Analysis

  • max time kernel
    84s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23-07-2021 15:31

General

  • Target

    a731929ca0a9a20edebbb0bba21c8cb5.exe

  • Size

    2.5MB

  • MD5

    a731929ca0a9a20edebbb0bba21c8cb5

  • SHA1

    c94fc1e14aeedbcc5f7ed7dec6fdebf81fc39fdb

  • SHA256

    21aad53d28c5415465bef9cd7b36d0d4708f22b57d77f7d6aca5e2de371c1bb5

  • SHA512

    9bd925810b0852445577d565eafc379a646ef3d49f5517a7fbd898873245db28564d5542fb485f97f7eaf7b716090e9e0062fdc5ef14f1a8e10280642c2d23e3

Malware Config

Extracted

Family

vidar

Version

39.7

Botnet

933

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

sel20

C2

dwarimlari.xyz:80

Extracted

Family

redline

Botnet

sel19

C2

dwarimlari.xyz:80

Extracted

Family

redline

Botnet

1

C2

51.178.146.144:59643

Extracted

Family

redline

Botnet

1000

C2

densalenge.xyz:80

Extracted

Family

vidar

Version

39.7

Botnet

921

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    921

Extracted

Family

vidar

Version

39.7

Botnet

903

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    903

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE GCleaner Downloader Activity M1
  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • suricata: ET MALWARE Win32/Ficker Stealer Activity M3
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 3 IoCs
  • Vidar Stealer 5 IoCs
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 41 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 13 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 6 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 6 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 18 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:1000
    • C:\Users\Admin\AppData\Roaming\eghjiab
      C:\Users\Admin\AppData\Roaming\eghjiab
      2⤵
        PID:6036
      • C:\Users\Admin\AppData\Roaming\cvhjiab
        C:\Users\Admin\AppData\Roaming\cvhjiab
        2⤵
          PID:6076
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2748
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
            PID:2728
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
              PID:2696
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2520
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                1⤵
                  PID:2512
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                  1⤵
                    PID:1888
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s SENS
                    1⤵
                      PID:1392
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                      1⤵
                        PID:1300
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Themes
                        1⤵
                          PID:1160
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                          1⤵
                            PID:1088
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                            1⤵
                              PID:1016
                            • C:\Users\Admin\AppData\Local\Temp\a731929ca0a9a20edebbb0bba21c8cb5.exe
                              "C:\Users\Admin\AppData\Local\Temp\a731929ca0a9a20edebbb0bba21c8cb5.exe"
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:532
                              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2804
                                • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\setup_install.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\setup_install.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of WriteProcessMemory
                                  PID:2844
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sonia_1.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3828
                                    • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_1.exe
                                      sonia_1.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:1608
                                      • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_1.exe" -a
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1508
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sonia_2.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1592
                                    • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_2.exe
                                      sonia_2.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks SCSI registry key(s)
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: MapViewOfSection
                                      PID:2812
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sonia_3.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4044
                                    • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_3.exe
                                      sonia_3.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks processor information in registry
                                      PID:1648
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_3.exe" & del C:\ProgramData\*.dll & exit
                                        6⤵
                                          PID:4676
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /im sonia_3.exe /f
                                            7⤵
                                            • Kills process with taskkill
                                            PID:5016
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /t 6
                                            7⤵
                                            • Delays execution with timeout.exe
                                            PID:3348
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sonia_4.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:972
                                      • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_4.exe
                                        sonia_4.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2324
                                        • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                          "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:3088
                                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                            "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                            7⤵
                                              PID:956
                                              • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                                8⤵
                                                  PID:6008
                                              • C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
                                                "C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"
                                                7⤵
                                                  PID:2792
                                                • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                  7⤵
                                                    PID:572
                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                      8⤵
                                                        PID:5672
                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                        8⤵
                                                          PID:5976
                                                      • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
                                                        7⤵
                                                          PID:5140
                                                          • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                                            C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                                            8⤵
                                                              PID:5424
                                                          • C:\Users\Admin\AppData\Local\Temp\pub1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\pub1.exe"
                                                            7⤵
                                                              PID:5544
                                                            • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                              7⤵
                                                                PID:5728
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 768
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:4956
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 940
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:5256
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 952
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:3348
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1064
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:5040
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1096
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:4664
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 1052
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:5004
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c sonia_5.exe
                                                          4⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4080
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_5.exe
                                                            sonia_5.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2760
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                          4⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3920
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_6.exe
                                                            sonia_6.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:2560
                                                            • C:\Users\Admin\Documents\1UOUEI6t3FqQuDXGSfIYPYpx.exe
                                                              "C:\Users\Admin\Documents\1UOUEI6t3FqQuDXGSfIYPYpx.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              PID:4608
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c cmd < Pura.vssm
                                                                7⤵
                                                                  PID:1720
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd
                                                                    8⤵
                                                                      PID:1608
                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                        findstr /V /R "^mDHHnooFzwuKWdLxXAvOmqexElRneQaCvwawdMkcQdyHAkGxAHZauWenBjehsKCCIDhUYKrkfwXoVxUaEvXxRZvAZTAtJXtuNCYXYLvQENryYTDusKJU$" Cancellata.vssm
                                                                        9⤵
                                                                          PID:5004
                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com
                                                                          Bordatino.exe.com s
                                                                          9⤵
                                                                            PID:3832
                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com
                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com s
                                                                              10⤵
                                                                                PID:6024
                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                              ping 127.0.0.1 -n 30
                                                                              9⤵
                                                                              • Runs ping.exe
                                                                              PID:6016
                                                                      • C:\Users\Admin\Documents\cfu7Eq1FJKH_8lGT66amABwY.exe
                                                                        "C:\Users\Admin\Documents\cfu7Eq1FJKH_8lGT66amABwY.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:4596
                                                                        • C:\Users\Admin\Documents\cfu7Eq1FJKH_8lGT66amABwY.exe
                                                                          C:\Users\Admin\Documents\cfu7Eq1FJKH_8lGT66amABwY.exe
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          PID:4936
                                                                      • C:\Users\Admin\Documents\3xeQglUgEOL0CQYyEUfBYkdU.exe
                                                                        "C:\Users\Admin\Documents\3xeQglUgEOL0CQYyEUfBYkdU.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:4584
                                                                        • C:\Users\Admin\Documents\3xeQglUgEOL0CQYyEUfBYkdU.exe
                                                                          "C:\Users\Admin\Documents\3xeQglUgEOL0CQYyEUfBYkdU.exe"
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          • Checks SCSI registry key(s)
                                                                          PID:1380
                                                                      • C:\Users\Admin\Documents\s6NVHQSG3Or9N4bY6pXfUo2d.exe
                                                                        "C:\Users\Admin\Documents\s6NVHQSG3Or9N4bY6pXfUo2d.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        PID:4824
                                                                        • C:\Users\Admin\Documents\s6NVHQSG3Or9N4bY6pXfUo2d.exe
                                                                          "C:\Users\Admin\Documents\s6NVHQSG3Or9N4bY6pXfUo2d.exe"
                                                                          7⤵
                                                                            PID:6028
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 560
                                                                            7⤵
                                                                            • Program crash
                                                                            PID:4452
                                                                        • C:\Users\Admin\Documents\OW_xmcllCXdCGA9UOBR214_2.exe
                                                                          "C:\Users\Admin\Documents\OW_xmcllCXdCGA9UOBR214_2.exe"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4768
                                                                          • C:\Users\Admin\Documents\OW_xmcllCXdCGA9UOBR214_2.exe
                                                                            C:\Users\Admin\Documents\OW_xmcllCXdCGA9UOBR214_2.exe
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            PID:4132
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\OW_xmcllCXdCGA9UOBR214_2.exe"
                                                                              8⤵
