Malware Analysis Report

2025-01-02 15:43

Sample ID 210723-7xbllrc9vn
Target 56FBB5D915FF47C20902B8927BA569A3.exe
SHA256 08c672cbfc638f1cde4a502afb6b0b907b0a665a6b487a9552cbf48abcb516a1
Tags
vidar 933 aspackv2 persistence stealer themida upx fickerstealer redline smokeloader socelars ani build2 backdoor infostealer suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

08c672cbfc638f1cde4a502afb6b0b907b0a665a6b487a9552cbf48abcb516a1

Threat Level: Known bad

The file 56FBB5D915FF47C20902B8927BA569A3.exe was found to be: Known bad.

Malicious Activity Summary

vidar 933 aspackv2 persistence stealer themida upx fickerstealer redline smokeloader socelars ani build2 backdoor infostealer suricata trojan

Socelars Payload

suricata: ET MALWARE Win32/Ficker Stealer Activity M3

suricata: ET MALWARE GCleaner Downloader Activity M1

Fickerstealer

SmokeLoader

Socelars

RedLine

RedLine Payload

Vidar

Process spawned unexpected child process

Vidar Stealer

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

ASPack v2.12-2.42

Themida packer

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-07-23 03:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-07-23 03:56

Reported

2021-07-23 03:59

Platform

win7v20210408

Max time kernel

14s

Max time network

175s

Command Line

"C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\rUNdlL32.eXe

Vidar

stealer vidar

Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ip-api.com N/A N/A
N/A ipinfo.io N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1036 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 1036 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 1036 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 1036 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 1036 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 1036 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 1036 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 572 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe
PID 572 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe
PID 572 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe
PID 572 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe
PID 572 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe
PID 572 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe
PID 572 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe
PID 1468 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1468 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 1800 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe

"C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe"

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

"C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_2.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_4.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_5.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_6.exe

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

sonia_1.exe

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.exe

sonia_6.exe

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_5.exe

sonia_5.exe

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

"C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe" -a

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe

sonia_7.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_8.exe

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe

sonia_3.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_7.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_3.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_1.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Windows\system32\rUNdlL32.eXe

rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main

C:\Windows\SysWOW64\rundll32.exe

rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main

C:\Users\Admin\Documents\9QSvq0hegeh2AyQvaoo2sGcr.exe

"C:\Users\Admin\Documents\9QSvq0hegeh2AyQvaoo2sGcr.exe"

C:\Users\Admin\Documents\PNzlhHAytmtNTi8j09F_nbri.exe

"C:\Users\Admin\Documents\PNzlhHAytmtNTi8j09F_nbri.exe"

C:\Users\Admin\Documents\aWDqzExkWT86YP5oL5udeOuH.exe

"C:\Users\Admin\Documents\aWDqzExkWT86YP5oL5udeOuH.exe"

C:\Users\Admin\Documents\jFpXYvCfs85DBPLAYPU92p15.exe

"C:\Users\Admin\Documents\jFpXYvCfs85DBPLAYPU92p15.exe"

C:\Users\Admin\Documents\7K5V3pBW58Grb8Ls1fMheCBk.exe

"C:\Users\Admin\Documents\7K5V3pBW58Grb8Ls1fMheCBk.exe"

C:\Users\Admin\Documents\EJIfJL59RXbPf45R1s578Yr7.exe

"C:\Users\Admin\Documents\EJIfJL59RXbPf45R1s578Yr7.exe"

C:\Users\Admin\Documents\MNK9KxgdtvuLmCc9S8H4fHST.exe

"C:\Users\Admin\Documents\MNK9KxgdtvuLmCc9S8H4fHST.exe"

C:\Users\Admin\Documents\iS3LVQ6bwI_ZgPRQI_ds6lvm.exe

"C:\Users\Admin\Documents\iS3LVQ6bwI_ZgPRQI_ds6lvm.exe"

C:\Users\Admin\Documents\AMgssA9kuIWUOIeNiluno7R2.exe

"C:\Users\Admin\Documents\AMgssA9kuIWUOIeNiluno7R2.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k SystemNetworkService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k SystemNetworkService

C:\Users\Admin\Documents\k6j0cFTNcbt9O1TbCb12aTK3.exe

"C:\Users\Admin\Documents\k6j0cFTNcbt9O1TbCb12aTK3.exe"

C:\Users\Admin\Documents\Lb4NxmRFIfij8de9UY4I6uLZ.exe

"C:\Users\Admin\Documents\Lb4NxmRFIfij8de9UY4I6uLZ.exe"

C:\Users\Admin\Documents\wpQ7YtsUwu79Pix4SOzWwby0.exe

"C:\Users\Admin\Documents\wpQ7YtsUwu79Pix4SOzWwby0.exe"

C:\Users\Admin\Documents\xfSYplu5H4jyMmcgkFEsi8PR.exe

"C:\Users\Admin\Documents\xfSYplu5H4jyMmcgkFEsi8PR.exe"

C:\Users\Admin\Documents\pvaLBpCXMNfJGJl1bNXWopZT.exe

"C:\Users\Admin\Documents\pvaLBpCXMNfJGJl1bNXWopZT.exe"

C:\Users\Admin\Documents\CPYEz022DnPxVDs8ruFIhp4e.exe

"C:\Users\Admin\Documents\CPYEz022DnPxVDs8ruFIhp4e.exe"

C:\Users\Admin\Documents\ylIJbKAj8ixzjDCc6Ee9_V2D.exe

"C:\Users\Admin\Documents\ylIJbKAj8ixzjDCc6Ee9_V2D.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c cmd < Pura.vssm

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 sokiran.xyz udp
N/A 8.8.8.8:53 ipinfo.io udp
N/A 172.67.186.105:80 sokiran.xyz tcp
N/A 34.117.59.81:443 ipinfo.io tcp
N/A 8.8.8.8:53 pki.goog udp
N/A 216.239.32.29:80 pki.goog tcp
N/A 8.8.8.8:53 ip-api.com udp
N/A 208.95.112.1:80 ip-api.com tcp
N/A 37.0.8.235:80 37.0.8.235 tcp
N/A 37.0.11.41:80 37.0.11.41 tcp
N/A 8.8.8.8:53 www.facebook.com udp
N/A 31.13.83.36:443 www.facebook.com tcp
N/A 8.8.8.8:53 www.anderesitebrauchen.com udp
N/A 8.8.8.8:53 cdn.discordapp.com udp
N/A 8.8.8.8:53 a.xyzgame.vip udp
N/A 8.8.8.8:53 i.spesgrt.com udp
N/A 8.8.8.8:53 flamkravmaga.com udp
N/A 8.8.8.8:53 www.szwbjs.com udp
N/A 172.67.153.179:80 i.spesgrt.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 136.144.41.201:80 136.144.41.201 tcp
N/A 172.67.173.218:80 a.xyzgame.vip tcp
N/A 136.144.41.201:80 136.144.41.201 tcp
N/A 185.20.227.194:80 185.20.227.194 tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 172.67.173.218:80 a.xyzgame.vip tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 172.67.173.218:80 a.xyzgame.vip tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 172.67.173.218:80 a.xyzgame.vip tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 172.67.173.218:443 a.xyzgame.vip tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 103.155.93.196:80 www.szwbjs.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:80 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 127.0.0.1:61996 tcp
N/A 127.0.0.1:61998 tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 162.159.134.233:443 cdn.discordapp.com tcp
N/A 8.8.8.8:53 flamkravmaga.com udp
N/A 8.8.8.8:53 s.lletlee.com udp
N/A 8.8.8.8:53 shpak125.tumblr.com udp
N/A 8.8.8.8:53 google.vrthcobj.com udp
N/A 8.8.8.8:53 google.vrthcobj.com udp
N/A 34.97.69.225:53 google.vrthcobj.com udp
N/A 74.114.154.22:443 shpak125.tumblr.com tcp
N/A 8.8.8.8:53 www.microsoft.com udp
N/A 34.97.69.225:443 google.vrthcobj.com tcp
N/A 208.95.112.1:80 ip-api.com tcp
N/A 8.8.8.8:53 by.dirfgame.com udp
N/A 172.67.215.92:80 by.dirfgame.com tcp
N/A 8.8.8.8:53 ol.gamegame.info udp
N/A 104.21.21.221:80 ol.gamegame.info tcp

