory/1252-131-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                            Filesize

                                                                                            572KB

                                                                                          • memory/1252-133-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                            Filesize

                                                                                            152KB

                                                                                          • memory/1252-117-0x0000000000000000-mapping.dmp
                                                                                          • memory/1252-150-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                            Filesize

                                                                                            100KB

                                                                                          • memory/1252-134-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                            Filesize

                                                                                            1.1MB

                                                                                          • memory/1252-151-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                            Filesize

                                                                                            100KB

                                                                                          • memory/1252-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                            Filesize

                                                                                            1.5MB

                                                                                          • memory/1268-294-0x000002A94F1D0000-0x000002A94F241000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/1316-296-0x00000280C1F70000-0x00000280C1FE1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/1448-280-0x0000024AA2900000-0x0000024AA2971000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/1544-149-0x0000000000000000-mapping.dmp
                                                                                          • memory/1756-385-0x00000000052E0000-0x00000000052E1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1756-325-0x0000000000000000-mapping.dmp
                                                                                          • memory/1756-356-0x0000000076E80000-0x000000007700E000-memory.dmp
                                                                                            Filesize

                                                                                            1.6MB

                                                                                          • memory/1896-277-0x0000021BF0CD0000-0x0000021BF0D41000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/1904-190-0x0000000004B40000-0x0000000004B5B000-memory.dmp
                                                                                            Filesize

                                                                                            108KB

                                                                                          • memory/1904-249-0x0000000007F20000-0x0000000007F21000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-196-0x0000000004A72000-0x0000000004A73000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-197-0x0000000004BE0000-0x0000000004BF9000-memory.dmp
                                                                                            Filesize

                                                                                            100KB

                                                                                          • memory/1904-222-0x0000000007DC0000-0x0000000007DC1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-175-0x00000000001D0000-0x00000000001FF000-memory.dmp
                                                                                            Filesize

                                                                                            188KB

                                                                                          • memory/1904-241-0x0000000004A73000-0x0000000004A74000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-153-0x0000000000000000-mapping.dmp
                                                                                          • memory/1904-205-0x00000000077B0000-0x00000000077B1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-204-0x0000000004A74000-0x0000000004A76000-memory.dmp
                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/1904-208-0x0000000000400000-0x0000000002C10000-memory.dmp
                                                                                            Filesize

                                                                                            40.1MB

                                                                                          • memory/1904-209-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-211-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-228-0x0000000004A70000-0x0000000004A71000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/1904-193-0x00000000072B0000-0x00000000072B1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2136-449-0x0000000004D00000-0x0000000004D5C000-memory.dmp
                                                                                            Filesize

                                                                                            368KB

                                                                                          • memory/2136-432-0x0000000000000000-mapping.dmp
                                                                                          • memory/2136-446-0x0000000004B83000-0x0000000004C84000-memory.dmp
                                                                                            Filesize

                                                                                            1.0MB

                                                                                          • memory/2180-207-0x00007FF6416E4060-mapping.dmp
                                                                                          • memory/2180-315-0x0000020600A00000-0x0000020600B06000-memory.dmp
                                                                                            Filesize

                                                                                            1.0MB

                                                                                          • memory/2180-314-0x0000020600120000-0x000002060013B000-memory.dmp
                                                                                            Filesize

                                                                                            108KB

                                                                                          • memory/2180-226-0x000002067DDE0000-0x000002067DE51000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/2416-246-0x0000011F466B0000-0x0000011F46721000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/2484-240-0x000002D76D070000-0x000002D76D0E1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/2504-200-0x0000000000400000-0x0000000002BF7000-memory.dmp
                                                                                            Filesize

                                                                                            40.0MB

                                                                                          • memory/2504-176-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                            Filesize

                                                                                            36KB

                                                                                          • memory/2504-156-0x0000000000000000-mapping.dmp
                                                                                          • memory/2596-213-0x000001F72A900000-0x000001F72A971000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/2636-391-0x0000000000000000-mapping.dmp
                                                                                          • memory/2676-227-0x0000000005110000-0x0000000005111000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2676-212-0x0000000000D60000-0x0000000000D6E000-memory.dmp
                                                                                            Filesize