                                                                                PID:5152
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout /T 10 /NOBREAK
                                                                                  9⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:3388
                                                                          • C:\Users\Admin\Documents\gT6A2g9DayIPGghRT9piZ8T5.exe
                                                                            "C:\Users\Admin\Documents\gT6A2g9DayIPGghRT9piZ8T5.exe"
                                                                            6⤵
                                                                              PID:4760
                                                                              • C:\Users\Admin\Documents\gT6A2g9DayIPGghRT9piZ8T5.exe
                                                                                C:\Users\Admin\Documents\gT6A2g9DayIPGghRT9piZ8T5.exe
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                PID:4976
                                                                            • C:\Users\Admin\Documents\viNaKtZhBpajkoGtRD7r8fJ4.exe
                                                                              "C:\Users\Admin\Documents\viNaKtZhBpajkoGtRD7r8fJ4.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              PID:4752
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 660
                                                                                7⤵
                                                                                • Program crash
                                                                                PID:572
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 676
                                                                                7⤵
                                                                                • Program crash
                                                                                PID:4452
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 636
                                                                                7⤵
                                                                                • Program crash
                                                                                PID:4308
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 684
                                                                                7⤵
                                                                                • Program crash
                                                                                PID:3980
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 896
                                                                                7⤵
                                                                                • Program crash
                                                                                PID:5192
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1072
                                                                                7⤵
                                                                                • Program crash
                                                                                PID:5472
                                                                            • C:\Users\Admin\Documents\RrbSQ7Uy2eRMEts17kZJvyNM.exe
                                                                              "C:\Users\Admin\Documents\RrbSQ7Uy2eRMEts17kZJvyNM.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4744
                                                                              • C:\Users\Admin\Documents\RrbSQ7Uy2eRMEts17kZJvyNM.exe
                                                                                C:\Users\Admin\Documents\RrbSQ7Uy2eRMEts17kZJvyNM.exe
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                PID:2788
                                                                            • C:\Users\Admin\Documents\VOmq99KD_u7hOnUOK5liNXeu.exe
                                                                              "C:\Users\Admin\Documents\VOmq99KD_u7hOnUOK5liNXeu.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4724
                                                                            • C:\Users\Admin\Documents\nZn9nHZn_GbJgTUTiDBbHtR3.exe
                                                                              "C:\Users\Admin\Documents\nZn9nHZn_GbJgTUTiDBbHtR3.exe"
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              PID:4712
                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                7⤵
                                                                                  PID:6068
                                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                  7⤵
                                                                                    PID:5168
                                                                                  • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                    7⤵
                                                                                      PID:4892
                                                                                    • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                      7⤵
                                                                                        PID:5552
                                                                                    • C:\Users\Admin\Documents\jkfDwtI8H0UdmP35s6ABkPK7.exe
                                                                                      "C:\Users\Admin\Documents\jkfDwtI8H0UdmP35s6ABkPK7.exe"
                                                                                      6⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4700
                                                                                      • C:\Users\Admin\Documents\jkfDwtI8H0UdmP35s6ABkPK7.exe
                                                                                        C:\Users\Admin\Documents\jkfDwtI8H0UdmP35s6ABkPK7.exe
                                                                                        7⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1796
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im jkfDwtI8H0UdmP35s6ABkPK7.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\jkfDwtI8H0UdmP35s6ABkPK7.exe" & del C:\ProgramData\*.dll & exit
                                                                                          8⤵
                                                                                            PID:5312
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /im jkfDwtI8H0UdmP35s6ABkPK7.exe /f
                                                                                              9⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:5672
                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                              timeout /t 6
                                                                                              9⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:5664
                                                                                      • C:\Users\Admin\Documents\xQs33_4RAlid6ZImFw6FtVz2.exe
                                                                                        "C:\Users\Admin\Documents\xQs33_4RAlid6ZImFw6FtVz2.exe"
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:4692
                                                                                        • C:\Users\Admin\Documents\xQs33_4RAlid6ZImFw6FtVz2.exe
                                                                                          C:\Users\Admin\Documents\xQs33_4RAlid6ZImFw6FtVz2.exe
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5096
                                                                                      • C:\Users\Admin\Documents\K3OcTO1dCtSftBd1m2NbSKC_.exe
                                                                                        "C:\Users\Admin\Documents\K3OcTO1dCtSftBd1m2NbSKC_.exe"
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4684
                                                                                        • C:\Users\Admin\Documents\K3OcTO1dCtSftBd1m2NbSKC_.exe
                                                                                          C:\Users\Admin\Documents\K3OcTO1dCtSftBd1m2NbSKC_.exe
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:4248
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im K3OcTO1dCtSftBd1m2NbSKC_.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\K3OcTO1dCtSftBd1m2NbSKC_.exe" & del C:\ProgramData\*.dll & exit
                                                                                            8⤵
                                                                                              PID:5956
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /im K3OcTO1dCtSftBd1m2NbSKC_.exe /f
                                                                                                9⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:5548
                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                timeout /t 6
                                                                                                9⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:5704
                                                                                        • C:\Users\Admin\Documents\PJeVVHhd2Sbks9AfjJwz0idr.exe
                                                                                          "C:\Users\Admin\Documents\PJeVVHhd2Sbks9AfjJwz0idr.exe"
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5024
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                                                            7⤵
                                                                                              PID:5680
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im chrome.exe
                                                                                                8⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:5920
                                                                                          • C:\Users\Admin\Documents\KkbQJRNmLVmEvkpq0f3Ru3G1.exe
                                                                                            "C:\Users\Admin\Documents\KkbQJRNmLVmEvkpq0f3Ru3G1.exe"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            PID:4312
                                                                                            • C:\Users\Admin\Documents\KkbQJRNmLVmEvkpq0f3Ru3G1.exe
                                                                                              C:\Users\Admin\Documents\KkbQJRNmLVmEvkpq0f3Ru3G1.exe
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:4796
                                                                                          • C:\Users\Admin\Documents\fuTFDFLjiELbzdTP1KUhHnCc.exe
                                                                                            "C:\Users\Admin\Documents\fuTFDFLjiELbzdTP1KUhHnCc.exe"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3808
                                                                                          • C:\Users\Admin\Documents\VsYcaldZjUo5OHH7AMzcodW3.exe
                                                                                            "C:\Users\Admin\Documents\VsYcaldZjUo5OHH7AMzcodW3.exe"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4860
                                                                                            • C:\Users\Admin\Documents\VsYcaldZjUo5OHH7AMzcodW3.exe
                                                                                              C:\Users\Admin\Documents\VsYcaldZjUo5OHH7AMzcodW3.exe
                                                                                              7⤵
                                                                                                PID:4920
                                                                                            • C:\Users\Admin\Documents\i_JBTgoYMjTI3VNd8Ls8y5yP.exe
                                                                                              "C:\Users\Admin\Documents\i_JBTgoYMjTI3VNd8Ls8y5yP.exe"
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              • Checks BIOS information in registry
                                                                                              • Checks whether UAC is enabled
                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                              PID:4888
                                                                                            • C:\Users\Admin\Documents\r6V2fmX5eHJecfDzutrfGbvX.exe
                                                                                              "C:\Users\Admin\Documents\r6V2fmX5eHJecfDzutrfGbvX.exe"
                                                                                              6⤵
                                                                                                PID:4452
                                                                                                • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                  "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                  7⤵
                                                                                                    PID:5332
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                      8⤵
                                                                                                        PID:5492
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                        8⤵
                                                                                                          PID:5984
                                                                                                      • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                                                                        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                                                                                        7⤵
                                                                                                          PID:5224
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                            8⤵
                                                                                                              PID:4944
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                              8⤵
                                                                                                                PID:1804
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                8⤵
                                                                                                                  PID:3920
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                  8⤵