Files

memory/1036-60-0x00000000750C1000-0x00000000750C3000-memory.dmp

\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

memory/572-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

memory/1468-72-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

memory/1468-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/1468-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/1468-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/1468-92-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.txt

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_2.txt

MD5 9f569d0eae949d683725de7bbe893eb8
SHA1 e4696b870a5a9d06585df259e8ee80f4b2364823
SHA256 273fb2e46f46a189e896064ce7213f2805dc0aff361eb997d59ccd903f1e9e8a
SHA512 94264d5969ea49d2a4e1bda9f0456ac430f1ae727f60cad883c7c24d1965a58b10e6d6901133a61dd2faa4701677d50abba71762ba7529c15f5046e5e3d69170

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.txt

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_5.txt

MD5 f9de3cedf6902c9b1d4794c8af41663e
SHA1 0439964dbcfa9ecd68b0f10557018098dcb6d126
SHA256 ce745112067479db4711a5f2c67706b9ab6423e5b5ffe58037e72286aabef338
SHA512 aa5f010a5decb5b2a620fe567f891984a3c7bdd2962cb452e3edda7ecc1ef742ab58cdbe7f1d7d5b28b39b606ccd52b66ad21d2cb2a22ea34ef50202854d2c31

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_4.txt

MD5 aebba1a56e0d716d2e4b6676888084c8
SHA1 fb0fc0de54c2f740deb8323272ff0180e4b89d99
SHA256 6529c1eb48d6a4ffe24e91bb65cab349436408048d403edf9fcfa38ac617d38b
SHA512 914fbff3f840d7dbde470514c9f8916112bbccce4f427b84c395c870b7194b3f6f453f583fc1081c6e896e3af3b89d5fdf0999a9a766e41a8f0448e6f06e6b62

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.txt

MD5 0c3f670f496ffcf516fe77d2a161a6ee
SHA1 0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512 bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_8.txt

MD5 c04d390489ac28e849ca9159224822af
SHA1 5b0c9e7b4a95d4729e62d106dbf89cb72919e64a
SHA256 d22e667e3f813d044ab2f69ba255c01cc847e7104760bff7a404875bc3ba67df
SHA512 25a4dc0f77293e90c08576b8066d0fb9238763eed0451b96b0e4c3b2daeb51935d699f256c1e505b7cfa986abfde840ba07543d944ab1c79adde91fb5726e3af

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.txt

MD5 2eb68e495e4eb18c86a443b2754bbab2
SHA1 82a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256 a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512 f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898

memory/1468-101-0x0000000064940000-0x0000000064959000-memory.dmp

memory/1468-103-0x0000000064940000-0x0000000064959000-memory.dmp

memory/1468-105-0x0000000064940000-0x0000000064959000-memory.dmp

memory/1804-117-0x0000000000000000-mapping.dmp

memory/1800-122-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe

MD5 2eb68e495e4eb18c86a443b2754bbab2
SHA1 82a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256 a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512 f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898

memory/1988-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_5.exe

MD5 f9de3cedf6902c9b1d4794c8af41663e
SHA1 0439964dbcfa9ecd68b0f10557018098dcb6d126
SHA256 ce745112067479db4711a5f2c67706b9ab6423e5b5ffe58037e72286aabef338
SHA512 aa5f010a5decb5b2a620fe567f891984a3c7bdd2962cb452e3edda7ecc1ef742ab58cdbe7f1d7d5b28b39b606ccd52b66ad21d2cb2a22ea34ef50202854d2c31

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.exe

MD5 0c3f670f496ffcf516fe77d2a161a6ee
SHA1 0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512 bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.exe

MD5 0c3f670f496ffcf516fe77d2a161a6ee
SHA1 0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512 bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.exe

MD5 0c3f670f496ffcf516fe77d2a161a6ee
SHA1 0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512 bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe

MD5 2eb68e495e4eb18c86a443b2754bbab2
SHA1 82a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256 a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512 f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe

MD5 2eb68e495e4eb18c86a443b2754bbab2
SHA1 82a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256 a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512 f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_7.exe

MD5 2eb68e495e4eb18c86a443b2754bbab2
SHA1 82a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256 a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512 f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898

memory/1896-157-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

memory/960-150-0x0000000000110000-0x0000000000111000-memory.dmp

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

memory/960-135-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_5.exe

MD5 f9de3cedf6902c9b1d4794c8af41663e
SHA1 0439964dbcfa9ecd68b0f10557018098dcb6d126
SHA256 ce745112067479db4711a5f2c67706b9ab6423e5b5ffe58037e72286aabef338
SHA512 aa5f010a5decb5b2a620fe567f891984a3c7bdd2962cb452e3edda7ecc1ef742ab58cdbe7f1d7d5b28b39b606ccd52b66ad21d2cb2a22ea34ef50202854d2c31

memory/1384-162-0x0000000000950000-0x00000000009ED000-memory.dmp

memory/1384-163-0x0000000000400000-0x00000000008EB000-memory.dmp

memory/240-130-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_6.exe

MD5 0c3f670f496ffcf516fe77d2a161a6ee
SHA1 0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512 bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

memory/1384-126-0x0000000000000000-mapping.dmp

memory/1612-128-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_3.exe

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

\Users\Admin\AppData\Local\Temp\7zSC3258BE4\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

memory/1468-118-0x0000000000400000-0x000000000051D000-memory.dmp

memory/1520-119-0x0000000000000000-mapping.dmp

memory/1468-116-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/1468-113-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/1100-112-0x0000000000000000-mapping.dmp

memory/1652-111-0x0000000000000000-mapping.dmp

memory/1468-108-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/1468-107-0x0000000064940000-0x0000000064959000-memory.dmp

memory/768-106-0x0000000000000000-mapping.dmp

memory/480-104-0x0000000000000000-mapping.dmp

memory/1020-102-0x0000000000000000-mapping.dmp

memory/1348-166-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f3a9a14699b8ef0723b3911ff5dad5d
SHA1 fd8b79607ad8717e79571b05d4dc88f5d4f48a17
SHA256 a9e7b3d0c43b7ebae59791f40cd54cb0c6a247a4df2606aa50464b63eda15261
SHA512 5fae8b7e92f56ae486cb4e1ebc0a1391773f4360c7a281245929c3788906f6086b0e6381754d22ab00c856292db46ecb10849a9485ed17c632e86555f9a37635

memory/684-174-0x0000000000000000-mapping.dmp

memory/960-176-0x0000000000380000-0x0000000000381000-memory.dmp

memory/2192-183-0x0000000000000000-mapping.dmp

memory/2168-182-0x0000000000000000-mapping.dmp

memory/2212-184-0x0000000000000000-mapping.dmp

memory/2192-191-0x00000000003B0000-0x00000000003B1000-memory.dmp

memory/2128-178-0x0000000000000000-mapping.dmp

memory/960-186-0x000000001AD20000-0x000000001AD22000-memory.dmp

memory/2152-179-0x0000000000000000-mapping.dmp

memory/2144-180-0x0000000000000000-mapping.dmp

memory/2160-181-0x0000000000000000-mapping.dmp

memory/2224-185-0x0000000000000000-mapping.dmp

memory/2120-177-0x0000000000000000-mapping.dmp

memory/960-193-0x0000000000390000-0x00000000003B3000-memory.dmp

memory/2376-194-0x00000000FF72246C-mapping.dmp

memory/2152-195-0x0000000000E70000-0x0000000000E71000-memory.dmp

memory/2476-199-0x00000000FF72246C-mapping.dmp

memory/2556-203-0x0000000000000000-mapping.dmp

memory/2580-204-0x0000000000000000-mapping.dmp

memory/2568-205-0x0000000000000000-mapping.dmp

memory/2596-206-0x0000000000000000-mapping.dmp

memory/2532-201-0x0000000000000000-mapping.dmp

memory/2520-200-0x0000000000000000-mapping.dmp

memory/2544-202-0x0000000000000000-mapping.dmp

memory/2616-208-0x0000000000000000-mapping.dmp

memory/2168-212-0x000007FEFB701000-0x000007FEFB703000-memory.dmp

memory/2128-216-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

memory/2568-220-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

memory/2520-219-0x0000000001080000-0x0000000001081000-memory.dmp

memory/2888-221-0x0000000000000000-mapping.dmp

memory/2976-224-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-07-23 03:56