                                                                                            56KB

                                                                                          • memory/2676-233-0x0000000000E50000-0x0000000000E51000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2676-191-0x0000000000720000-0x0000000000721000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2676-182-0x0000000000000000-mapping.dmp
                                                                                          • memory/2676-203-0x0000000000D50000-0x0000000000D51000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/2752-298-0x000001E5E9040000-0x000001E5E90B1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/2760-299-0x0000024613A40000-0x0000024613AB1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/2764-155-0x0000000000000000-mapping.dmp
                                                                                          • memory/2796-157-0x0000000000000000-mapping.dmp
                                                                                          • memory/2796-538-0x0000000000000000-mapping.dmp
                                                                                          • memory/2796-413-0x0000000000000000-mapping.dmp
                                                                                          • memory/2876-199-0x0000000000400000-0x0000000002C53000-memory.dmp
                                                                                            Filesize

                                                                                            40.3MB

                                                                                          • memory/2876-192-0x0000000002D70000-0x0000000002EBA000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/2876-158-0x0000000000000000-mapping.dmp
                                                                                          • memory/2880-521-0x0000000000000000-mapping.dmp
                                                                                          • memory/3008-201-0x0000015437670000-0x00000154376E1000-memory.dmp
                                                                                            Filesize

                                                                                            452KB

                                                                                          • memory/3008-243-0x00000154375B0000-0x00000154375FC000-memory.dmp
                                                                                            Filesize

                                                                                            304KB

                                                                                          • memory/3024-276-0x0000000000CB0000-0x0000000000CC5000-memory.dmp
                                                                                            Filesize

                                                                                            84KB

                                                                                          • memory/3144-535-0x0000000000000000-mapping.dmp
                                                                                          • memory/3156-210-0x0000000004DE0000-0x0000000004EE1000-memory.dmp
                                                                                            Filesize

                                                                                            1.0MB

                                                                                          • memory/3156-219-0x0000000004D20000-0x0000000004D7D000-memory.dmp
                                                                                            Filesize

                                                                                            372KB

                                                                                          • memory/3156-178-0x0000000000000000-mapping.dmp
                                                                                          • memory/3348-346-0x0000000000000000-mapping.dmp
                                                                                          • memory/3348-146-0x0000000000000000-mapping.dmp
                                                                                          • memory/3376-523-0x0000000000000000-mapping.dmp
                                                                                          • memory/3500-170-0x0000000000000000-mapping.dmp
                                                                                          • memory/3628-163-0x0000000000000000-mapping.dmp
                                                                                          • memory/3628-232-0x00000152E28F0000-0x00000152E295E000-memory.dmp
                                                                                            Filesize

                                                                                            440KB

                                                                                          • memory/3628-239-0x00000152E4790000-0x00000152E485E000-memory.dmp
                                                                                            Filesize

                                                                                            824KB

                                                                                          • memory/3760-142-0x0000000000000000-mapping.dmp
                                                                                          • memory/3760-308-0x0000000000000000-mapping.dmp
                                                                                          • memory/3852-148-0x0000000000000000-mapping.dmp
                                                                                          • memory/3860-114-0x0000000000000000-mapping.dmp
                                                                                          • memory/3944-169-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3944-173-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3944-164-0x0000000000000000-mapping.dmp
                                                                                          • memory/3944-174-0x0000000000FC0000-0x0000000000FC2000-memory.dmp
                                                                                            Filesize

                                                                                            8KB

                                                                                          • memory/3944-167-0x0000000000870000-0x0000000000871000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/3944-171-0x0000000000FD0000-0x0000000000FEE000-memory.dmp
                                                                                            Filesize

                                                                                            120KB

                                                                                          • memory/3980-145-0x0000000000000000-mapping.dmp
                                                                                          • memory/4108-270-0x0000000005190000-0x0000000005796000-memory.dmp
                                                                                            Filesize

                                                                                            6.0MB

                                                                                          • memory/4108-245-0x0000000076E80000-0x000000007700E000-memory.dmp
                                                                                            Filesize

                                                                                            1.6MB

                                                                                          • memory/4108-215-0x0000000000000000-mapping.dmp
                                                                                          • memory/4108-250-0x0000000000E90000-0x0000000000E91000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4176-234-0x00000000003F0000-0x00000000003F1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4176-223-0x0000000000000000-mapping.dmp
                                                                                          • memory/4176-306-0x0000000008310000-0x0000000008311000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4176-268-0x0000000004E10000-0x0000000004E11000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4176-264-0x0000000004AE0000-0x0000000004B1E000-memory.dmp
                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4184-345-0x0000000000000000-mapping.dmp
                                                                                          • memory/4184-355-0x0000000000400000-0x0000000000651000-memory.dmp
                                                                                            Filesize

                                                                                            2.3MB

                                                                                          • memory/4240-393-0x0000000000000000-mapping.dmp
                                                                                          • memory/4240-453-0x0000000000000000-mapping.dmp
                                                                                          • memory/4296-361-0x0000000076E80000-0x000000007700E000-memory.dmp
                                                                                            Filesize