                                                                                                                    PID:4192
                                                                                                                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                  "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                  7⤵
                                                                                                                    PID:5364
                                                                                                                • C:\Users\Admin\Documents\pLv3SQ3wtuDpB2_CWjgXF_Qz.exe
                                                                                                                  "C:\Users\Admin\Documents\pLv3SQ3wtuDpB2_CWjgXF_Qz.exe"
                                                                                                                  6⤵
                                                                                                                    PID:4864
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im pLv3SQ3wtuDpB2_CWjgXF_Qz.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\pLv3SQ3wtuDpB2_CWjgXF_Qz.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                      7⤵
                                                                                                                        PID:2804
                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                          taskkill /im pLv3SQ3wtuDpB2_CWjgXF_Qz.exe /f
                                                                                                                          8⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:5344
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout /t 6
                                                                                                                          8⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:5968
                                                                                                                    • C:\Users\Admin\Documents\j8ZpWk3fQG6J3nvAIBzm2Ogc.exe
                                                                                                                      "C:\Users\Admin\Documents\j8ZpWk3fQG6J3nvAIBzm2Ogc.exe"
                                                                                                                      6⤵
                                                                                                                        PID:2456
                                                                                                                      • C:\Users\Admin\Documents\7Loy6STBcgIcT746UpIRFkxW.exe
                                                                                                                        "C:\Users\Admin\Documents\7Loy6STBcgIcT746UpIRFkxW.exe"
                                                                                                                        6⤵
                                                                                                                          PID:3456
                                                                                                                          • C:\Users\Admin\Documents\7Loy6STBcgIcT746UpIRFkxW.exe
                                                                                                                            "C:\Users\Admin\Documents\7Loy6STBcgIcT746UpIRFkxW.exe"
                                                                                                                            7⤵
                                                                                                                              PID:5388
                                                                                                                          • C:\Users\Admin\Documents\gI6hyjbfDZOTnBWxsRGqaBSe.exe
                                                                                                                            "C:\Users\Admin\Documents\gI6hyjbfDZOTnBWxsRGqaBSe.exe"
                                                                                                                            6⤵
                                                                                                                              PID:4592
                                                                                                                            • C:\Users\Admin\Documents\214BZVaZQxlhgn611gGDpgl2.exe
                                                                                                                              "C:\Users\Admin\Documents\214BZVaZQxlhgn611gGDpgl2.exe"
                                                                                                                              6⤵
                                                                                                                                PID:5288
                                                                                                                                • C:\Users\Admin\Documents\214BZVaZQxlhgn611gGDpgl2.exe
                                                                                                                                  "C:\Users\Admin\Documents\214BZVaZQxlhgn611gGDpgl2.exe" -a
                                                                                                                                  7⤵
                                                                                                                                    PID:2312
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                                                                              4⤵
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:3840
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_7.exe
                                                                                                                                sonia_7.exe
                                                                                                                                5⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1496
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                  6⤵
                                                                                                                                    PID:4796
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                    6⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4880
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                    6⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4348
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                    6⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    PID:4760
                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                          1⤵
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3660
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                            2⤵
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Modifies registry class
                                                                                                                            PID:1964
                                                                                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2552
                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                            2⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3520
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D811.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\D811.exe
                                                                                                                          1⤵
                                                                                                                            PID:5828
                                                                                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                            1⤵
                                                                                                                            • Process spawned unexpected child process
                                                                                                                            PID:5440
                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                              2⤵
                                                                                                                                PID:5168
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\F7E.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\F7E.exe
                                                                                                                              1⤵
                                                                                                                                PID:5316
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11E0.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\11E0.exe
                                                                                                                                1⤵
                                                                                                                                  PID:5192
                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  PID:5628
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                    2⤵
                                                                                                                                      PID:5372
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\16F2.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\16F2.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:1124
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\16F2.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\16F2.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:4864
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\226C.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\226C.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:2064
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
                                                                                                                                            2⤵
                                                                                                                                              PID:5764
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                                                                                                                                3⤵
                                                                                                                                                  PID:5968
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4780
                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                      wmic shadowcopy delete
                                                                                                                                                      4⤵
                                                                                                                                                        PID:6040
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4852
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5024
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4788
                                                                                                                                                            • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                                                                              vssadmin delete shadows /all /quiet
                                                                                                                                                              4⤵
                                                                                                                                                              • Interacts with shadow copies
                                                                                                                                                              PID:3516
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5736
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2A0F.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2A0F.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4304
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2A0F.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2A0F.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4176
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2E26.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2E26.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:6028
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2E26.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2E26.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5432
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\301B.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\301B.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:5012
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 301B.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\301B.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4000
                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                          taskkill /im 301B.exe /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:5932
                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                          timeout /t 6
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                          PID:5712
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3201.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3201.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:3348
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3444.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3444.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4136
                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5716
                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5084
                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:4144
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                C:\Windows\explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4004
                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:2780
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    C:\Windows\explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4316
                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4624
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        C:\Windows\explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:500
                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2784
                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:4304
                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4584