Reported

2021-07-23 03:58

Platform

win10v20210410

Max time kernel

7s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe"

Signatures

Fickerstealer

infostealer fickerstealer

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\rundll32.exe

RedLine

infostealer redline

RedLine Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Socelars

stealer socelars

Socelars Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

suricata: ET MALWARE GCleaner Downloader Activity M1

suricata

suricata: ET MALWARE Win32/Ficker Stealer Activity M3

suricata

Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\Install2.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\Install2.EXE N/A

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.ipify.org N/A N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_4.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3872 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 3872 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 3872 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
PID 2624 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe
PID 2624 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe
PID 2624 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\setup_installer.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe
PID 2756 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe C:\Windows\SysWOW64\cmd.exe
PID 1188 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_2.exe
PID 1188 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_2.exe
PID 1188 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_2.exe
PID 3580 wrote to memory of 3860 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_3.exe
PID 3580 wrote to memory of 3860 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_3.exe
PID 3580 wrote to memory of 3860 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_3.exe
PID 3504 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe
PID 3504 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe
PID 3504 wrote to memory of 3952 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe
PID 1812 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe
PID 1812 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe
PID 1812 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe
PID 8 wrote to memory of 3764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_6.exe
PID 8 wrote to memory of 3764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_6.exe
PID 8 wrote to memory of 3764 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_6.exe
PID 2344 wrote to memory of 200 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_4.exe
PID 2344 wrote to memory of 200 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_4.exe
PID 3792 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_5.exe
PID 3792 wrote to memory of 2140 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_5.exe
PID 2152 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe
PID 2152 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe
PID 2152 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe
PID 3952 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe
PID 3952 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe
PID 3952 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe
PID 2608 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe C:\Users\Admin\AppData\Local\Temp\Chrome2.exe
PID 2608 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe C:\Users\Admin\AppData\Local\Temp\Chrome2.exe
PID 2608 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe C:\Users\Admin\AppData\Local\Temp\Install2.EXE
PID 2608 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe C:\Users\Admin\AppData\Local\Temp\Install2.EXE
PID 3572 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
PID 3572 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
PID 3572 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
PID 2608 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe
PID 2608 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe

"C:\Users\Admin\AppData\Local\Temp\56FBB5D915FF47C20902B8927BA569A3.exe"

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe

"C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_1.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_2.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_3.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_4.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_5.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_6.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_7.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_3.exe

sonia_3.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe

sonia_8.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_6.exe

sonia_6.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe

sonia_1.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c sonia_8.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_5.exe

sonia_5.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe

sonia_7.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_4.exe

sonia_4.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_2.exe

sonia_2.exe

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe

"C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe" -a

C:\Users\Admin\AppData\Local\Temp\Chrome2.exe

"C:\Users\Admin\AppData\Local\Temp\Chrome2.exe"

C:\Users\Admin\AppData\Local\Temp\Install2.EXE

"C:\Users\Admin\AppData\Local\Temp\Install2.EXE"

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe

"C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe"

C:\Users\Admin\AppData\Local\Temp\3002.exe

"C:\Users\Admin\AppData\Local\Temp\3002.exe"

C:\Windows\system32\rUNdlL32.eXe

rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main

C:\Users\Admin\AppData\Local\Temp\askinstall54.exe

"C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe

"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"

C:\Windows\SysWOW64\rundll32.exe

rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe

"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k SystemNetworkService

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

C:\Users\Admin\AppData\Local\Temp\pub1.exe

"C:\Users\Admin\AppData\Local\Temp\pub1.exe"

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Users\Admin\AppData\Local\Temp\3002.exe

"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe

C:\Users\Admin\Documents\a6CeLOaS1YQDC1MEJyKPfd9_.exe

"C:\Users\Admin\Documents\a6CeLOaS1YQDC1MEJyKPfd9_.exe"

C:\Users\Admin\Documents\CUa9Qn2wrcaY_2hyaDO7lIJr.exe

"C:\Users\Admin\Documents\CUa9Qn2wrcaY_2hyaDO7lIJr.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

C:\Users\Admin\Documents\y1LDd31UWynDv6FSvg40Lz3s.exe

"C:\Users\Admin\Documents\y1LDd31UWynDv6FSvg40Lz3s.exe"

C:\Users\Admin\Documents\LCoivcX1v2HjGDl0ZCaUl0W1.exe

"C:\Users\Admin\Documents\LCoivcX1v2HjGDl0ZCaUl0W1.exe"

C:\Users\Admin\Documents\KhDflABGDaqGf_H97ZgVjvO5.exe

"C:\Users\Admin\Documents\KhDflABGDaqGf_H97ZgVjvO5.exe"

C:\Users\Admin\Documents\pRSEa8fVkoh7rEqIWJyeYQ28.exe

"C:\Users\Admin\Documents\pRSEa8fVkoh7rEqIWJyeYQ28.exe"

C:\Users\Admin\Documents\feg6GZnYFF8gn78nK1tsQICk.exe

"C:\Users\Admin\Documents\feg6GZnYFF8gn78nK1tsQICk.exe"

C:\Users\Admin\Documents\h4sIgOv36ce2bQirTcDSEgVO.exe

"C:\Users\Admin\Documents\h4sIgOv36ce2bQirTcDSEgVO.exe"

C:\Users\Admin\Documents\QM9Kyfa90HdFtgrMUMi8AkzF.exe

"C:\Users\Admin\Documents\QM9Kyfa90HdFtgrMUMi8AkzF.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD2~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD2~1.EXE

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system64" /tr '"C:\Users\Admin\AppData\Roaming\system64.exe"' & exit

C:\Users\Admin\Documents\pRSEa8fVkoh7rEqIWJyeYQ28.exe

C:\Users\Admin\Documents\pRSEa8fVkoh7rEqIWJyeYQ28.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c cmd < Pura.vssm

C:\Users\Admin\AppData\Roaming\system64.exe

"C:\Users\Admin\AppData\Roaming\system64.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 804

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS63DB.tmp\Install.cmd" "

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "system64" /tr '"C:\Users\Admin\AppData\Roaming\system64.exe"'

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^mDHHnooFzwuKWdLxXAvOmqexElRneQaCvwawdMkcQdyHAkGxAHZauWenBjehsKCCIDhUYKrkfwXoVxUaEvXxRZvAZTAtJXtuNCYXYLvQENryYTDusKJU$" Cancellata.vssm

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 828

C:\Users\Admin\Documents\8Ab_xm_SkCMT4LE9fp9IA7zT.exe

"C:\Users\Admin\Documents\8Ab_xm_SkCMT4LE9fp9IA7zT.exe"

C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe

"C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe"

C:\Users\Admin\Documents\AB1QphK8L9jBKvaQan8JzE3O.exe

"C:\Users\Admin\Documents\AB1QphK8L9jBKvaQan8JzE3O.exe"

C:\Users\Admin\Documents\QjP3tAFchXbTo6ABX8aVyOoM.exe

"C:\Users\Admin\Documents\QjP3tAFchXbTo6ABX8aVyOoM.exe"