                                                                                            1.6MB

                                                                                          • memory/4296-340-0x0000000000000000-mapping.dmp
                                                                                          • memory/4296-388-0x0000000006050000-0x0000000006051000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4352-395-0x0000000000000000-mapping.dmp
                                                                                          • memory/4424-419-0x0000000004CB0000-0x00000000052B6000-memory.dmp
                                                                                            Filesize

                                                                                            6.0MB

                                                                                          • memory/4424-403-0x0000000000417E26-mapping.dmp
                                                                                          • memory/4476-295-0x0000000004A70000-0x0000000004A71000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4476-285-0x0000000004F20000-0x0000000004F21000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4476-247-0x0000000000000000-mapping.dmp
                                                                                          • memory/4516-390-0x0000000000000000-mapping.dmp
                                                                                          • memory/4516-397-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                                            Filesize

                                                                                            64KB

                                                                                          • memory/4516-438-0x0000000000417E32-mapping.dmp
                                                                                          • memory/4516-399-0x0000000000550000-0x000000000069A000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/4592-411-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                            Filesize

                                                                                            48KB

                                                                                          • memory/4592-408-0x0000000000402F68-mapping.dmp
                                                                                          • memory/4652-357-0x0000000000000000-mapping.dmp
                                                                                          • memory/4684-422-0x0000000000400000-0x00000000009A7000-memory.dmp
                                                                                            Filesize

                                                                                            5.7MB

                                                                                          • memory/4684-417-0x00000000009B0000-0x0000000000AFA000-memory.dmp
                                                                                            Filesize

                                                                                            1.3MB

                                                                                          • memory/4684-350-0x0000000000000000-mapping.dmp
                                                                                          • memory/4692-506-0x0000000000000000-mapping.dmp
                                                                                          • memory/4792-382-0x00000000055A0000-0x00000000055A1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4792-318-0x0000000000000000-mapping.dmp
                                                                                          • memory/4920-323-0x0000000000000000-mapping.dmp
                                                                                          • memory/4944-293-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                            Filesize

                                                                                            340KB

                                                                                          • memory/4944-290-0x0000000000000000-mapping.dmp
                                                                                          • memory/4964-319-0x0000000000000000-mapping.dmp
                                                                                          • memory/4964-389-0x0000000004ED0000-0x0000000004F46000-memory.dmp
                                                                                            Filesize

                                                                                            472KB

                                                                                          • memory/4976-379-0x0000000004CF0000-0x00000000051EE000-memory.dmp
                                                                                            Filesize

                                                                                            5.0MB

                                                                                          • memory/4976-327-0x0000000000000000-mapping.dmp
                                                                                          • memory/4976-354-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/4976-344-0x0000000000230000-0x0000000000231000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5000-410-0x0000000000030000-0x000000000003C000-memory.dmp
                                                                                            Filesize

                                                                                            48KB

                                                                                          • memory/5000-320-0x0000000000000000-mapping.dmp
                                                                                          • memory/5004-349-0x0000000000A00000-0x0000000000A01000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5004-326-0x0000000000000000-mapping.dmp
                                                                                          • memory/5004-384-0x0000000005480000-0x0000000005481000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5016-322-0x0000000000000000-mapping.dmp
                                                                                          • memory/5016-424-0x0000017DE6250000-0x0000017DE62BF000-memory.dmp
                                                                                            Filesize

                                                                                            444KB

                                                                                          • memory/5020-396-0x0000000004F90000-0x0000000004F91000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5020-321-0x0000000000000000-mapping.dmp
                                                                                          • memory/5020-336-0x0000000000680000-0x0000000000681000-memory.dmp
                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/5040-420-0x0000000000400000-0x00000000009F0000-memory.dmp
                                                                                            Filesize

                                                                                            5.9MB

                                                                                          • memory/5040-416-0x00000000026B0000-0x000000000274D000-memory.dmp
                                                                                            Filesize

                                                                                            628KB

                                                                                          • memory/5040-343-0x0000000000000000-mapping.dmp
                                                                                          • memory/5076-324-0x0000000000000000-mapping.dmp
                                                                                          • memory/5280-548-0x0000000000000000-mapping.dmp
                                                                                          • memory/5620-564-0x0000000000000000-mapping.dmp
                                                                                          • memory/5796-570-0x0000000000000000-mapping.dmp
                                                                                          • memory/5908-587-0x0000000000000000-mapping.dmp