                                                                                                                                                                                              Network

                                                                                                                                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                              Persistence

                                                                                                                                                                                              Modify Existing Service

                                                                                                                                                                                              1
                                                                                                                                                                                              T1031

                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                              1
                                                                                                                                                                                              T1112

                                                                                                                                                                                              Disabling Security Tools

                                                                                                                                                                                              1
                                                                                                                                                                                              T1089

                                                                                                                                                                                              File Deletion

                                                                                                                                                                                              2
                                                                                                                                                                                              T1107

                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                              1
                                                                                                                                                                                              T1497

                                                                                                                                                                                              Credential Access

                                                                                                                                                                                              Credentials in Files

                                                                                                                                                                                              3
                                                                                                                                                                                              T1081

                                                                                                                                                                                              Discovery

                                                                                                                                                                                              Query Registry

                                                                                                                                                                                              5
                                                                                                                                                                                              T1012

                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                              1
                                                                                                                                                                                              T1497

                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                              5
                                                                                                                                                                                              T1082

                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                              1
                                                                                                                                                                                              T1120

                                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                                              1
                                                                                                                                                                                              T1018

                                                                                                                                                                                              Collection

                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                              3
                                                                                                                                                                                              T1005

                                                                                                                                                                                              Command and Control

                                                                                                                                                                                              Web Service

                                                                                                                                                                                              1
                                                                                                                                                                                              T1102

                                                                                                                                                                                              Impact

                                                                                                                                                                                              Inhibit System Recovery

                                                                                                                                                                                              2
                                                                                                                                                                                              T1490

                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                              Downloads

                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                MD5

                                                                                                                                                                                                bba3ba0f62ee168abf7f4ee4eb3946a3

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                f15843e12754b6147c81761c95211be7c61e1fdc

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                4947431858f07828edb45931406c284162f7adb78bd691b699e7dc839573f8ad

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                3669ef933d2edb983f6f80f11f41e1014ae7af81acc42fb01c529102c1816bcb86eb4b3d8dcf2f334ce83aaffe4fc6903c2d39933fef35f689b3a6734bfe5e15

                                                                                                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
                                                                                                                                                                                                MD5

                                                                                                                                                                                                6ed33927dfa3c6dd8f8a3e6fbc7523ee

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                d76a97470401a255004de91f4f6634991d9c87c1

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                e936a01ff0e2ffc34ed1a6c4381efab701ffe1bd2589bb81d97e235fefd2fd89

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                c6d7378dc771d594104eb5d51c8e8ad250be7ad79b67b1b7fece9c1cc26d6d1d2c15f41cbd3d0be0417aff396634240619c1cd31f288852f0f18ff0298ce66d4

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                cc0d6b6813f92dbf5be3ecacf44d662a

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                b968c57a14ddada4128356f6e39fb66c6d864d3f

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\libcurl.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\libcurlpp.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\libgcc_s_dw2-1.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\libstdc++-6.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\libwinpthread-1.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\setup_install.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                da0fe3edbef59b463f295f810c997151

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                8911abbb89245d4e09e11e703726700fa00081b2

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                dcc9de6d44d93e02a854b153a1008ae8248fa73d9ce611b8c6570600759902c1

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                939198b1a65b0e4ee5d0e4dea089e152d39f6c524c87db9055a03feaf3d2e1c8c2c00e191fecb6f8273079cbfa6f50595a67f8d5f23bf70bebd7a4f7c39a9235

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\setup_install.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                da0fe3edbef59b463f295f810c997151

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                8911abbb89245d4e09e11e703726700fa00081b2

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                dcc9de6d44d93e02a854b153a1008ae8248fa73d9ce611b8c6570600759902c1

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                939198b1a65b0e4ee5d0e4dea089e152d39f6c524c87db9055a03feaf3d2e1c8c2c00e191fecb6f8273079cbfa6f50595a67f8d5f23bf70bebd7a4f7c39a9235

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_1.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                6e43430011784cff369ea5a5ae4b000f

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_1.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                6e43430011784cff369ea5a5ae4b000f

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_1.txt
                                                                                                                                                                                                MD5

                                                                                                                                                                                                6e43430011784cff369ea5a5ae4b000f

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_2.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                a237095a767ea5e743a00c3c81e620de

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                1bd3d63415c55b0ba979c59577319266bf9e3913

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                d4050b4dc2921e350c3d214bfff08aa0b616cf26212cab2e63be05747aa6703f

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                aee84ca49bc29b416ade64ac7f95a4024e0ffae91d7142d4a87769f218b6de85fced0b7b81a2453e47666be096f6722c7c2315cddad54f94ccb4d8445d9290cd

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_2.txt
                                                                                                                                                                                                MD5

                                                                                                                                                                                                a237095a767ea5e743a00c3c81e620de

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                1bd3d63415c55b0ba979c59577319266bf9e3913

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                d4050b4dc2921e350c3d214bfff08aa0b616cf26212cab2e63be05747aa6703f

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                aee84ca49bc29b416ade64ac7f95a4024e0ffae91d7142d4a87769f218b6de85fced0b7b81a2453e47666be096f6722c7c2315cddad54f94ccb4d8445d9290cd

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_3.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                be37bdabe36f0a66e8b3081e8797218a

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                de93272dbca71c78d61ae131ee3dc97f7cd1ea7b

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                ab2ec9b130e539e68fdfb822f8c3fda9ba74560e7933210f47477e82bb08c4e5

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                473982ea0612b37c3232b66d448484ec4aef27c35598c7e506f559dafb3bd50b034b9a5db7ba03efc6de0c1dd0e249c1660fbb253a36fb51b6bb212fd8ce3b99

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_3.txt
                                                                                                                                                                                                MD5

                                                                                                                                                                                                be37bdabe36f0a66e8b3081e8797218a

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                de93272dbca71c78d61ae131ee3dc97f7cd1ea7b

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                ab2ec9b130e539e68fdfb822f8c3fda9ba74560e7933210f47477e82bb08c4e5

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                473982ea0612b37c3232b66d448484ec4aef27c35598c7e506f559dafb3bd50b034b9a5db7ba03efc6de0c1dd0e249c1660fbb253a36fb51b6bb212fd8ce3b99

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_4.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                aebba1a56e0d716d2e4b6676888084c8

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                fb0fc0de54c2f740deb8323272ff0180e4b89d99

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                6529c1eb48d6a4ffe24e91bb65cab349436408048d403edf9fcfa38ac617d38b

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                914fbff3f840d7dbde470514c9f8916112bbccce4f427b84c395c870b7194b3f6f453f583fc1081c6e896e3af3b89d5fdf0999a9a766e41a8f0448e6f06e6b62

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_4.txt
                                                                                                                                                                                                MD5

                                                                                                                                                                                                aebba1a56e0d716d2e4b6676888084c8

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                fb0fc0de54c2f740deb8323272ff0180e4b89d99

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                6529c1eb48d6a4ffe24e91bb65cab349436408048d403edf9fcfa38ac617d38b

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                914fbff3f840d7dbde470514c9f8916112bbccce4f427b84c395c870b7194b3f6f453f583fc1081c6e896e3af3b89d5fdf0999a9a766e41a8f0448e6f06e6b62

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_5.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                7ec7b612ff4f9771629ae397c77baf18

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                0e10994968563b5f11dcbbb965023bc2404142e3

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                f64759837bbb18960f5acab25fb18404c7bdb46312676672134ac2c00454befb

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                07b5651fba5595456fe456c08783e613fe7c7c44805b910853a5c4d61fa2f25c6eb3bad39798c7459bc93b0805f2729b6f3200b635b88fac0d5afae23558ea67

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_5.txt
                                                                                                                                                                                                MD5