C:\Users\Admin\Documents\6Qz0QP0avlDPNm0TaD0YiFPf.exe

"C:\Users\Admin\Documents\6Qz0QP0avlDPNm0TaD0YiFPf.exe"

C:\Users\Admin\Documents\pRSEa8fVkoh7rEqIWJyeYQ28.exe

C:\Users\Admin\Documents\pRSEa8fVkoh7rEqIWJyeYQ28.exe

C:\Users\Admin\Documents\1e5OrbLrT8Kyqt7nvoMV4tBQ.exe

"C:\Users\Admin\Documents\1e5OrbLrT8Kyqt7nvoMV4tBQ.exe"

C:\Users\Admin\Documents\Y9OGw0EM0DeG2pc3DChrDrMy.exe

"C:\Users\Admin\Documents\Y9OGw0EM0DeG2pc3DChrDrMy.exe"

C:\Users\Admin\Documents\8tGC6EL_J6genNkt2pEV3Vn3.exe

"C:\Users\Admin\Documents\8tGC6EL_J6genNkt2pEV3Vn3.exe"

C:\Users\Admin\Documents\wuOKf5MMo3RpzGOY_T4R3Bee.exe

"C:\Users\Admin\Documents\wuOKf5MMo3RpzGOY_T4R3Bee.exe"

C:\Users\Admin\Documents\E4CosaxtDjmkMP8Mt5_yqQFe.exe

"C:\Users\Admin\Documents\E4CosaxtDjmkMP8Mt5_yqQFe.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 892

C:\Users\Admin\Documents\a6CeLOaS1YQDC1MEJyKPfd9_.exe

C:\Users\Admin\Documents\a6CeLOaS1YQDC1MEJyKPfd9_.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 1016

C:\Users\Admin\Documents\CUa9Qn2wrcaY_2hyaDO7lIJr.exe

C:\Users\Admin\Documents\CUa9Qn2wrcaY_2hyaDO7lIJr.exe

C:\Users\Admin\Documents\a6CeLOaS1YQDC1MEJyKPfd9_.exe

C:\Users\Admin\Documents\a6CeLOaS1YQDC1MEJyKPfd9_.exe

C:\Users\Admin\Documents\KhDflABGDaqGf_H97ZgVjvO5.exe

C:\Users\Admin\Documents\KhDflABGDaqGf_H97ZgVjvO5.exe

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com

Bordatino.exe.com s

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 30

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "system64" /tr '"C:\Users\Admin\AppData\Roaming\system64.exe"' & exit

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"

C:\Users\Admin\Documents\E4CosaxtDjmkMP8Mt5_yqQFe.exe

C:\Users\Admin\Documents\E4CosaxtDjmkMP8Mt5_yqQFe.exe

C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe

C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com s

C:\Users\Admin\AppData\Local\Temp\557F.exe

C:\Users\Admin\AppData\Local\Temp\557F.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 864

C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe

C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe

C:\Users\Admin\Documents\6Qz0QP0avlDPNm0TaD0YiFPf.exe

"C:\Users\Admin\Documents\6Qz0QP0avlDPNm0TaD0YiFPf.exe" -a

C:\Users\Admin\Documents\AB1QphK8L9jBKvaQan8JzE3O.exe

"C:\Users\Admin\Documents\AB1QphK8L9jBKvaQan8JzE3O.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 976

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com s

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "system64" /tr '"C:\Users\Admin\AppData\Roaming\system64.exe"'

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 892

C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe

C:\Users\Admin\Documents\4XIutftPuRUSbZgCPs4cO0hN.exe

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca

C:\Users\Admin\AppData\Local\Temp\11111.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com s

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com s

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 sokiran.xyz udp
N/A 104.21.19.133:80 sokiran.xyz tcp
N/A 8.8.8.8:53 cdn.discordapp.com udp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 8.8.8.8:53 ip-api.com udp
N/A 8.8.8.8:53 ipinfo.io udp
N/A 208.95.112.1:80 ip-api.com tcp
N/A 34.117.59.81:443 ipinfo.io tcp
N/A 37.0.8.235:80 37.0.8.235 tcp
N/A 8.8.8.8:53 music-s.xyz udp
N/A 8.8.8.8:53 iplogger.org udp
N/A 88.99.66.31:443 iplogger.org tcp
N/A 88.99.66.31:443 iplogger.org tcp
N/A 8.8.8.8:53 www.listincode.com udp
N/A 88.99.66.31:443 iplogger.org tcp
N/A 144.202.76.47:443 www.listincode.com tcp
N/A 8.8.8.8:53 google.vrthcobj.com udp
N/A 8.8.8.8:53 google.vrthcobj.com udp
N/A 34.97.69.225:53 google.vrthcobj.com udp
N/A 37.0.11.41:80 37.0.11.41 tcp
N/A 8.8.8.8:53 www.facebook.com udp
N/A 31.13.64.35:443 www.facebook.com tcp
N/A 208.95.112.1:80 ip-api.com tcp
N/A 136.144.41.201:80 136.144.41.201 tcp
N/A 8.8.8.8:53 shpak125.tumblr.com udp
N/A 74.114.154.22:443 shpak125.tumblr.com tcp
N/A 127.0.0.1:61515 tcp
N/A 127.0.0.1:61517 tcp
N/A 185.20.227.194:80 185.20.227.194 tcp
N/A 136.144.41.201:80 136.144.41.201 tcp
N/A 8.8.8.8:53 flamkravmaga.com udp
N/A 136.144.41.201:80 136.144.41.201 tcp
N/A 8.8.8.8:53 i.spesgrt.com udp
N/A 8.8.8.8:53 www.anderesitebrauchen.com udp
N/A 172.67.153.179:80 i.spesgrt.com tcp
N/A 74.114.154.22:443 shpak125.tumblr.com tcp
N/A 8.8.8.8:53 flamkravmaga.com udp
N/A 136.144.41.201:80 136.144.41.201 tcp
N/A 136.144.41.201:80 136.144.41.201 tcp
N/A 8.8.8.8:53 www.szwbjs.com udp
N/A 103.155.93.196:80 www.szwbjs.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:80 cdn.discordapp.com tcp
N/A 8.8.8.8:53 a.xyzgame.vip udp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 8.8.8.8:53 live.goatgame.live udp
N/A 172.67.173.218:80 a.xyzgame.vip tcp
N/A 172.67.173.218:80 a.xyzgame.vip tcp
N/A 172.67.173.218:80 a.xyzgame.vip tcp
N/A 104.21.70.98:443 live.goatgame.live tcp
N/A 172.67.173.218:443 a.xyzgame.vip tcp
N/A 8.8.8.8:53 s.lletlee.com udp
N/A 104.21.17.130:443 s.lletlee.com tcp
N/A 8.8.8.8:53 www.facebook.com udp
N/A 31.13.83.36:443 www.facebook.com tcp
N/A 8.8.8.8:53 conceitosseg.com udp
N/A 8.8.8.8:53 music-s.xyz udp
N/A 88.99.66.31:443 iplogger.org tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 162.159.133.233:443 cdn.discordapp.com tcp
N/A 183.100.39.157:80 conceitosseg.com tcp
N/A 8.8.8.8:53 b.xyzgame.cc udp
N/A 104.21.51.99:443 b.xyzgame.cc tcp
N/A 104.21.17.130:443 s.lletlee.com tcp
N/A 8.8.8.8:53 statuse.digitalcertvalidation.com udp
N/A 183.100.39.157:80 conceitosseg.com tcp
N/A 72.21.91.29:80 statuse.digitalcertvalidation.com tcp
N/A 88.99.66.31:443 iplogger.org tcp
N/A 152.89.247.174:80 152.89.247.174 tcp
N/A 8.8.8.8:53 crl.comodoca.com udp
N/A 208.95.112.1:80 ip-api.com tcp
N/A 128.1.32.84:80 128.1.32.84 tcp
N/A 8.8.8.8:53 uehge4g6gh.2ihsfa.com udp
N/A 88.218.92.148:80 uehge4g6gh.2ihsfa.com tcp
N/A 8.8.8.8:53 by.dirfgame.com udp
N/A 183.100.39.157:80 conceitosseg.com tcp
N/A 172.67.215.92:80 by.dirfgame.com tcp
N/A 208.95.112.1:80 ip-api.com tcp
N/A 37.0.11.41:80 37.0.11.41 tcp
N/A 45.142.213.135:30059 tcp
N/A 8.8.8.8:53 ol.gamegame.info udp
N/A 104.21.21.221:80 ol.gamegame.info tcp
N/A 8.8.8.8:53 iplis.ru udp
N/A 183.100.39.157:80 conceitosseg.com tcp
N/A 88.99.66.31:443 iplis.ru tcp
N/A 8.8.8.8:53 ivaloribar.xyz udp
N/A 8.8.8.8:53 api.ipify.org udp
N/A 54.225.78.40:80 api.ipify.org tcp
N/A 212.224.105.80:80 ivaloribar.xyz tcp
N/A 37.0.8.225:80 tcp
N/A 8.8.8.8:53 api.ip.sb udp
N/A 172.67.75.172:443 api.ip.sb tcp
N/A 8.8.8.8:53 yoshelona.xyz udp
N/A 183.100.39.157:80 conceitosseg.com tcp
N/A 37.0.8.225:80 tcp
N/A 77.220.213.35:52349 77.220.213.35 tcp
N/A 8.8.8.8:53 g-prtnrs.top udp
N/A 91.241.19.12:80 g-prtnrs.top tcp
N/A 74.114.154.22:443 shpak125.tumblr.com tcp
N/A 8.8.8.8:53 dwarimlari.xyz udp
N/A 88.218.92.148:80 uehge4g6gh.2ihsfa.com tcp

