Analysis

  • max time kernel
    4294212s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    12-03-2022 03:47

General

  • Target

    a00a83410de17b566a300fe4745a4ef963bfeb4a006d0f475def96a67ef4c36c.exe

  • Size

    3.3MB

  • MD5

    485fb3b3d2eafd1fa3a9d4bfd11c6fc8

  • SHA1

    32e3d51b13ac7c59390cf884aa4365fb3db54096

  • SHA256

    a00a83410de17b566a300fe4745a4ef963bfeb4a006d0f475def96a67ef4c36c

  • SHA512

    c8ba6e37a885e6f9b90a86f72567884a57e06cddf9a9f3fb7ac4864ff3045b1d098de16d1e3e657ff888f46ab41bddcabd92450af2eeff18cd3858b0ce06790b

Malware Config

Extracted

Family

redline

Botnet

Cana

C2

176.111.174.254:56328

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 64 IoCs
  • ASPack v2.12-2.42 17 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 10 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 54 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 6 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:460
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          3⤵
            PID:2240
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
            PID:528
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
              PID:1484
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k SystemNetworkService
              2⤵
                PID:384
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                  PID:984
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                    PID:1772
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                    2⤵
                      PID:960
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                      2⤵
                        PID:1364
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                          PID:604
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                            PID:976
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                              PID:1224
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                              2⤵
                                PID:1088
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                  PID:1620
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                  2⤵
                                    PID:1156
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                    2⤵
                                      PID:1976
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                      2⤵
                                        PID:1808
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:668
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                          PID:292
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                          2⤵
                                            PID:1064
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                            2⤵
                                              PID:1340
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                              2⤵
                                                PID:1352
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                2⤵
                                                  PID:1240
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                  2⤵
                                                    PID:1336
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                    2⤵
                                                      PID:1376
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                      2⤵
                                                        PID:1588
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                        2⤵
                                                          PID:1508
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                          2⤵
                                                            PID:756
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                            2⤵
                                                              PID:1724
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                              2⤵
                                                                PID:1500
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                2⤵
                                                                  PID:1480
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                  2⤵
                                                                    PID:1972
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                    2⤵
                                                                      PID:632
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                      2⤵
                                                                        PID:1252
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                        2⤵
                                                                          PID:1236
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                          2⤵
                                                                            PID:1524
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                            2⤵
                                                                              PID:2032
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                              2⤵
                                                                                PID:1684
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                2⤵
                                                                                  PID:1964
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                  2⤵
                                                                                    PID:1872
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                    2⤵
                                                                                      PID:1056
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                      2⤵
                                                                                        PID:564
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                        2⤵
                                                                                          PID:1276
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                          2⤵
                                                                                            PID:1680
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                            2⤵
                                                                                              PID:864
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                              2⤵
                                                                                                PID:1584
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                2⤵
                                                                                                  PID:1736
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                  2⤵
                                                                                                    PID:860
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                    2⤵
                                                                                                      PID:1008
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                      2⤵
                                                                                                        PID:588
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                        2⤵
                                                                                                          PID:1504
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                          2⤵
                                                                                                            PID:1324
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                            2⤵
                                                                                                              PID:1052
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                              2⤵
                                                                                                                PID:552
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                2⤵
                                                                                                                  PID:2044
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                  2⤵
                                                                                                                    PID:1876
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                    2⤵
                                                                                                                      PID:2064
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                      2⤵
                                                                                                                        PID:2708
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                        2⤵
                                                                                                                          PID:2732
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                          2⤵
                                                                                                                            PID:2756
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                            2⤵
                                                                                                                              PID:2780
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                              2⤵
                                                                                                                                PID:2804
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                2⤵
                                                                                                                                  PID:2876
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                  2⤵
                                                                                                                                    PID:2908
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                    2⤵
                                                                                                                                      PID:2932
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                      2⤵
                                                                                                                                        PID:2948
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                        2⤵
                                                                                                                                          PID:2972
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                          2⤵
                                                                                                                                            PID:2996
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                            2⤵
                                                                                                                                              PID:3020
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                              2⤵
                                                                                                                                                PID:3036
                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                2⤵
                                                                                                                                                  PID:3060
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1816
                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1560
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1660
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1020
                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1308
                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2108
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2096
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2084
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2160
                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1116
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1628
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:776
                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2280
                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:2296
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2304
                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2324
                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2340
                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2388
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2404
                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2420
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a00a83410de17b566a300fe4745a4ef963bfeb4a006d0f475def96a67ef4c36c.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a00a83410de17b566a300fe4745a4ef963bfeb4a006d0f475def96a67ef4c36c.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:1996
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:1640
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sonia_1.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:1284
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_1.exe
                                                                                                                                                                                              sonia_1.exe
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:1052
                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:112
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sonia_2.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:1344
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_2.exe
                                                                                                                                                                                              sonia_2.exe
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                              PID:1816
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sonia_8.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1520
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:2020
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_7.exe
                                                                                                                                                                                                sonia_7.exe
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:1576
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:1792
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_6.exe
                                                                                                                                                                                                sonia_6.exe
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:1020
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_5.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:980
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_5.exe
                                                                                                                                                                                                sonia_5.exe
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:1516
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sonia_4.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:2024
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_4.exe
                                                                                                                                                                                                sonia_4.exe
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:668
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sonia_3.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:1924
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_3.exe
                                                                                                                                                                                                  sonia_3.exe
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Modifies system certificate store
                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 964
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 420
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                PID:1592