                                                                                                                                                                                                7ec7b612ff4f9771629ae397c77baf18

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                0e10994968563b5f11dcbbb965023bc2404142e3

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                f64759837bbb18960f5acab25fb18404c7bdb46312676672134ac2c00454befb

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                07b5651fba5595456fe456c08783e613fe7c7c44805b910853a5c4d61fa2f25c6eb3bad39798c7459bc93b0805f2729b6f3200b635b88fac0d5afae23558ea67

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_6.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                0c3f670f496ffcf516fe77d2a161a6ee

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                0c59d3494b38d768fe120e0a4ca2a1dca7567e6e

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_6.txt
                                                                                                                                                                                                MD5

                                                                                                                                                                                                0c3f670f496ffcf516fe77d2a161a6ee

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                0c59d3494b38d768fe120e0a4ca2a1dca7567e6e

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_7.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                7eef13ea166d4795e7e2df97f6a97199

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                f80c5425a60534595c409842d37268213dcc1f92

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                22abf0e430b18088dcf4f889e33c8f1bdc9c918f908a2e450ab26a3db18d9d36

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                3bfb99aaad774079083e9575c0184760cba8e58c65979a90126d6d292696c4bb66604bb02f7e5b575628269c617a42d943129c1ef56a10dd0c7ba9cf2f79d12f

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4FA0D574\sonia_7.txt
                                                                                                                                                                                                MD5

                                                                                                                                                                                                7eef13ea166d4795e7e2df97f6a97199

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                f80c5425a60534595c409842d37268213dcc1f92

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                22abf0e430b18088dcf4f889e33c8f1bdc9c918f908a2e450ab26a3db18d9d36

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                3bfb99aaad774079083e9575c0184760cba8e58c65979a90126d6d292696c4bb66604bb02f7e5b575628269c617a42d943129c1ef56a10dd0c7ba9cf2f79d12f

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                efc352d21b18e468273577da51189c2e

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                c832eb34a76b866aa3acccb705476832683d9e73

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                cbf481dda581c5e9840f4c3c1a38c3d9ddd7ff6f244e6afa37c1cce9c6214fba

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                143a5d5d1dcb9c80e5ae34b2d2fae19471496513a7f131f6eb48278e673545df014b19689b305e8ef411506fa482b8665e344012810a76df75a472b3e5df2059

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                efc352d21b18e468273577da51189c2e

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                c832eb34a76b866aa3acccb705476832683d9e73

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                cbf481dda581c5e9840f4c3c1a38c3d9ddd7ff6f244e6afa37c1cce9c6214fba

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                143a5d5d1dcb9c80e5ae34b2d2fae19471496513a7f131f6eb48278e673545df014b19689b305e8ef411506fa482b8665e344012810a76df75a472b3e5df2059

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                                                                                                                                MD5

                                                                                                                                                                                                99ab358c6f267b09d7a596548654a6ba

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                d5a643074b69be2281a168983e3f6bef7322f676

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                1c7be730bdc4833afb7117d48c3fd513

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                9db3f5fff279084e7ffdef85d380c0bc

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                cb60e5dcb4cca5c40ffddd0f137ad43afc4dcdce

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                53b4ef9e5eea55e2aca2700dd64164f70dda9d01a47e176742d613d0e0a25d21

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                e40c19e3a6453047f99693eee7567067a09adc0cee633212dfe2e6fb20d138b6b685b8eff23cf1827c976d6f0259372d0438eca09cafee1d944c438383c024f7

                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                9db3f5fff279084e7ffdef85d380c0bc

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                cb60e5dcb4cca5c40ffddd0f137ad43afc4dcdce

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                53b4ef9e5eea55e2aca2700dd64164f70dda9d01a47e176742d613d0e0a25d21

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                e40c19e3a6453047f99693eee7567067a09adc0cee633212dfe2e6fb20d138b6b685b8eff23cf1827c976d6f0259372d0438eca09cafee1d944c438383c024f7

                                                                                                                                                                                              • C:\Users\Admin\Documents\1UOUEI6t3FqQuDXGSfIYPYpx.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                b719cba1a8c6e43a6f106a57b04962e4

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                80363428f99500ca7da13ad4ff5b07a97627507f

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                82d440b0f4ab1630e2e2cfe49a04ea383657ef055b33fb86db7aaa8131e2933b

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                0411ed00195a9bde7710718939af58a8a090d5db924e4317b499ee89dc6f1e83908045e787e36237887df738351de310b1c61da99b8df702f0033b0255935264

                                                                                                                                                                                              • C:\Users\Admin\Documents\1UOUEI6t3FqQuDXGSfIYPYpx.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                b719cba1a8c6e43a6f106a57b04962e4

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                80363428f99500ca7da13ad4ff5b07a97627507f

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                82d440b0f4ab1630e2e2cfe49a04ea383657ef055b33fb86db7aaa8131e2933b

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                0411ed00195a9bde7710718939af58a8a090d5db924e4317b499ee89dc6f1e83908045e787e36237887df738351de310b1c61da99b8df702f0033b0255935264

                                                                                                                                                                                              • C:\Users\Admin\Documents\3xeQglUgEOL0CQYyEUfBYkdU.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                00f56bdcfabaa8c5a9962d9d246568b1

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                fbd6214f2647a678013180323e4d0e37e910b6cd

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                c2f97cb42192e281f2990f413998444b8d0399ed6cf621dd6b9676370073d13b

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                de8a22eae73b85a55e8e28717aa43fbe4f90cf538e14677bad8a5dc3e869649290445acc4fea9a9b4319b66b40b750531bc192f328a1712d19877346cf8338c5

                                                                                                                                                                                              • C:\Users\Admin\Documents\3xeQglUgEOL0CQYyEUfBYkdU.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                00f56bdcfabaa8c5a9962d9d246568b1

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                fbd6214f2647a678013180323e4d0e37e910b6cd

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                c2f97cb42192e281f2990f413998444b8d0399ed6cf621dd6b9676370073d13b

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                de8a22eae73b85a55e8e28717aa43fbe4f90cf538e14677bad8a5dc3e869649290445acc4fea9a9b4319b66b40b750531bc192f328a1712d19877346cf8338c5

                                                                                                                                                                                              • C:\Users\Admin\Documents\K3OcTO1dCtSftBd1m2NbSKC_.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                98c91fa83f9235f812578e2bb5b3a786

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                58418036a8bbf4fde7f96f6ba7557f73a32f2f8a

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                7e29d69a13ac7c8ac362cf0450a0036dbff413bb550459ff7e61c9ab50a5be14

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                d1f94c7b39149985f4b7bb23a91812440532ac386d3bf28785b34a59c0459dfb626f0d6ff91ae3b594083bf499de2c0c60b61cd2cd81e2a0cbc71872a476076a

                                                                                                                                                                                              • C:\Users\Admin\Documents\K3OcTO1dCtSftBd1m2NbSKC_.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                98c91fa83f9235f812578e2bb5b3a786

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                58418036a8bbf4fde7f96f6ba7557f73a32f2f8a

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                7e29d69a13ac7c8ac362cf0450a0036dbff413bb550459ff7e61c9ab50a5be14