Files

memory/2624-114-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

MD5 7e03737d683bc19280a5dc25befc85b6
SHA1 c6718f0a136b082720c7bebfda479ec882033a5e
SHA256 7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449
SHA512 09486956105fd99ef7cb45a175483f873f6aa95462cbd25d344fbe4c770ac894d9c36506063eb7a4f6665e3ba78ae1f106a92a74428a4471ac58abce3003e2fb

memory/2756-117-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\setup_install.exe

MD5 b1b08befa4d0b60d8cf636ef7fa77779
SHA1 45c2bbd6af057098d1d1e4c925daa7c353ed024c
SHA256 08e6949bd92997ec51e4e87f2e320d9f2816567a72e3666d83d0a3e4f942ce1a
SHA512 e4af4a67ff39008e16cf0e781d327ce22d35555605da42e554ddfb377ffa0a17edc011284e310b16730025e0034ac453ef7b8354a21a5f8ab5d285bf4b4029e3

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libcurlpp.dll

MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libcurl.dll

MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libstdc++-6.dll

MD5 5e279950775baae5fea04d2cc4526bcc
SHA1 8aef1e10031c3629512c43dd8b0b5d9060878453
SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512 666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libwinpthread-1.dll

MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\libgcc_s_dw2-1.dll

MD5 9aec524b616618b0d3d00b27b6f51da1
SHA1 64264300801a353db324d11738ffed876550e1d3
SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA512 0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

memory/2756-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

memory/2756-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

memory/2756-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

memory/2756-133-0x0000000000400000-0x000000000051D000-memory.dmp

memory/1188-146-0x0000000000000000-mapping.dmp

memory/2756-145-0x0000000064940000-0x0000000064959000-memory.dmp

memory/2756-147-0x0000000064940000-0x0000000064959000-memory.dmp

memory/3580-148-0x0000000000000000-mapping.dmp

memory/2344-149-0x0000000000000000-mapping.dmp

memory/3504-144-0x0000000000000000-mapping.dmp

memory/2756-143-0x0000000064940000-0x0000000064959000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.txt

MD5 c04d390489ac28e849ca9159224822af
SHA1 5b0c9e7b4a95d4729e62d106dbf89cb72919e64a
SHA256 d22e667e3f813d044ab2f69ba255c01cc847e7104760bff7a404875bc3ba67df
SHA512 25a4dc0f77293e90c08576b8066d0fb9238763eed0451b96b0e4c3b2daeb51935d699f256c1e505b7cfa986abfde840ba07543d944ab1c79adde91fb5726e3af

memory/2152-152-0x0000000000000000-mapping.dmp

memory/3860-155-0x0000000000000000-mapping.dmp

memory/2496-154-0x0000000000000000-mapping.dmp

memory/1812-153-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_2.exe

MD5 9f569d0eae949d683725de7bbe893eb8
SHA1 e4696b870a5a9d06585df259e8ee80f4b2364823
SHA256 273fb2e46f46a189e896064ce7213f2805dc0aff361eb997d59ccd903f1e9e8a
SHA512 94264d5969ea49d2a4e1bda9f0456ac430f1ae727f60cad883c7c24d1965a58b10e6d6901133a61dd2faa4701677d50abba71762ba7529c15f5046e5e3d69170

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_3.exe

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

memory/2608-159-0x0000000000000000-mapping.dmp

memory/3952-156-0x0000000000000000-mapping.dmp

memory/3764-162-0x0000000000000000-mapping.dmp

memory/2140-164-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_4.exe

MD5 aebba1a56e0d716d2e4b6676888084c8
SHA1 fb0fc0de54c2f740deb8323272ff0180e4b89d99
SHA256 6529c1eb48d6a4ffe24e91bb65cab349436408048d403edf9fcfa38ac617d38b
SHA512 914fbff3f840d7dbde470514c9f8916112bbccce4f427b84c395c870b7194b3f6f453f583fc1081c6e896e3af3b89d5fdf0999a9a766e41a8f0448e6f06e6b62

memory/3572-171-0x0000000000000000-mapping.dmp

memory/2140-173-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_5.exe

MD5 f9de3cedf6902c9b1d4794c8af41663e
SHA1 0439964dbcfa9ecd68b0f10557018098dcb6d126
SHA256 ce745112067479db4711a5f2c67706b9ab6423e5b5ffe58037e72286aabef338
SHA512 aa5f010a5decb5b2a620fe567f891984a3c7bdd2962cb452e3edda7ecc1ef742ab58cdbe7f1d7d5b28b39b606ccd52b66ad21d2cb2a22ea34ef50202854d2c31

memory/200-170-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

memory/2608-166-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_6.exe

MD5 0c3f670f496ffcf516fe77d2a161a6ee
SHA1 0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512 bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.exe

MD5 2eb68e495e4eb18c86a443b2754bbab2
SHA1 82a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256 a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512 f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898

memory/200-163-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_8.exe

MD5 c04d390489ac28e849ca9159224822af
SHA1 5b0c9e7b4a95d4729e62d106dbf89cb72919e64a
SHA256 d22e667e3f813d044ab2f69ba255c01cc847e7104760bff7a404875bc3ba67df
SHA512 25a4dc0f77293e90c08576b8066d0fb9238763eed0451b96b0e4c3b2daeb51935d699f256c1e505b7cfa986abfde840ba07543d944ab1c79adde91fb5726e3af

memory/200-176-0x000000001C440000-0x000000001C442000-memory.dmp

memory/8-151-0x0000000000000000-mapping.dmp

memory/3792-150-0x0000000000000000-mapping.dmp

memory/2140-177-0x00000000013E0000-0x00000000013E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.exe

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

memory/3724-178-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_7.txt

MD5 2eb68e495e4eb18c86a443b2754bbab2
SHA1 82a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256 a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512 f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_6.txt

MD5 0c3f670f496ffcf516fe77d2a161a6ee
SHA1 0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512 bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_5.txt