                                                                                                                                                                                          Network

                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                          Persistence

                                                                                                                                                                                          Modify Existing Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1031

                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                          2
                                                                                                                                                                                          T1112

                                                                                                                                                                                          Disabling Security Tools

                                                                                                                                                                                          1
                                                                                                                                                                                          T1089

                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                          1
                                                                                                                                                                                          T1130

                                                                                                                                                                                          Discovery

                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                          2
                                                                                                                                                                                          T1082

                                                                                                                                                                                          Query Registry

                                                                                                                                                                                          1
                                                                                                                                                                                          T1012

                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1120

                                                                                                                                                                                          Command and Control

                                                                                                                                                                                          Web Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1102

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\libcurl.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\libcurlpp.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\libgcc_s_dw2-1.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\libstdc++-6.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\libwinpthread-1.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_1.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7837314688b7989de1e8d94f598eb2dd

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            889ae8ce433d5357f8ea2aff64daaba563dc94e3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_1.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7837314688b7989de1e8d94f598eb2dd

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            889ae8ce433d5357f8ea2aff64daaba563dc94e3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_2.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bd8d3e2ece2d873dc8f9f27377cfdb20

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2f93fb292a56b92a6f66257d1523aabec3b57c5e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0ec573288ae2237f7127b399ed33f920a263628517fcbea42b7271d12743eb9f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ad7007a12cfe4ee2e9003e9660aad53a6b0d28f77136dccc9f702e5592096a5642fce3409ec7d126449dab3ba5c8847c3f594b477512b0cfbe5a6f1fd0f2b22b

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_2.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bd8d3e2ece2d873dc8f9f27377cfdb20

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2f93fb292a56b92a6f66257d1523aabec3b57c5e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0ec573288ae2237f7127b399ed33f920a263628517fcbea42b7271d12743eb9f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ad7007a12cfe4ee2e9003e9660aad53a6b0d28f77136dccc9f702e5592096a5642fce3409ec7d126449dab3ba5c8847c3f594b477512b0cfbe5a6f1fd0f2b22b

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_3.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            f7eb1781b32a1f71d74a475b1ff01d9e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2448b54e98df83975be1fad49236c51cd91b309f