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                d1f94c7b39149985f4b7bb23a91812440532ac386d3bf28785b34a59c0459dfb626f0d6ff91ae3b594083bf499de2c0c60b61cd2cd81e2a0cbc71872a476076a

                                                                                                                                                                                              • C:\Users\Admin\Documents\OW_xmcllCXdCGA9UOBR214_2.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                3fc3cda9f2e33072e179ac256b3de820

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                c19c6727af6db25f9fe93da4b536a4c8c3daf7d9

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                54f7ad2fa8de4e86e2a5519ab9b043abe5285911a626b462f90817080f7366e6

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                fef02b52921caeb378be8fa108dbce8346c5860e615cad5a16bb5332ff1af0a040cebf3d8668ef6a9faac72102fa7d151f0e89e8cea5ae318d25e378baa0383d

                                                                                                                                                                                              • C:\Users\Admin\Documents\OW_xmcllCXdCGA9UOBR214_2.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                3fc3cda9f2e33072e179ac256b3de820

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                c19c6727af6db25f9fe93da4b536a4c8c3daf7d9

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                54f7ad2fa8de4e86e2a5519ab9b043abe5285911a626b462f90817080f7366e6

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                fef02b52921caeb378be8fa108dbce8346c5860e615cad5a16bb5332ff1af0a040cebf3d8668ef6a9faac72102fa7d151f0e89e8cea5ae318d25e378baa0383d

                                                                                                                                                                                              • C:\Users\Admin\Documents\RrbSQ7Uy2eRMEts17kZJvyNM.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                3242f74bc2e2936de899a749ecff59cf

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                9176f251c6c4135190315ef9d4a2f25b7a801c56

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                55aecb45a0e3844c0621c28907e857ec0ab23372e57bfa5dd614ea0b298b2c71

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                fc7f74b3153a3c798a89fda1efe4809568cd35a7c00a3611275013c0a1ffbbead29e1e67e853875b56e73404c7dcc7c8f4e38296cc560e1086c91f4fcc989927

                                                                                                                                                                                              • C:\Users\Admin\Documents\RrbSQ7Uy2eRMEts17kZJvyNM.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                3242f74bc2e2936de899a749ecff59cf

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                9176f251c6c4135190315ef9d4a2f25b7a801c56

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                55aecb45a0e3844c0621c28907e857ec0ab23372e57bfa5dd614ea0b298b2c71

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                fc7f74b3153a3c798a89fda1efe4809568cd35a7c00a3611275013c0a1ffbbead29e1e67e853875b56e73404c7dcc7c8f4e38296cc560e1086c91f4fcc989927

                                                                                                                                                                                              • C:\Users\Admin\Documents\VOmq99KD_u7hOnUOK5liNXeu.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                3f6b84ccd4292674328ab4754f4a5ba2

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                74aaf6dde13a3762503188b4e5c5d4f79dd5380a

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                0fbccc26213ec041b38565416c423bbf000c8ff5fef6f2dd4ca1bcb112bc4794

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                ff4aeaf69f0b86686a5195a441a2f3c57b660dfb2a04a3427dff00bd330db80e4623b97d6f71f1fdc8e33ed1f52d3ae17ccaf37a1df6110655f0bad7aed828e1

                                                                                                                                                                                              • C:\Users\Admin\Documents\VOmq99KD_u7hOnUOK5liNXeu.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                3f6b84ccd4292674328ab4754f4a5ba2

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                74aaf6dde13a3762503188b4e5c5d4f79dd5380a

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                0fbccc26213ec041b38565416c423bbf000c8ff5fef6f2dd4ca1bcb112bc4794

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                ff4aeaf69f0b86686a5195a441a2f3c57b660dfb2a04a3427dff00bd330db80e4623b97d6f71f1fdc8e33ed1f52d3ae17ccaf37a1df6110655f0bad7aed828e1

                                                                                                                                                                                              • C:\Users\Admin\Documents\cfu7Eq1FJKH_8lGT66amABwY.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                35cb601362743df19723b17045a4961c

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                6d6f732d2293a559985282536cc7fa07c6381cda

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                541d3642089ec4bb9214d30c65244a800750224c7672995d8a5b5d536bec1a6b

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                b419dcb48171cc5c0da04871df5f1b7de0eb0ad3d25012b80129fa79c3fde72e7aa73a0172c8e08e2503274328f04ee1c58cf54272b3d3551d28ac357b26edb2

                                                                                                                                                                                              • C:\Users\Admin\Documents\gT6A2g9DayIPGghRT9piZ8T5.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                aad9f8143d6c128c233ac8a574cd1230

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                bf6f1b7e334ff62fb25a0c9acc22ccfb2e86d755

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                3b7b5389e0f134d7b0bb6a57a94e8559baa0a45777bf11e344c529064b186962

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                a226de09af59a1c943e692a1d849984d48c8a0eaf2bc9f350f9fe5ba4ae5bf4afa4b2904faf9391875c27d09f5de054aa014d543671b530939ea704af2db7df9

                                                                                                                                                                                              • C:\Users\Admin\Documents\jkfDwtI8H0UdmP35s6ABkPK7.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                852a5d55e5ec96b98052d0ad05646f61

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                1625667df73d6c14ab6c20129368c1b74dabac61

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                b6d5c0c8ccb29d196557672260448f0421b1beca82d3fd4890f201348ff33795

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                edcc69a765c5e5b5f454b92a0a6befe090c8122f39e17002b9046b9b4fb6e871cd27c713e691ba9aa4862ef97ca3f783ef375d77f6f77f19f70eab191ba7d8ae

                                                                                                                                                                                              • C:\Users\Admin\Documents\jkfDwtI8H0UdmP35s6ABkPK7.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                852a5d55e5ec96b98052d0ad05646f61

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                1625667df73d6c14ab6c20129368c1b74dabac61

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                b6d5c0c8ccb29d196557672260448f0421b1beca82d3fd4890f201348ff33795

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                edcc69a765c5e5b5f454b92a0a6befe090c8122f39e17002b9046b9b4fb6e871cd27c713e691ba9aa4862ef97ca3f783ef375d77f6f77f19f70eab191ba7d8ae

                                                                                                                                                                                              • C:\Users\Admin\Documents\nZn9nHZn_GbJgTUTiDBbHtR3.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                38bce36f28d65863d45c7aff3e4f6df7

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                d132febde405e8553f2f886addd6796feb64532a

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                dc6765f28c007d5c7d351abe710c09d6efdd1c43dafe22dcb1eabc7d44116845

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                453d395504e8a9a99c110ff4ee5c29544c5770283b6e14b8fb70287c1a47eec6eb19186127f972525c463c36bb1bda27b02d13f712dff2db5f280d57ef7eb198

                                                                                                                                                                                              • C:\Users\Admin\Documents\nZn9nHZn_GbJgTUTiDBbHtR3.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                38bce36f28d65863d45c7aff3e4f6df7

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                d132febde405e8553f2f886addd6796feb64532a

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                dc6765f28c007d5c7d351abe710c09d6efdd1c43dafe22dcb1eabc7d44116845