MD5 f9de3cedf6902c9b1d4794c8af41663e
SHA1 0439964dbcfa9ecd68b0f10557018098dcb6d126
SHA256 ce745112067479db4711a5f2c67706b9ab6423e5b5ffe58037e72286aabef338
SHA512 aa5f010a5decb5b2a620fe567f891984a3c7bdd2962cb452e3edda7ecc1ef742ab58cdbe7f1d7d5b28b39b606ccd52b66ad21d2cb2a22ea34ef50202854d2c31

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_4.txt

MD5 aebba1a56e0d716d2e4b6676888084c8
SHA1 fb0fc0de54c2f740deb8323272ff0180e4b89d99
SHA256 6529c1eb48d6a4ffe24e91bb65cab349436408048d403edf9fcfa38ac617d38b
SHA512 914fbff3f840d7dbde470514c9f8916112bbccce4f427b84c395c870b7194b3f6f453f583fc1081c6e896e3af3b89d5fdf0999a9a766e41a8f0448e6f06e6b62

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_3.txt

MD5 7c42c04a6e95c6b494018be20ef811dc
SHA1 126d1bce056ae6ba2cea63815f6465450a1a6339
SHA256 f5d5b68ad033335a06f341b7968209734cae7487ac80a3646843762bd1147e69
SHA512 2334784119ccf315d38e8d02aa4752b0e5b9243750df0f8f0fc492bc1b617fadd871a23d57d536c2bcf593e8d683b4f2567b316cc43db0061d9bba7014f2f317

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_2.txt

MD5 9f569d0eae949d683725de7bbe893eb8
SHA1 e4696b870a5a9d06585df259e8ee80f4b2364823
SHA256 273fb2e46f46a189e896064ce7213f2805dc0aff361eb997d59ccd903f1e9e8a
SHA512 94264d5969ea49d2a4e1bda9f0456ac430f1ae727f60cad883c7c24d1965a58b10e6d6901133a61dd2faa4701677d50abba71762ba7529c15f5046e5e3d69170

C:\Users\Admin\AppData\Local\Temp\7zS04AC6A14\sonia_1.txt

MD5 6e43430011784cff369ea5a5ae4b000f
SHA1 5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256 a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA512 33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

memory/3468-181-0x0000000000000000-mapping.dmp

memory/2140-180-0x0000000001410000-0x0000000001433000-memory.dmp

memory/2756-134-0x0000000064940000-0x0000000064959000-memory.dmp

memory/3468-184-0x0000000000180000-0x0000000000181000-memory.dmp

memory/4136-187-0x0000000000000000-mapping.dmp

memory/2140-188-0x000000001BA60000-0x000000001BA62000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Install2.EXE

MD5 ab5eae79062ddedb6715c265dddd9044
SHA1 254a9f7bd992f0e2dd1c33dc03db60050402df84
SHA256 8a87cc9fab38ab661ed147f2b39b85582e9ee7671006780f528d6fddb377f75f
SHA512 28e2568646d8a103e138a0f5bc15a785aeb6b41f87c30be9db556c4baf58a25902bb94cb72d861cbfc24f3829342d50ce891e0637ccd04ac9252abe60b33ab4d

memory/4188-191-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Install2.EXE

MD5 ab5eae79062ddedb6715c265dddd9044
SHA1 254a9f7bd992f0e2dd1c33dc03db60050402df84
SHA256 8a87cc9fab38ab661ed147f2b39b85582e9ee7671006780f528d6fddb377f75f
SHA512 28e2568646d8a103e138a0f5bc15a785aeb6b41f87c30be9db556c4baf58a25902bb94cb72d861cbfc24f3829342d50ce891e0637ccd04ac9252abe60b33ab4d

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

memory/4208-199-0x0000000000480000-0x0000000000481000-memory.dmp

memory/4324-200-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe

MD5 6e61e25e7dc311d34b4a37e9c42d4079
SHA1 f623f0c66d599a12677cabcb0140034b5cf969bf
SHA256 55366854ece30f35d98d54b9fdfd48b0c4482bdfd4aacb59c78ccde8ce89bd9d
SHA512 da2f50a9139bcaa89680d939b905187574d2b84b89436f570c2e218680dad5c3d880cfc9e434f26c059d6602a334f2488afae4e9b92fcdc022928164400b7314

C:\Users\Admin\AppData\Local\Temp\P1GlorySetp.exe

MD5 6e61e25e7dc311d34b4a37e9c42d4079
SHA1 f623f0c66d599a12677cabcb0140034b5cf969bf
SHA256 55366854ece30f35d98d54b9fdfd48b0c4482bdfd4aacb59c78ccde8ce89bd9d
SHA512 da2f50a9139bcaa89680d939b905187574d2b84b89436f570c2e218680dad5c3d880cfc9e434f26c059d6602a334f2488afae4e9b92fcdc022928164400b7314

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

MD5 a20ebb2a10324b073fd40110d9ee705d
SHA1 33cf4d5e7bc35f9ef524ad9eb38c9e229ea128f1
SHA256 e6cb7b6bd4848499533b29bdf85f60e362df435c6254d74521ad40dddfb77d1a
SHA512 797dcb7dcc6cbfeadc65816ce1bc6dc140fcf7f7255b78cbb26702904af0853e97b614de3d958c3646e2d3f65417d923588836e3c745a50b767ff3db0706ae84

memory/4416-204-0x0000000000000000-mapping.dmp

memory/4208-203-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

memory/4208-192-0x0000000000000000-mapping.dmp

memory/2140-185-0x00000000013F0000-0x00000000013F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Chrome2.exe

MD5 1eba952dd3974898cd98fbc8807b6929
SHA1 963289ab1f6af6b34fc596bb0464947e230db350
SHA256 6725aa9db031f924217cc47b78f53f03aafa329eb15906a910f21abc05116315
SHA512 18a23964951d6ba123f92b53cef1e70f4840803675c884ae4f128e55eecb6667ad456b164ca9ff47eaf01256ad0d46de69c520b16ab5af58175c13e759c20397

C:\Users\Admin\AppData\Local\Temp\Chrome2.exe

MD5 1eba952dd3974898cd98fbc8807b6929
SHA1 963289ab1f6af6b34fc596bb0464947e230db350
SHA256 6725aa9db031f924217cc47b78f53f03aafa329eb15906a910f21abc05116315
SHA512 18a23964951d6ba123f92b53cef1e70f4840803675c884ae4f128e55eecb6667ad456b164ca9ff47eaf01256ad0d46de69c520b16ab5af58175c13e759c20397

memory/4416-207-0x0000000000C50000-0x0000000000C51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 efc352d21b18e468273577da51189c2e
SHA1 c832eb34a76b866aa3acccb705476832683d9e73
SHA256 cbf481dda581c5e9840f4c3c1a38c3d9ddd7ff6f244e6afa37c1cce9c6214fba
SHA512 143a5d5d1dcb9c80e5ae34b2d2fae19471496513a7f131f6eb48278e673545df014b19689b305e8ef411506fa482b8665e344012810a76df75a472b3e5df2059

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 efc352d21b18e468273577da51189c2e
SHA1 c832eb34a76b866aa3acccb705476832683d9e73
SHA256 cbf481dda581c5e9840f4c3c1a38c3d9ddd7ff6f244e6afa37c1cce9c6214fba
SHA512 143a5d5d1dcb9c80e5ae34b2d2fae19471496513a7f131f6eb48278e673545df014b19689b305e8ef411506fa482b8665e344012810a76df75a472b3e5df2059

memory/4208-210-0x0000000000C00000-0x0000000000C02000-memory.dmp

\Users\Admin\AppData\Local\Temp\CC4F.tmp

MD5 50741b3f2d7debf5d2bed63d88404029
SHA1 56210388a627b926162b36967045be06ffb1aad3
SHA256 f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512 fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

memory/2496-211-0x0000000000030000-0x0000000000039000-memory.dmp

memory/4208-214-0x0000000000BB0000-0x0000000000BD3000-memory.dmp

memory/3860-215-0x00000000008F0000-0x0000000000A3A000-memory.dmp

memory/3860-217-0x0000000000400000-0x00000000008EB000-memory.dmp

memory/4208-219-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

memory/2496-218-0x0000000000400000-0x000000000088F000-memory.dmp

memory/4324-213-0x0000000000B30000-0x0000000000B31000-memory.dmp

memory/4580-220-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3002.exe

MD5 e511bb4cf31a2307b6f3445a869bcf31
SHA1 76f5c6e8df733ac13d205d426831ed7672a05349
SHA256 56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137
SHA512 9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