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fcd7594fe4671bc043182bd4cf88c680daa568739eacc23f3aa24aeb942ac99c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e1f939862f36213fa3a7f03cdde9ad6be4690786eb0e474d6ae47a3f7faef46313f5931167d04ae8e0086a1b8a56f4a74b7ca2d59aa8857cce1c94eaa90ce518

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_3.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            f7eb1781b32a1f71d74a475b1ff01d9e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2448b54e98df83975be1fad49236c51cd91b309f

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fcd7594fe4671bc043182bd4cf88c680daa568739eacc23f3aa24aeb942ac99c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e1f939862f36213fa3a7f03cdde9ad6be4690786eb0e474d6ae47a3f7faef46313f5931167d04ae8e0086a1b8a56f4a74b7ca2d59aa8857cce1c94eaa90ce518

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_4.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_4.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_5.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            8d9c547b81d8879a650a50a5f24f7024

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            f98072723cca6f7c862b2bb056d9de844c2953aa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            38a18614d1a00a939be838c7ca0b343f1ed8b33d4317648750a1ac0d6a72a861

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e2f2cb74d5911b19a82bf021772a71b94deb123b2095233d3a965f657d909d15b4bdc9706413ef49d59249e40232507d8ba33bc9e9d0f9544c08b50349610bad

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_5.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            8d9c547b81d8879a650a50a5f24f7024

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            f98072723cca6f7c862b2bb056d9de844c2953aa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            38a18614d1a00a939be838c7ca0b343f1ed8b33d4317648750a1ac0d6a72a861

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e2f2cb74d5911b19a82bf021772a71b94deb123b2095233d3a965f657d909d15b4bdc9706413ef49d59249e40232507d8ba33bc9e9d0f9544c08b50349610bad

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_6.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            3568d61a49b61ce18bd6093748ffd32a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            0f6c4618eb4fca4972869a56bf6d8b020e1440f8

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            af350212764e6304bf417e81cf0009b494119670e4bc1b187cd79cf4c487c7b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5c0129297fe07f919fe228633e193f56167e4f92815aa2cb1b9749ff14f377ec4d5c0414dffc733cbdc0b448e4552e06a527a481a144cd3af413c77fe2937cde

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_6.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            3568d61a49b61ce18bd6093748ffd32a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            0f6c4618eb4fca4972869a56bf6d8b020e1440f8

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            af350212764e6304bf417e81cf0009b494119670e4bc1b187cd79cf4c487c7b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5c0129297fe07f919fe228633e193f56167e4f92815aa2cb1b9749ff14f377ec4d5c0414dffc733cbdc0b448e4552e06a527a481a144cd3af413c77fe2937cde

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            a619719c691f7cf4f68f80045cef89db

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d4a643dc1954f3872f75f18e01be501a8142c0fa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d66a43c1f830997ba92149f8e93d040dbaa9a8df0637e07b9be7cfa85c884a25

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            76486b0f0102320c60478158170006ffc377c54eb0891ed1d3c7b48d2f1bdf09cbe51be0c03c9122c00015bb53e66e7a9320517f1610868cc45ef0eea319b23d

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_7.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            a619719c691f7cf4f68f80045cef89db

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d4a643dc1954f3872f75f18e01be501a8142c0fa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d66a43c1f830997ba92149f8e93d040dbaa9a8df0637e07b9be7cfa85c884a25

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            76486b0f0102320c60478158170006ffc377c54eb0891ed1d3c7b48d2f1bdf09cbe51be0c03c9122c00015bb53e66e7a9320517f1610868cc45ef0eea319b23d

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_8.txt
                                                                                                                                                                                            MD5

                                                                                                                                                                                            2db2339eb1e4591bf50b57e9578c52a4

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            ee018ac734e410f42125cc378f07dc666f277a10

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            15692b1bb15ddf9e505696d8d61188fc689e31c49beb05f36034f5292aec1e7c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            357c5eaacfcb2c555e87e0834ade6ec727399417b05d66e11881421239463cf27dc0f8d15b978d023f2f63b3510050de3ead4626c7e43a178f8650b1374c1d66