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                453d395504e8a9a99c110ff4ee5c29544c5770283b6e14b8fb70287c1a47eec6eb19186127f972525c463c36bb1bda27b02d13f712dff2db5f280d57ef7eb198

                                                                                                                                                                                              • C:\Users\Admin\Documents\s6NVHQSG3Or9N4bY6pXfUo2d.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                ce08b9bcb1d1a2787a4cc96ec16a777b

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                d24563451408339690a2df03cbc3264cf1fced60

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                a86c7bd6eca9eef48dfd38b916d674748986ce058da2a1493e16e2d3e72d1b55

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                77d233b95af3b7a298809e0c8c352801235cdb677193195e8f962ae3cb6af76acbbe1b907319f8548d1b9b05e4dc3e5c1755dbedcffaadacfd6238f1da246c8b

                                                                                                                                                                                              • C:\Users\Admin\Documents\s6NVHQSG3Or9N4bY6pXfUo2d.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                ce08b9bcb1d1a2787a4cc96ec16a777b

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                d24563451408339690a2df03cbc3264cf1fced60

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                a86c7bd6eca9eef48dfd38b916d674748986ce058da2a1493e16e2d3e72d1b55

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                77d233b95af3b7a298809e0c8c352801235cdb677193195e8f962ae3cb6af76acbbe1b907319f8548d1b9b05e4dc3e5c1755dbedcffaadacfd6238f1da246c8b

                                                                                                                                                                                              • C:\Users\Admin\Documents\viNaKtZhBpajkoGtRD7r8fJ4.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                53a054b69aa3f6a1a4b49263d682bdde

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                5b28a3cfdc97b2f06c887e5d8458fff7602ee8ff

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                e7c5567fd365d83b90ad0ce5dfa783f4f9fe1a9adfa71ebfafcdc318319e8d2a

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                1a6c731a7a32dcd957a8f98ae06140d0a36419d9bcdeb52dafe8c42da9d3d3e948d74ae53c4e02c16f8619dafb729fc901677846a910303bc26904e9d1adfdf0

                                                                                                                                                                                              • C:\Users\Admin\Documents\viNaKtZhBpajkoGtRD7r8fJ4.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                53a054b69aa3f6a1a4b49263d682bdde

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                5b28a3cfdc97b2f06c887e5d8458fff7602ee8ff

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                e7c5567fd365d83b90ad0ce5dfa783f4f9fe1a9adfa71ebfafcdc318319e8d2a

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                1a6c731a7a32dcd957a8f98ae06140d0a36419d9bcdeb52dafe8c42da9d3d3e948d74ae53c4e02c16f8619dafb729fc901677846a910303bc26904e9d1adfdf0

                                                                                                                                                                                              • C:\Users\Admin\Documents\xQs33_4RAlid6ZImFw6FtVz2.exe
                                                                                                                                                                                                MD5

                                                                                                                                                                                                cb97d7578c07fbadf1d6655faf4230cb

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                54b971448bcfb6a913e460ce4aec72bf131103a9

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                35db5b59f62e3dc3187c543b4e5cd623f5c3905f89ae046877c2fa5b69cf5e39

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                10cddef68909644c66d1d241a249e1db1b344ef57cabe9247b05b9168e1fe20092711f43bceba1244f8d8d54495fca1b15c8f0aa31067942aaa7a26ab6f2df2a

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS4FA0D574\libcurl.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS4FA0D574\libcurlpp.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS4FA0D574\libgcc_s_dw2-1.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS4FA0D574\libgcc_s_dw2-1.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS4FA0D574\libgcc_s_dw2-1.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS4FA0D574\libstdc++-6.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\7zS4FA0D574\libwinpthread-1.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                                                                                                                                                MD5

                                                                                                                                                                                                50741b3f2d7debf5d2bed63d88404029

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                56210388a627b926162b36967045be06ffb1aad3

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                                                                                MD5

                                                                                                                                                                                                1c7be730bdc4833afb7117d48c3fd513

                                                                                                                                                                                                SHA1

                                                                                                                                                                                                dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                                                                                                SHA256

                                                                                                                                                                                                8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                                                                                                SHA512

                                                                                                                                                                                                7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                                                                                              • memory/572-463-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/956-446-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/972-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1000-220-0x000002CF77680000-0x000002CF776F1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1016-219-0x000001B505AA0000-0x000001B505B11000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1088-214-0x0000017E96E40000-0x0000017E96EB1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1160-280-0x0000022DF75D0000-0x0000022DF7641000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1300-290-0x000001C147140000-0x000001C1471B1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1380-398-0x0000000000402E1A-mapping.dmp
                                                                                                                                                                                              • memory/1380-444-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                36KB

                                                                                                                                                                                              • memory/1392-225-0x000002735DE80000-0x000002735DEF1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1496-191-0x000001A5CB850000-0x000001A5CB8BF000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                444KB

                                                                                                                                                                                              • memory/1496-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1496-192-0x000001A5CB8C0000-0x000001A5CB991000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                836KB

                                                                                                                                                                                              • memory/1508-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1592-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1608-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1608-476-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1648-186-0x0000000000400000-0x00000000008EA000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4.9MB

                                                                                                                                                                                              • memory/1648-184-0x00000000009C0000-0x0000000000B0A000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                1.3MB

                                                                                                                                                                                              • memory/1648-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1720-464-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/1796-366-0x000000000046B76D-mapping.dmp
                                                                                                                                                                                              • memory/1796-379-0x0000000000400000-0x00000000004A1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                644KB

                                                                                                                                                                                              • memory/1888-246-0x000001E87A760000-0x000001E87A7D1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1964-422-0x0000015A05890000-0x0000015A05996000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                1.0MB

                                                                                                                                                                                              • memory/1964-420-0x0000015A030A0000-0x0000015A030BB000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                108KB

                                                                                                                                                                                              • memory/1964-217-0x0000015A03200000-0x0000015A03271000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/1964-197-0x00007FF6535E4060-mapping.dmp
                                                                                                                                                                                              • memory/2324-166-0x0000000000250000-0x0000000000251000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/2324-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2324-175-0x000000001AE70000-0x000000001AE72000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                8KB

                                                                                                                                                                                              • memory/2456-468-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2512-224-0x000002BC06040000-0x000002BC060B1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/2520-222-0x00000219941D0000-0x0000021994241000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/2560-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2696-215-0x000002BE73F00000-0x000002BE73F71000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/2728-291-0x0000014AF8940000-0x0000014AF89B1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/2748-294-0x000002AD03380000-0x000002AD033F1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/2760-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2760-176-0x00000000027B0000-0x00000000027B2000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                8KB

                                                                                                                                                                                              • memory/2760-170-0x00000000007D0000-0x00000000007D1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/2760-172-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/2760-173-0x0000000000E10000-0x0000000000E2C000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                112KB

                                                                                                                                                                                              • memory/2760-174-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/2788-380-0x0000000000417DE2-mapping.dmp
                                                                                                                                                                                              • memory/2788-443-0x0000000004F30000-0x0000000005536000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                6.0MB