\Users\Admin\AppData\Local\Temp\axhub.dll

MD5 1c7be730bdc4833afb7117d48c3fd513
SHA1 dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA256 8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA512 7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

memory/4688-225-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\askinstall54.exe

MD5 1c26d844eac983317d51664d92e26037
SHA1 0fcf6bdc38115bedea1a2c7b3fe9f028e85dc59c
SHA256 6c613e1e1c2f9e06505bd9f752af269d30317934278b0b91bd51a89c079cc2a3
SHA512 d06bee071f60aad1d12564fb7b211e737d7567d0acda7cc18b19b9b3a12ef6bff7282856b9e16382ad9b653b0e8cd259ba4a99930e947c5d59eaba74c0f26e06

C:\Users\Admin\AppData\Local\Temp\axhub.dat

MD5 99ab358c6f267b09d7a596548654a6ba
SHA1 d5a643074b69be2281a168983e3f6bef7322f676
SHA256 586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512 952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b

memory/4324-228-0x0000000005350000-0x0000000005351000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\askinstall54.exe

MD5 1c26d844eac983317d51664d92e26037
SHA1 0fcf6bdc38115bedea1a2c7b3fe9f028e85dc59c
SHA256 6c613e1e1c2f9e06505bd9f752af269d30317934278b0b91bd51a89c079cc2a3
SHA512 d06bee071f60aad1d12564fb7b211e737d7567d0acda7cc18b19b9b3a12ef6bff7282856b9e16382ad9b653b0e8cd259ba4a99930e947c5d59eaba74c0f26e06

memory/4644-224-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\axhub.dll

MD5 1c7be730bdc4833afb7117d48c3fd513
SHA1 dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA256 8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA512 7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

C:\Users\Admin\AppData\Local\Temp\3002.exe

MD5 e511bb4cf31a2307b6f3445a869bcf31
SHA1 76f5c6e8df733ac13d205d426831ed7672a05349
SHA256 56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137
SHA512 9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe

MD5 e4b4e8239211d0334ea235cf9fc8b272
SHA1 dfd916e4074e177288e62c444f947d408963cf8d
SHA256 d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b
SHA512 ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

memory/4888-237-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe

MD5 e4b4e8239211d0334ea235cf9fc8b272
SHA1 dfd916e4074e177288e62c444f947d408963cf8d
SHA256 d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b
SHA512 ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

memory/4792-231-0x0000000000000000-mapping.dmp

memory/4324-221-0x00000000053B0000-0x00000000053B1000-memory.dmp

memory/4916-240-0x00007FF6EBC94060-mapping.dmp

memory/4976-242-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe

MD5 9cfa65c4d7300d02dc8db6dfcd662447
SHA1 adf8103369c24e04d3cebc500659ef9d50b605c5
SHA256 e3d556df0c1db47d21134214070f90c0ee000d47889ceecdb0fb19ab00f8b4d7
SHA512 d7288293ad35c45f1ccaac5f94ace2a6ff7ecead1a81f6b9f03ba1e081fa08e33df44891bc868e9fe48c34ef75f0fcfb261a03a2dda1e60e754c232488c2cc4c

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BIRZAC~1.EXE

MD5 a20ebb2a10324b073fd40110d9ee705d
SHA1 33cf4d5e7bc35f9ef524ad9eb38c9e229ea128f1
SHA256 e6cb7b6bd4848499533b29bdf85f60e362df435c6254d74521ad40dddfb77d1a
SHA512 797dcb7dcc6cbfeadc65816ce1bc6dc140fcf7f7255b78cbb26702904af0853e97b614de3d958c3646e2d3f65417d923588836e3c745a50b767ff3db0706ae84

memory/4644-248-0x0000000004563000-0x0000000004664000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

memory/5088-254-0x0000000000000000-mapping.dmp

memory/996-255-0x0000025E4A140000-0x0000025E4A1B1000-memory.dmp

memory/4644-253-0x0000000004470000-0x00000000044CD000-memory.dmp

memory/4916-251-0x0000023BE9DD0000-0x0000023BE9E41000-memory.dmp

memory/4324-246-0x0000000005320000-0x0000000005321000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pub1.exe

MD5 870e13b640e4e99c60c7f41ee4ea95bb
SHA1 68077dcdadefec55abb38514a65d34abb293273a
SHA256 7df446ede9c1db56f1196ae9dae181054f5b5970711d9bc6705cede1d804ef1a
SHA512 093ae54d30c8141cc3d73ca0dea69ccd799a2be2a4434d588466dcc00b3522f29fa40e2ec10c51950b032f8874c2723d6e807750fbd8bd624ae455b5a1978d07

C:\Users\Admin\AppData\Local\Temp\pub1.exe

MD5 870e13b640e4e99c60c7f41ee4ea95bb
SHA1 68077dcdadefec55abb38514a65d34abb293273a
SHA256 7df446ede9c1db56f1196ae9dae181054f5b5970711d9bc6705cede1d804ef1a
SHA512 093ae54d30c8141cc3d73ca0dea69ccd799a2be2a4434d588466dcc00b3522f29fa40e2ec10c51950b032f8874c2723d6e807750fbd8bd624ae455b5a1978d07

memory/668-262-0x000002120E3E0000-0x000002120E451000-memory.dmp

memory/4888-261-0x00000000005F0000-0x00000000005F1000-memory.dmp

memory/2328-267-0x0000015C0AFD0000-0x0000015C0B041000-memory.dmp

memory/192-266-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3002.exe

MD5 e511bb4cf31a2307b6f3445a869bcf31
SHA1 76f5c6e8df733ac13d205d426831ed7672a05349
SHA256 56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137
SHA512 9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

memory/2572-265-0x000002725B780000-0x000002725B7F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe

MD5 9cfa65c4d7300d02dc8db6dfcd662447
SHA1 adf8103369c24e04d3cebc500659ef9d50b605c5
SHA256 e3d556df0c1db47d21134214070f90c0ee000d47889ceecdb0fb19ab00f8b4d7
SHA512 d7288293ad35c45f1ccaac5f94ace2a6ff7ecead1a81f6b9f03ba1e081fa08e33df44891bc868e9fe48c34ef75f0fcfb261a03a2dda1e60e754c232488c2cc4c

memory/4404-274-0x0000000000000000-mapping.dmp

memory/668-256-0x000002120E320000-0x000002120E36C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA512 3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