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\libcurl.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\libcurlpp.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\libgcc_s_dw2-1.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9aec524b616618b0d3d00b27b6f51da1

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            64264300801a353db324d11738ffed876550e1d3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\libstdc++-6.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            5e279950775baae5fea04d2cc4526bcc

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\libwinpthread-1.dll
                                                                                                                                                                                            MD5

                                                                                                                                                                                            1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\setup_install.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            6affd678204fc45b7d3b8b12f5f0669f

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            95a7344f53d93fbe0cc206d59786a42c8623ca67

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            060de3aafea11fae4d49f1f425a29419c2fe523ade3dd59203d722771ef8e784

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            985fdeaf62c253dcd5282b378ee9f94d32770ca623ca53e96ca3d25cd788ff271b99623f97c636d90bf28aa49f0933baede6c7f74d7a42b9192be0849b9a82f1

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_1.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7837314688b7989de1e8d94f598eb2dd

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            889ae8ce433d5357f8ea2aff64daaba563dc94e3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_1.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7837314688b7989de1e8d94f598eb2dd

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            889ae8ce433d5357f8ea2aff64daaba563dc94e3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_1.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7837314688b7989de1e8d94f598eb2dd

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            889ae8ce433d5357f8ea2aff64daaba563dc94e3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_2.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bd8d3e2ece2d873dc8f9f27377cfdb20

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2f93fb292a56b92a6f66257d1523aabec3b57c5e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0ec573288ae2237f7127b399ed33f920a263628517fcbea42b7271d12743eb9f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ad7007a12cfe4ee2e9003e9660aad53a6b0d28f77136dccc9f702e5592096a5642fce3409ec7d126449dab3ba5c8847c3f594b477512b0cfbe5a6f1fd0f2b22b

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_2.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bd8d3e2ece2d873dc8f9f27377cfdb20

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2f93fb292a56b92a6f66257d1523aabec3b57c5e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0ec573288ae2237f7127b399ed33f920a263628517fcbea42b7271d12743eb9f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ad7007a12cfe4ee2e9003e9660aad53a6b0d28f77136dccc9f702e5592096a5642fce3409ec7d126449dab3ba5c8847c3f594b477512b0cfbe5a6f1fd0f2b22b

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_2.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bd8d3e2ece2d873dc8f9f27377cfdb20

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2f93fb292a56b92a6f66257d1523aabec3b57c5e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0ec573288ae2237f7127b399ed33f920a263628517fcbea42b7271d12743eb9f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ad7007a12cfe4ee2e9003e9660aad53a6b0d28f77136dccc9f702e5592096a5642fce3409ec7d126449dab3ba5c8847c3f594b477512b0cfbe5a6f1fd0f2b22b

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_2.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bd8d3e2ece2d873dc8f9f27377cfdb20

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2f93fb292a56b92a6f66257d1523aabec3b57c5e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0ec573288ae2237f7127b399ed33f920a263628517fcbea42b7271d12743eb9f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ad7007a12cfe4ee2e9003e9660aad53a6b0d28f77136dccc9f702e5592096a5642fce3409ec7d126449dab3ba5c8847c3f594b477512b0cfbe5a6f1fd0f2b22b

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_3.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            f7eb1781b32a1f71d74a475b1ff01d9e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2448b54e98df83975be1fad49236c51cd91b309f

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fcd7594fe4671bc043182bd4cf88c680daa568739eacc23f3aa24aeb942ac99c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e1f939862f36213fa3a7f03cdde9ad6be4690786eb0e474d6ae47a3f7faef46313f5931167d04ae8e0086a1b8a56f4a74b7ca2d59aa8857cce1c94eaa90ce518

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_3.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            f7eb1781b32a1f71d74a475b1ff01d9e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2448b54e98df83975be1fad49236c51cd91b309f