                                                                                                                                                                                              • memory/2792-457-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2804-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2812-185-0x0000000000400000-0x000000000088F000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4.6MB

                                                                                                                                                                                              • memory/2812-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2812-183-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                36KB

                                                                                                                                                                                              • memory/2844-137-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                100KB

                                                                                                                                                                                              • memory/2844-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                1.5MB

                                                                                                                                                                                              • memory/2844-139-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                1.1MB

                                                                                                                                                                                              • memory/2844-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/2844-132-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                572KB

                                                                                                                                                                                              • memory/2844-136-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                100KB

                                                                                                                                                                                              • memory/2844-138-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                100KB

                                                                                                                                                                                              • memory/2844-135-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                152KB

                                                                                                                                                                                              • memory/2844-134-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                100KB

                                                                                                                                                                                              • memory/2988-274-0x0000000000BA0000-0x0000000000BB5000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                84KB

                                                                                                                                                                                              • memory/3088-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/3088-200-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/3456-467-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/3520-194-0x0000000004C60000-0x0000000004CBD000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                372KB

                                                                                                                                                                                              • memory/3520-188-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/3520-193-0x0000000004B56000-0x0000000004C57000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                1.0MB

                                                                                                                                                                                              • memory/3660-213-0x000002A17AE50000-0x000002A17AEC1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                452KB

                                                                                                                                                                                              • memory/3660-211-0x000002A17AD90000-0x000002A17ADDC000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                304KB

                                                                                                                                                                                              • memory/3808-301-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/3808-414-0x0000000000400000-0x00000000008B6000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4.7MB

                                                                                                                                                                                              • memory/3808-407-0x00000000008D0000-0x00000000008FF000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                188KB

                                                                                                                                                                                              • memory/3808-417-0x0000000002A64000-0x0000000002A66000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                8KB

                                                                                                                                                                                              • memory/3808-442-0x0000000002A63000-0x0000000002A64000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/3808-440-0x0000000002A62000-0x0000000002A63000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/3808-424-0x0000000002A60000-0x0000000002A61000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/3828-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/3840-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/3920-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4044-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4080-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4132-387-0x0000000000400000-0x0000000000495000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                596KB

                                                                                                                                                                                              • memory/4132-378-0x000000000044003F-mapping.dmp
                                                                                                                                                                                              • memory/4248-384-0x0000000000400000-0x00000000004A1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                644KB

                                                                                                                                                                                              • memory/4248-372-0x000000000046B76D-mapping.dmp
                                                                                                                                                                                              • memory/4312-302-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4312-316-0x00000000009C0000-0x00000000009C1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4312-325-0x0000000005440000-0x0000000005441000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4348-353-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4452-466-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4584-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4584-405-0x00000000008F0000-0x00000000008FA000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                40KB

                                                                                                                                                                                              • memory/4592-470-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4596-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4596-315-0x0000000002400000-0x0000000002476000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                472KB

                                                                                                                                                                                              • memory/4596-293-0x00000000001A0000-0x00000000001A1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4608-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4676-455-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4684-247-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4684-279-0x0000000000F00000-0x0000000000F01000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4684-329-0x0000000001950000-0x000000000195E000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                56KB

                                                                                                                                                                                              • memory/4684-327-0x0000000005800000-0x0000000005801000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4692-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4692-317-0x0000000004D10000-0x0000000004D86000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                472KB

                                                                                                                                                                                              • memory/4692-300-0x0000000000550000-0x0000000000551000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4700-278-0x0000000000BB0000-0x0000000000BB1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4700-328-0x00000000053F0000-0x00000000053FE000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                56KB

                                                                                                                                                                                              • memory/4700-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4700-298-0x00000000054A0000-0x00000000054A1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4712-251-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4724-250-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4724-292-0x0000000000E50000-0x0000000000E51000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4724-312-0x0000000001590000-0x0000000001592000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                8KB

                                                                                                                                                                                              • memory/4724-306-0x0000000001570000-0x0000000001571000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4724-319-0x0000000001580000-0x0000000001581000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4724-314-0x00000000015A0000-0x00000000015C3000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                140KB

                                                                                                                                                                                              • memory/4744-277-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4744-303-0x0000000005950000-0x0000000005951000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4744-332-0x00000000016B0000-0x00000000016BE000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                56KB

                                                                                                                                                                                              • memory/4744-252-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4752-255-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4752-370-0x00000000008B0000-0x00000000009FA000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                1.3MB

                                                                                                                                                                                              • memory/4752-389-0x0000000000400000-0x00000000008B0000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4.7MB

                                                                                                                                                                                              • memory/4760-297-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4760-313-0x0000000005420000-0x0000000005421000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4760-439-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4760-309-0x00000000052C0000-0x00000000052C1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4760-305-0x0000000005320000-0x0000000005321000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4760-254-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4760-324-0x0000000005950000-0x0000000005951000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4768-276-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4768-253-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4768-331-0x00000000057E0000-0x00000000057E1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4768-330-0x00000000056E0000-0x00000000056EE000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                56KB

                                                                                                                                                                                              • memory/4796-348-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                120KB

                                                                                                                                                                                              • memory/4796-256-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4796-352-0x0000000000417DEE-mapping.dmp
                                                                                                                                                                                              • memory/4796-434-0x0000000005050000-0x0000000005656000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                6.0MB

                                                                                                                                                                                              • memory/4796-284-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                340KB

                                                                                                                                                                                              • memory/4824-449-0x0000000002EE0000-0x0000000003806000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                9.1MB

                                                                                                                                                                                              • memory/4824-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4824-451-0x0000000000400000-0x0000000000D41000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                9.3MB

                                                                                                                                                                                              • memory/4860-342-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4860-411-0x0000000004C00000-0x0000000004C01000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4864-465-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4880-320-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4888-344-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/4888-413-0x0000000077CE0000-0x0000000077E6E000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                1.6MB

                                                                                                                                                                                              • memory/4888-438-0x0000000005FE0000-0x0000000005FE1000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                4KB

                                                                                                                                                                                              • memory/4920-448-0x0000000000418836-mapping.dmp
                                                                                                                                                                                              • memory/4936-350-0x0000000000418836-mapping.dmp
                                                                                                                                                                                              • memory/4936-436-0x0000000004EC0000-0x00000000054C6000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                6.0MB

                                                                                                                                                                                              • memory/4936-346-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                120KB

                                                                                                                                                                                              • memory/4976-351-0x000000000041883A-mapping.dmp
                                                                                                                                                                                              • memory/4976-431-0x0000000005320000-0x0000000005926000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                6.0MB

                                                                                                                                                                                              • memory/4976-347-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                120KB

                                                                                                                                                                                              • memory/5016-462-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/5024-275-0x0000000000000000-mapping.dmp
                                                                                                                                                                                              • memory/5096-341-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                120KB

                                                                                                                                                                                              • memory/5096-429-0x0000000005170000-0x0000000005776000-memory.dmp
                                                                                                                                                                                                Filesize

                                                                                                                                                                                                6.0MB

                                                                                                                                                                                              • memory/5096-343-0x0000000000418832-mapping.dmp