C:\Users\Admin\AppData\Local\Temp\setup.exe

MD5 f045d3467289a1b177b33c35c726e5ed
SHA1 01b96307874f1a1a277bf062e03f2a47a6c906d0
SHA256 a8e6248c5472e049abd81f8678457b9f94453a67cb6edb45578ed69a0b926bce
SHA512 5b76dab8503156f23506ee6e4834b46bb2611698edbc5d305eccea52d168c95eabd3343691ede96f8d0194fe69afd424795832ee03409a15f058d57cbc2d6e0d

memory/3468-280-0x0000000000A80000-0x0000000000A8A000-memory.dmp

memory/380-281-0x000002D0E7060000-0x000002D0E70D1000-memory.dmp

memory/4888-279-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\setup.exe

MD5 f045d3467289a1b177b33c35c726e5ed
SHA1 01b96307874f1a1a277bf062e03f2a47a6c906d0
SHA256 a8e6248c5472e049abd81f8678457b9f94453a67cb6edb45578ed69a0b926bce
SHA512 5b76dab8503156f23506ee6e4834b46bb2611698edbc5d305eccea52d168c95eabd3343691ede96f8d0194fe69afd424795832ee03409a15f058d57cbc2d6e0d

memory/4832-288-0x0000000000000000-mapping.dmp

memory/2228-287-0x0000000000000000-mapping.dmp

memory/3468-283-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

memory/2348-282-0x0000028603B70000-0x0000028603BE1000-memory.dmp

memory/1100-285-0x000001E698E80000-0x000001E698EF1000-memory.dmp

memory/3612-289-0x0000000000000000-mapping.dmp

memory/4900-290-0x0000000000000000-mapping.dmp

memory/5016-291-0x0000000000000000-mapping.dmp

memory/4856-300-0x0000000000000000-mapping.dmp

memory/4832-302-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

memory/5040-301-0x0000000000000000-mapping.dmp

memory/4900-306-0x00000000000B0000-0x00000000000B1000-memory.dmp

memory/4232-305-0x0000000000417DE2-mapping.dmp

memory/2588-299-0x0000000000000000-mapping.dmp

memory/4212-298-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4232-297-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2228-296-0x0000000000990000-0x0000000000991000-memory.dmp

C:\Users\Admin\Documents\CUa9Qn2wrcaY_2hyaDO7lIJr.exe

MD5 5e7a2fdde2803b22b39abf66ecf9bc33
SHA1 8581bf9990d130b259a558e6117b2877af481b1c
SHA256 bfc594ee1e900ae34a48fbb6c833ffe9a0fae9baf8b620d71a273a0913dbd939
SHA512 7ae0bfc9bace472f53c3add50d7479cd5430010057d5c0f7163000a295f4983e496ec9b75b4308aad998a0794391920cdd4f070ddc8b12381b54fb7627984718

memory/4320-292-0x0000000000000000-mapping.dmp

C:\Users\Admin\Documents\CUa9Qn2wrcaY_2hyaDO7lIJr.exe

MD5 5e7a2fdde2803b22b39abf66ecf9bc33
SHA1 8581bf9990d130b259a558e6117b2877af481b1c
SHA256 bfc594ee1e900ae34a48fbb6c833ffe9a0fae9baf8b620d71a273a0913dbd939
SHA512 7ae0bfc9bace472f53c3add50d7479cd5430010057d5c0f7163000a295f4983e496ec9b75b4308aad998a0794391920cdd4f070ddc8b12381b54fb7627984718

memory/3468-293-0x0000000002850000-0x0000000002852000-memory.dmp

memory/2228-315-0x0000000001020000-0x0000000001021000-memory.dmp

memory/1604-324-0x0000000000000000-mapping.dmp

memory/4232-322-0x00000000052F0000-0x00000000052F1000-memory.dmp

memory/4232-327-0x0000000002850000-0x0000000002851000-memory.dmp

memory/4232-331-0x0000000004D20000-0x0000000004D21000-memory.dmp

memory/3712-333-0x0000000000000000-mapping.dmp

memory/2588-339-0x00000000025E0000-0x00000000025E2000-memory.dmp

memory/4232-340-0x0000000004D60000-0x0000000004D61000-memory.dmp

memory/1148-345-0x000001C5C3A30000-0x000001C5C3AA1000-memory.dmp

memory/2588-344-0x00000000025F0000-0x0000000002613000-memory.dmp

memory/4212-342-0x0000000005040000-0x0000000005646000-memory.dmp

memory/1976-337-0x00000276D90C0000-0x00000276D9131000-memory.dmp

memory/2588-330-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

memory/3612-317-0x0000000000920000-0x0000000000921000-memory.dmp

memory/2588-312-0x00000000005C0000-0x00000000005C1000-memory.dmp

memory/2376-310-0x0000000000A60000-0x0000000000A75000-memory.dmp

memory/2588-350-0x0000000000C00000-0x0000000000C01000-memory.dmp

memory/4976-347-0x0000000000030000-0x0000000000039000-memory.dmp

memory/4212-308-0x0000000000417E02-mapping.dmp

memory/1416-303-0x000001D63EA50000-0x000001D63EAC1000-memory.dmp

memory/2652-349-0x000002424ED40000-0x000002424EDB1000-memory.dmp

memory/5016-354-0x00000000773C0000-0x000000007754E000-memory.dmp

memory/3612-355-0x0000000005260000-0x0000000005261000-memory.dmp

memory/2496-361-0x0000000000000000-mapping.dmp

memory/1368-362-0x00000140D3E60000-0x00000140D3ED1000-memory.dmp

memory/4212-359-0x00000000053F0000-0x00000000053F1000-memory.dmp

memory/2192-366-0x0000000000000000-mapping.dmp

memory/4232-358-0x0000000004CE0000-0x00000000052E6000-memory.dmp

memory/5016-356-0x0000000000200000-0x0000000000201000-memory.dmp

memory/2660-353-0x0000025D1F1D0000-0x0000025D1F241000-memory.dmp

memory/4976-352-0x0000000000400000-0x0000000000891000-memory.dmp

memory/4416-368-0x0000000000000000-mapping.dmp

memory/1188-373-0x0000000000000000-mapping.dmp

memory/4460-372-0x0000000000000000-mapping.dmp

memory/2760-374-0x0000000000000000-mapping.dmp

memory/5088-376-0x00000000001D0000-0x00000000001FE000-memory.dmp

memory/5088-377-0x0000000000400000-0x00000000009BE000-memory.dmp

memory/5016-375-0x0000000005740000-0x0000000005741000-memory.dmp

memory/3248-378-0x0000000000000000-mapping.dmp

memory/3084-382-0x0000000000000000-mapping.dmp

memory/1668-380-0x0000000000000000-mapping.dmp

memory/4580-381-0x0000000000000000-mapping.dmp

memory/428-379-0x0000000000000000-mapping.dmp

memory/4832-392-0x0000000003090000-0x0000000003091000-memory.dmp

memory/4916-402-0x0000023BE9BE0000-0x0000023BE9BFB000-memory.dmp

memory/4916-405-0x0000023BEC490000-0x0000023BEC596000-memory.dmp

memory/4900-397-0x0000000004960000-0x0000000004961000-memory.dmp

memory/4320-409-0x0000028677700000-0x000002867776F000-memory.dmp

memory/2376-414-0x0000000000C30000-0x0000000000C45000-memory.dmp

memory/4320-418-0x0000028677770000-0x0000028677840000-memory.dmp

memory/4416-389-0x00000000012F0000-0x00000000012F2000-memory.dmp

memory/4380-387-0x0000000000000000-mapping.dmp

memory/4028-386-0x0000000000000000-mapping.dmp

memory/4464-385-0x0000000000000000-mapping.dmp

memory/2244-383-0x0000000000000000-mapping.dmp

memory/3760-384-0x0000000000000000-mapping.dmp

memory/4580-429-0x0000000005960000-0x0000000005961000-memory.dmp

memory/4888-427-0x0000000004C20000-0x0000000005226000-memory.dmp

memory/3084-439-0x00000000773C0000-0x000000007754E000-memory.dmp

memory/4380-435-0x00000000773C0000-0x000000007754E000-memory.dmp

memory/2244-430-0x0000000004940000-0x00000000049B6000-memory.dmp

memory/3608-458-0x0000000001120000-0x0000000001122000-memory.dmp

memory/5060-462-0x0000000005460000-0x0000000005A66000-memory.dmp

memory/4380-472-0x0000000005B40000-0x0000000005B41000-memory.dmp

memory/4196-474-0x00000000054B0000-0x0000000005AB6000-memory.dmp

memory/5044-476-0x0000000004E00000-0x00000000052FE000-memory.dmp

memory/1668-482-0x00000000009B0000-0x0000000000AFA000-memory.dmp

memory/3084-479-0x0000000005670000-0x0000000005671000-memory.dmp

memory/4464-485-0x0000000000400000-0x00000000008AF000-memory.dmp