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fcd7594fe4671bc043182bd4cf88c680daa568739eacc23f3aa24aeb942ac99c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e1f939862f36213fa3a7f03cdde9ad6be4690786eb0e474d6ae47a3f7faef46313f5931167d04ae8e0086a1b8a56f4a74b7ca2d59aa8857cce1c94eaa90ce518

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_3.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            f7eb1781b32a1f71d74a475b1ff01d9e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2448b54e98df83975be1fad49236c51cd91b309f

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fcd7594fe4671bc043182bd4cf88c680daa568739eacc23f3aa24aeb942ac99c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e1f939862f36213fa3a7f03cdde9ad6be4690786eb0e474d6ae47a3f7faef46313f5931167d04ae8e0086a1b8a56f4a74b7ca2d59aa8857cce1c94eaa90ce518

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_3.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            f7eb1781b32a1f71d74a475b1ff01d9e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            2448b54e98df83975be1fad49236c51cd91b309f

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fcd7594fe4671bc043182bd4cf88c680daa568739eacc23f3aa24aeb942ac99c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e1f939862f36213fa3a7f03cdde9ad6be4690786eb0e474d6ae47a3f7faef46313f5931167d04ae8e0086a1b8a56f4a74b7ca2d59aa8857cce1c94eaa90ce518

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_4.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_4.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_4.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            5668cb771643274ba2c375ec6403c266

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_5.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            8d9c547b81d8879a650a50a5f24f7024

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            f98072723cca6f7c862b2bb056d9de844c2953aa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            38a18614d1a00a939be838c7ca0b343f1ed8b33d4317648750a1ac0d6a72a861

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            e2f2cb74d5911b19a82bf021772a71b94deb123b2095233d3a965f657d909d15b4bdc9706413ef49d59249e40232507d8ba33bc9e9d0f9544c08b50349610bad

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_6.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            3568d61a49b61ce18bd6093748ffd32a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            0f6c4618eb4fca4972869a56bf6d8b020e1440f8

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            af350212764e6304bf417e81cf0009b494119670e4bc1b187cd79cf4c487c7b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5c0129297fe07f919fe228633e193f56167e4f92815aa2cb1b9749ff14f377ec4d5c0414dffc733cbdc0b448e4552e06a527a481a144cd3af413c77fe2937cde

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_6.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            3568d61a49b61ce18bd6093748ffd32a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            0f6c4618eb4fca4972869a56bf6d8b020e1440f8

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            af350212764e6304bf417e81cf0009b494119670e4bc1b187cd79cf4c487c7b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5c0129297fe07f919fe228633e193f56167e4f92815aa2cb1b9749ff14f377ec4d5c0414dffc733cbdc0b448e4552e06a527a481a144cd3af413c77fe2937cde

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_6.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            3568d61a49b61ce18bd6093748ffd32a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            0f6c4618eb4fca4972869a56bf6d8b020e1440f8

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            af350212764e6304bf417e81cf0009b494119670e4bc1b187cd79cf4c487c7b6

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            5c0129297fe07f919fe228633e193f56167e4f92815aa2cb1b9749ff14f377ec4d5c0414dffc733cbdc0b448e4552e06a527a481a144cd3af413c77fe2937cde

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            a619719c691f7cf4f68f80045cef89db

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d4a643dc1954f3872f75f18e01be501a8142c0fa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d66a43c1f830997ba92149f8e93d040dbaa9a8df0637e07b9be7cfa85c884a25

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            76486b0f0102320c60478158170006ffc377c54eb0891ed1d3c7b48d2f1bdf09cbe51be0c03c9122c00015bb53e66e7a9320517f1610868cc45ef0eea319b23d

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            a619719c691f7cf4f68f80045cef89db

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d4a643dc1954f3872f75f18e01be501a8142c0fa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d66a43c1f830997ba92149f8e93d040dbaa9a8df0637e07b9be7cfa85c884a25

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            76486b0f0102320c60478158170006ffc377c54eb0891ed1d3c7b48d2f1bdf09cbe51be0c03c9122c00015bb53e66e7a9320517f1610868cc45ef0eea319b23d

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            a619719c691f7cf4f68f80045cef89db

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d4a643dc1954f3872f75f18e01be501a8142c0fa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d66a43c1f830997ba92149f8e93d040dbaa9a8df0637e07b9be7cfa85c884a25

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            76486b0f0102320c60478158170006ffc377c54eb0891ed1d3c7b48d2f1bdf09cbe51be0c03c9122c00015bb53e66e7a9320517f1610868cc45ef0eea319b23d

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\7zSCC71E956\sonia_7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            a619719c691f7cf4f68f80045cef89db

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d4a643dc1954f3872f75f18e01be501a8142c0fa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d66a43c1f830997ba92149f8e93d040dbaa9a8df0637e07b9be7cfa85c884a25

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            76486b0f0102320c60478158170006ffc377c54eb0891ed1d3c7b48d2f1bdf09cbe51be0c03c9122c00015bb53e66e7a9320517f1610868cc45ef0eea319b23d

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                          • memory/112-156-0x0000000002070000-0x00000000020CD000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            372KB

                                                                                                                                                                                          • memory/112-154-0x0000000002130000-0x0000000002231000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.0MB

                                                                                                                                                                                          • memory/528-152-0x00000000000F0000-0x000000000013C000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            304KB

                                                                                                                                                                                          • memory/1516-275-0x000007FEF4FD0000-0x000007FEF59BC000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            9.9MB

                                                                                                                                                                                          • memory/1516-184-0x0000000000350000-0x0000000000356000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            24KB

                                                                                                                                                                                          • memory/1516-193-0x0000000000360000-0x0000000000384000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            144KB

                                                                                                                                                                                          • memory/1516-206-0x0000000000390000-0x0000000000396000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            24KB

                                                                                                                                                                                          • memory/1516-142-0x0000000000A20000-0x0000000000A4E000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            184KB

                                                                                                                                                                                          • memory/1576-177-0x0000000002300000-0x0000000002320000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            128KB

                                                                                                                                                                                          • memory/1576-183-0x00000000025B0000-0x00000000025CE000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            120KB

                                                                                                                                                                                          • memory/1576-143-0x0000000000320000-0x0000000000341000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            132KB

                                                                                                                                                                                          • memory/1640-84-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/1640-87-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/1640-74-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            572KB

                                                                                                                                                                                          • memory/1640-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.5MB

                                                                                                                                                                                          • memory/1640-76-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            572KB

                                                                                                                                                                                          • memory/1640-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.5MB

                                                                                                                                                                                          • memory/1640-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.5MB

                                                                                                                                                                                          • memory/1640-83-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/1640-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.5MB

                                                                                                                                                                                          • memory/1640-81-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            152KB

                                                                                                                                                                                          • memory/1640-82-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/1640-75-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            572KB

                                                                                                                                                                                          • memory/1640-86-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/1640-85-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/1708-157-0x00000000002E0000-0x0000000000344000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            400KB

                                                                                                                                                                                          • memory/1816-267-0x0000000000A70000-0x0000000000A7E000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            56KB

                                                                                                                                                                                          • memory/1816-271-0x0000000000400000-0x00000000008F6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            5.0MB

                                                                                                                                                                                          • memory/1816-269-0x0000000000240000-0x0000000000249000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            36KB

                                                                                                                                                                                          • memory/1816-153-0x0000000000A70000-0x0000000000A7E000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            56KB

                                                                                                                                                                                          • memory/1996-54-0x0000000074C61000-0x0000000074C63000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8KB

                                                                                                                                                                                          • memory/1996-479-0x0000000002870000-0x000000000298D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB