Analysis
-
max time kernel
4294191s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
15-03-2022 14:12
Static task
static1
Behavioral task
behavioral1
Sample
f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe
Resource
win10v2004-en-20220113
General
-
Target
f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe
-
Size
3.6MB
-
MD5
ec9a8d1ba08d8b5b8c3ec2d27bbe081a
-
SHA1
bfe1795805701810346382706106899a2da4b995
-
SHA256
f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5
-
SHA512
724ae398f062a54ba17a2ce418d40b9063698775d3ae5ae3d42555c4f502e12b3c5e54a23da052151ffca075b9b3a3f7a82882013dfb081fa04e723d3feb5a88
Malware Config
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Extracted
redline
Cana
176.111.174.254:56328
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
vidar
50.9
937
https://ieji.de/@sam7al
https://busshi.moe/@sam0al
-
profile_id
937
Extracted
vidar
50.9
1177
https://ieji.de/@sam7al
https://busshi.moe/@sam0al
-
profile_id
1177
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1364-190-0x00000000024F0000-0x0000000002510000-memory.dmp family_redline behavioral1/memory/1364-203-0x0000000002540000-0x000000000255E000-memory.dmp family_redline behavioral1/memory/1808-214-0x0000000000FD0000-0x0000000001155000-memory.dmp family_redline behavioral1/memory/1808-216-0x0000000000FD0000-0x0000000001155000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
OnlyLogger Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1620-245-0x0000000000820000-0x0000000000864000-memory.dmp family_onlylogger behavioral1/memory/1620-247-0x0000000000400000-0x000000000048C000-memory.dmp family_onlylogger -
Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2004-204-0x0000000000950000-0x00000000009ED000-memory.dmp family_vidar behavioral1/memory/2004-221-0x0000000000400000-0x000000000094C000-memory.dmp family_vidar behavioral1/memory/544-243-0x0000000000400000-0x00000000004D1000-memory.dmp family_vidar behavioral1/memory/544-242-0x0000000001E70000-0x0000000001F1C000-memory.dmp family_vidar behavioral1/memory/2132-260-0x00000000000D0000-0x000000000045C000-memory.dmp family_vidar -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 34 IoCs
Processes:
setup_install.exesotema_2.exesotema_4.exesotema_7.exesotema_8.exesotema_6.exesotema_5.exesotema_3.exesotema_8.tmpjfiag3g_gg.exerVyrj6tlkfrVd1_cRPthYMfm.exeugeCB7sDMfsPTeK9QbOBdsfm.exeg2F2D7aDXSVTDaRIJlKtxfFY.exeVx60WlFFqKsSCDE5hTS7SMdH.exeiyyPVNlwuFmF1V_KxX4BZsOz.exeI0yfnE9q9lUZiHQWqDlrcoa8.exe7yshpmvftFmD_WqtJKamUHnn.exeqII2C0R7vjw9_BjnYQXCDvEF.exeB_uGld0GgaNybjdbhpVwMJ8a.exe0t1mz0U0MnniC0YDsxLbBwzD.exeIaCA22TnG2k5zUDCypMHRC14.exeUJpLQDAncm3__rxg0m_dA5il.exeprQMybu73riIeSFS1yAPysNE.exeTHZgUjetsvQ6J9iNJKSuebA6.exeiPUKmMugz7cCUC9f9MV3wghs.exeFt6KIhlrmStn4lD4QMLp75B3.exevtNRzPWFAU_idEwrRqgY6NEE.exedSQ6xexj_RR585ekp1hNn73M.exesotema_7.exe1gQkThLhBCxUeik2K4S5srk4.exejfiag3g_gg.exe994e908d-cbe9-4782-8bcb-a2720dfe83e8.exeSta.exe.pifgitcitcpid process 1980 setup_install.exe 1092 sotema_2.exe 1172 sotema_4.exe 284 sotema_7.exe 1192 sotema_8.exe 1364 sotema_6.exe 1632 sotema_5.exe 2004 sotema_3.exe 1596 sotema_8.tmp 1636 jfiag3g_gg.exe 1956 rVyrj6tlkfrVd1_cRPthYMfm.exe 2024 ugeCB7sDMfsPTeK9QbOBdsfm.exe 1660 g2F2D7aDXSVTDaRIJlKtxfFY.exe 556 Vx60WlFFqKsSCDE5hTS7SMdH.exe 1488 iyyPVNlwuFmF1V_KxX4BZsOz.exe 544 I0yfnE9q9lUZiHQWqDlrcoa8.exe 1960 7yshpmvftFmD_WqtJKamUHnn.exe 1620 qII2C0R7vjw9_BjnYQXCDvEF.exe 1908 B_uGld0GgaNybjdbhpVwMJ8a.exe 1560 0t1mz0U0MnniC0YDsxLbBwzD.exe 1808 IaCA22TnG2k5zUDCypMHRC14.exe 1604 UJpLQDAncm3__rxg0m_dA5il.exe 1812 prQMybu73riIeSFS1yAPysNE.exe 2064 THZgUjetsvQ6J9iNJKSuebA6.exe 1832 iPUKmMugz7cCUC9f9MV3wghs.exe 2124 Ft6KIhlrmStn4lD4QMLp75B3.exe 2116 vtNRzPWFAU_idEwrRqgY6NEE.exe 2132 dSQ6xexj_RR585ekp1hNn73M.exe 2328 sotema_7.exe 2656 1gQkThLhBCxUeik2K4S5srk4.exe 2956 jfiag3g_gg.exe 2856 994e908d-cbe9-4782-8bcb-a2720dfe83e8.exe 1472 Sta.exe.pif 2836 gitcitc -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Ft6KIhlrmStn4lD4QMLp75B3.exe7yshpmvftFmD_WqtJKamUHnn.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Ft6KIhlrmStn4lD4QMLp75B3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Ft6KIhlrmStn4lD4QMLp75B3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7yshpmvftFmD_WqtJKamUHnn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7yshpmvftFmD_WqtJKamUHnn.exe -
Loads dropped DLL 64 IoCs
Processes:
f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exesetup_install.execmd.exesotema_2.execmd.execmd.execmd.execmd.execmd.exesotema_4.execmd.exesotema_8.exesotema_5.exesotema_7.exesotema_6.exesotema_3.exesotema_8.tmpjfiag3g_gg.exeugeCB7sDMfsPTeK9QbOBdsfm.exerVyrj6tlkfrVd1_cRPthYMfm.exepid process 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe 1980 setup_install.exe 1980 setup_install.exe 1980 setup_install.exe 1980 setup_install.exe 1980 setup_install.exe 1980 setup_install.exe 1980 setup_install.exe 1980 setup_install.exe 1132 cmd.exe 1132 cmd.exe 1092 sotema_2.exe 1092 sotema_2.exe 856 cmd.exe 992 cmd.exe 992 cmd.exe 1320 cmd.exe 1780 cmd.exe 1780 cmd.exe 1420 cmd.exe 1172 sotema_4.exe 1172 sotema_4.exe 1544 cmd.exe 1544 cmd.exe 1192 sotema_8.exe 1192 sotema_8.exe 1632 sotema_5.exe 1632 sotema_5.exe 284 sotema_7.exe 284 sotema_7.exe 1364 sotema_6.exe 1364 sotema_6.exe 1192 sotema_8.exe 2004 sotema_3.exe 2004 sotema_3.exe 1596 sotema_8.tmp 1596 sotema_8.tmp 1596 sotema_8.tmp 1172 sotema_4.exe 1172 sotema_4.exe 1636 jfiag3g_gg.exe 1636 jfiag3g_gg.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 2024 ugeCB7sDMfsPTeK9QbOBdsfm.exe 2024 ugeCB7sDMfsPTeK9QbOBdsfm.exe 1956 rVyrj6tlkfrVd1_cRPthYMfm.exe 1956 rVyrj6tlkfrVd1_cRPthYMfm.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe 1632 sotema_5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Ft6KIhlrmStn4lD4QMLp75B3.exe7yshpmvftFmD_WqtJKamUHnn.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Ft6KIhlrmStn4lD4QMLp75B3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7yshpmvftFmD_WqtJKamUHnn.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ipinfo.io 13 ipinfo.io 15 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
dSQ6xexj_RR585ekp1hNn73M.exeIaCA22TnG2k5zUDCypMHRC14.exepid process 2132 dSQ6xexj_RR585ekp1hNn73M.exe 1808 IaCA22TnG2k5zUDCypMHRC14.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
sotema_7.exe7yshpmvftFmD_WqtJKamUHnn.exeFt6KIhlrmStn4lD4QMLp75B3.exedescription pid process target process PID 284 set thread context of 2328 284 sotema_7.exe sotema_7.exe PID 1960 set thread context of 2416 1960 7yshpmvftFmD_WqtJKamUHnn.exe AppLaunch.exe PID 2124 set thread context of 2320 2124 Ft6KIhlrmStn4lD4QMLp75B3.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1868 2004 WerFault.exe sotema_3.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sotema_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sotema_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sotema_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sotema_2.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
I0yfnE9q9lUZiHQWqDlrcoa8.exedSQ6xexj_RR585ekp1hNn73M.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 I0yfnE9q9lUZiHQWqDlrcoa8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString I0yfnE9q9lUZiHQWqDlrcoa8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dSQ6xexj_RR585ekp1hNn73M.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dSQ6xexj_RR585ekp1hNn73M.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1512 timeout.exe 1028 timeout.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2544 tasklist.exe 2896 tasklist.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 2216 taskkill.exe 2768 taskkill.exe 2352 taskkill.exe -
Processes:
sotema_3.exeI0yfnE9q9lUZiHQWqDlrcoa8.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a sotema_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a sotema_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 I0yfnE9q9lUZiHQWqDlrcoa8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e I0yfnE9q9lUZiHQWqDlrcoa8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e I0yfnE9q9lUZiHQWqDlrcoa8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 sotema_3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sotema_2.exedSQ6xexj_RR585ekp1hNn73M.exeIaCA22TnG2k5zUDCypMHRC14.exepid process 1092 sotema_2.exe 1092 sotema_2.exe 2132 dSQ6xexj_RR585ekp1hNn73M.exe 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1808 IaCA22TnG2k5zUDCypMHRC14.exe 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1260 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sotema_2.exepid process 1092 sotema_2.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
sotema_7.exe1gQkThLhBCxUeik2K4S5srk4.exesotema_6.exetasklist.exetaskkill.exetasklist.exedescription pid process Token: SeDebugPrivilege 284 sotema_7.exe Token: SeDebugPrivilege 2656 1gQkThLhBCxUeik2K4S5srk4.exe Token: SeDebugPrivilege 1364 sotema_6.exe Token: SeDebugPrivilege 2544 tasklist.exe Token: SeDebugPrivilege 2216 taskkill.exe Token: SeDebugPrivilege 2896 tasklist.exe Token: SeShutdownPrivilege 1260 Token: SeShutdownPrivilege 1260 Token: SeShutdownPrivilege 1260 Token: SeShutdownPrivilege 1260 -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
Sta.exe.pifpid process 1472 Sta.exe.pif 1260 1260 1260 1260 1472 Sta.exe.pif 1472 Sta.exe.pif 1260 1260 -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Sta.exe.pifpid process 1472 Sta.exe.pif 1472 Sta.exe.pif 1472 Sta.exe.pif -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exesetup_install.execmd.exedescription pid process target process PID 1888 wrote to memory of 1980 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe setup_install.exe PID 1888 wrote to memory of 1980 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe setup_install.exe PID 1888 wrote to memory of 1980 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe setup_install.exe PID 1888 wrote to memory of 1980 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe setup_install.exe PID 1888 wrote to memory of 1980 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe setup_install.exe PID 1888 wrote to memory of 1980 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe setup_install.exe PID 1888 wrote to memory of 1980 1888 f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe setup_install.exe PID 1980 wrote to memory of 1152 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1152 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1152 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1152 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1152 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1152 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1152 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1132 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1132 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1132 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1132 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1132 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1132 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1132 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1544 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1544 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1544 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1544 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1544 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1544 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1544 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 856 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 856 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 856 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 856 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 856 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 856 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 856 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1420 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1420 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1420 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1420 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1420 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1420 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1420 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1780 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1780 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1780 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1780 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1780 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1780 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1780 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 992 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 992 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 992 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 992 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 992 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 992 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 992 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1320 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1320 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1320 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1320 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1320 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1320 1980 setup_install.exe cmd.exe PID 1980 wrote to memory of 1320 1980 setup_install.exe cmd.exe PID 1132 wrote to memory of 1092 1132 cmd.exe sotema_2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe"C:\Users\Admin\AppData\Local\Temp\f9e39563cee4f95eec4062daf6578d28f042bc7d9c59a0180c40865d48dc1bc5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_1.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_2.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_2.exesotema_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_3.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_3.exesotema_3.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 9565⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_5.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_5.exesotema_5.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Documents\rVyrj6tlkfrVd1_cRPthYMfm.exe"C:\Users\Admin\Documents\rVyrj6tlkfrVd1_cRPthYMfm.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Documents\ugeCB7sDMfsPTeK9QbOBdsfm.exe"C:\Users\Admin\Documents\ugeCB7sDMfsPTeK9QbOBdsfm.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Documents\qII2C0R7vjw9_BjnYQXCDvEF.exe"C:\Users\Admin\Documents\qII2C0R7vjw9_BjnYQXCDvEF.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "qII2C0R7vjw9_BjnYQXCDvEF.exe" /f & erase "C:\Users\Admin\Documents\qII2C0R7vjw9_BjnYQXCDvEF.exe" & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "qII2C0R7vjw9_BjnYQXCDvEF.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\I0yfnE9q9lUZiHQWqDlrcoa8.exe"C:\Users\Admin\Documents\I0yfnE9q9lUZiHQWqDlrcoa8.exe"5⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im I0yfnE9q9lUZiHQWqDlrcoa8.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\I0yfnE9q9lUZiHQWqDlrcoa8.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im I0yfnE9q9lUZiHQWqDlrcoa8.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\7yshpmvftFmD_WqtJKamUHnn.exe"C:\Users\Admin\Documents\7yshpmvftFmD_WqtJKamUHnn.exe"5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Users\Admin\Documents\iyyPVNlwuFmF1V_KxX4BZsOz.exe"C:\Users\Admin\Documents\iyyPVNlwuFmF1V_KxX4BZsOz.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\prQMybu73riIeSFS1yAPysNE.exe"C:\Users\Admin\Documents\prQMybu73riIeSFS1yAPysNE.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\0t1mz0U0MnniC0YDsxLbBwzD.exe"C:\Users\Admin\Documents\0t1mz0U0MnniC0YDsxLbBwzD.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\UJpLQDAncm3__rxg0m_dA5il.exe"C:\Users\Admin\Documents\UJpLQDAncm3__rxg0m_dA5il.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\B_uGld0GgaNybjdbhpVwMJ8a.exe"C:\Users\Admin\Documents\B_uGld0GgaNybjdbhpVwMJ8a.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla6⤵
-
C:\Windows\SysWOW64\cmd.execmd7⤵
-
C:\Windows\SysWOW64\find.exefind /I /N "bullguardcore.exe"8⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq BullGuardCore.exe"8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /I /N "psuaservice.exe"8⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq PSUAService.exe"8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^wtwRMqjYMlcblhfrOaJNpOohYASICCRoGRaYHSofIqwzkvtDhVASceYjWNSjoDvlzhRaVdvWpzypNPwCvgcGwZMDTye$" Hai.xla8⤵
-
C:\Windows\SysWOW64\waitfor.exewaitfor /t 5 MsGxuGavEVaQbserVWhrA8⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sta.exe.pifSta.exe.pif V8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Documents\IaCA22TnG2k5zUDCypMHRC14.exe"C:\Users\Admin\Documents\IaCA22TnG2k5zUDCypMHRC14.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\iPUKmMugz7cCUC9f9MV3wghs.exe"C:\Users\Admin\Documents\iPUKmMugz7cCUC9f9MV3wghs.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\THZgUjetsvQ6J9iNJKSuebA6.exe"C:\Users\Admin\Documents\THZgUjetsvQ6J9iNJKSuebA6.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Vx60WlFFqKsSCDE5hTS7SMdH.exe"C:\Users\Admin\Documents\Vx60WlFFqKsSCDE5hTS7SMdH.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\g2F2D7aDXSVTDaRIJlKtxfFY.exe"C:\Users\Admin\Documents\g2F2D7aDXSVTDaRIJlKtxfFY.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\dSQ6xexj_RR585ekp1hNn73M.exe"C:\Users\Admin\Documents\dSQ6xexj_RR585ekp1hNn73M.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im dSQ6xexj_RR585ekp1hNn73M.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\dSQ6xexj_RR585ekp1hNn73M.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im dSQ6xexj_RR585ekp1hNn73M.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\Ft6KIhlrmStn4lD4QMLp75B3.exe"C:\Users\Admin\Documents\Ft6KIhlrmStn4lD4QMLp75B3.exe"5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Users\Admin\Documents\vtNRzPWFAU_idEwrRqgY6NEE.exe"C:\Users\Admin\Documents\vtNRzPWFAU_idEwrRqgY6NEE.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\1gQkThLhBCxUeik2K4S5srk4.exe"C:\Users\Admin\Documents\1gQkThLhBCxUeik2K4S5srk4.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\994e908d-cbe9-4782-8bcb-a2720dfe83e8.exe"C:\Users\Admin\AppData\Local\Temp\994e908d-cbe9-4782-8bcb-a2720dfe83e8.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_7.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exesotema_7.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exeC:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_8.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_8.exesotema_8.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-BNT5G.tmp\sotema_8.tmp"C:\Users\Admin\AppData\Local\Temp\is-BNT5G.tmp\sotema_8.tmp" /SL5="$50120,161510,77824,C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_8.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_6.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_6.exesotema_6.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_4.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_4.exesotema_4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {12F58752-AA73-40D2-8CAD-210870FFBBDB} S-1-5-21-2199625441-3471261906-229485034-1000:DRLQIXCW\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\gitcitcC:\Users\Admin\AppData\Roaming\gitcitc2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
2Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_1.txtMD5
7837314688b7989de1e8d94f598eb2dd
SHA1889ae8ce433d5357f8ea2aff64daaba563dc94e3
SHA256d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247
SHA5123df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_2.exeMD5
ce748a3cc2d227035478c7bfbbce6d1c
SHA11439aea074e496e3be89d1182c98802b4cd6d5db
SHA256fc89e01cff6cbe417bbfdf12984a25b14c317090471bf89a4f47eec1f82fe630
SHA512e31aa4b43e38c3f2c36b2041dc784adaf0ab2620699ef0d855132a8dcb577c8090af10b467283f0204b41fd93c6ae0397a67d1bc9e2ad6fa7d90c5d75aacc5a8
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_2.txtMD5
ce748a3cc2d227035478c7bfbbce6d1c
SHA11439aea074e496e3be89d1182c98802b4cd6d5db
SHA256fc89e01cff6cbe417bbfdf12984a25b14c317090471bf89a4f47eec1f82fe630
SHA512e31aa4b43e38c3f2c36b2041dc784adaf0ab2620699ef0d855132a8dcb577c8090af10b467283f0204b41fd93c6ae0397a67d1bc9e2ad6fa7d90c5d75aacc5a8
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_3.exeMD5
18fd29a7113a43375058a2788177b0ee
SHA186d2df734704de865027f6cbfbc8e5a329990fb5
SHA256088df39953be8f10f9f92ecc00b2ecb3f21bf987ddbab78b684b7760ac1b9559
SHA512c6d376890e79040b47b86b673b970cbc9606d6f5f8a11fb2ec2e3d370d44ec8d9347852d6273fa051c0f26d73cadc9312818a23a9c998cc5aa3b98dd01877688
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_3.txtMD5
18fd29a7113a43375058a2788177b0ee
SHA186d2df734704de865027f6cbfbc8e5a329990fb5
SHA256088df39953be8f10f9f92ecc00b2ecb3f21bf987ddbab78b684b7760ac1b9559
SHA512c6d376890e79040b47b86b673b970cbc9606d6f5f8a11fb2ec2e3d370d44ec8d9347852d6273fa051c0f26d73cadc9312818a23a9c998cc5aa3b98dd01877688
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_4.txtMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_5.exeMD5
bcb71fb45d694263db5beb8187869059
SHA1582eda9bb90f9a64a41704b80f5ef2aded5142a3
SHA2560bcf14216198351151d34d3e6ea6c05bf06c62eee05e15804ba132ea455b3710
SHA512c3830dadd928a5986002c9c7d495915a1756700609676c9a11fc364ad08e06ce6ac93f3116b8e8a7cd9327d875d21e1f4d78446e2e85030f76aad7f21c494676
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_5.txtMD5
bcb71fb45d694263db5beb8187869059
SHA1582eda9bb90f9a64a41704b80f5ef2aded5142a3
SHA2560bcf14216198351151d34d3e6ea6c05bf06c62eee05e15804ba132ea455b3710
SHA512c3830dadd928a5986002c9c7d495915a1756700609676c9a11fc364ad08e06ce6ac93f3116b8e8a7cd9327d875d21e1f4d78446e2e85030f76aad7f21c494676
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_6.exeMD5
8c2f0a89bd8bfb029cf02e853ea30d82
SHA1d5d75a26a70a769d04ce977fe8bc774efa9de3be
SHA2566cb493755e621fed7e262241c1dc4a7baf77c08dc5eb18cae912eec57958eb47
SHA51210e2b0cb031119badf8bb1844a64e70e6cfd2034a7887d71a82df045818e41abc45f50c5733fcea0a53bbedd63d0113f4fad95c36f61c43ea71350fc04159623
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_6.txtMD5
8c2f0a89bd8bfb029cf02e853ea30d82
SHA1d5d75a26a70a769d04ce977fe8bc774efa9de3be
SHA2566cb493755e621fed7e262241c1dc4a7baf77c08dc5eb18cae912eec57958eb47
SHA51210e2b0cb031119badf8bb1844a64e70e6cfd2034a7887d71a82df045818e41abc45f50c5733fcea0a53bbedd63d0113f4fad95c36f61c43ea71350fc04159623
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exeMD5
cfb846afa58b9a2fb8018e55ef841f90
SHA18a6bfe762bf3093b1fff0211752a34dc5ee57319
SHA25692f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6
SHA51273344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.txtMD5
cfb846afa58b9a2fb8018e55ef841f90
SHA18a6bfe762bf3093b1fff0211752a34dc5ee57319
SHA25692f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6
SHA51273344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_8.exeMD5
1299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
C:\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_8.txtMD5
1299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
C:\Users\Admin\AppData\Local\Temp\is-BNT5G.tmp\sotema_8.tmpMD5
fe3859b471b9dc985043bc8387e0c36f
SHA102084ecb89ccb2f102442d8d7de18cbe0ff88972
SHA256da844b9d344aadd4b2129fa650d3ba01b18f7391a9b7d4678f9ef771c6d6017c
SHA5126429d3856ce5476d95852cd4f47f69dfbe512c815b9c49a1db29a0f0b2677b2f3821d354496ca6e9d000a478ad35222f67d65584e6d22b77acf9e81b055cca09
-
C:\Users\Admin\AppData\Local\Temp\is-BNT5G.tmp\sotema_8.tmpMD5
fe3859b471b9dc985043bc8387e0c36f
SHA102084ecb89ccb2f102442d8d7de18cbe0ff88972
SHA256da844b9d344aadd4b2129fa650d3ba01b18f7391a9b7d4678f9ef771c6d6017c
SHA5126429d3856ce5476d95852cd4f47f69dfbe512c815b9c49a1db29a0f0b2677b2f3821d354496ca6e9d000a478ad35222f67d65584e6d22b77acf9e81b055cca09
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\setup_install.exeMD5
010ed9e894981129d928561d36b2f65f
SHA1f5548e59941bce5ce2b8b86067fb0fe27f826570
SHA256195325feef9e246a50ac98c54205b460b0323a1934bf047dc994e0976e46bc9f
SHA5125710b1287efa9f6e544fb1dfc519fcf101379b73880b5b10784853633e8c0a7707b4cb2ce904369d90fc77e565cc63d21c2fe31860a8257f6bc874271967a2c9
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_2.exeMD5
ce748a3cc2d227035478c7bfbbce6d1c
SHA11439aea074e496e3be89d1182c98802b4cd6d5db
SHA256fc89e01cff6cbe417bbfdf12984a25b14c317090471bf89a4f47eec1f82fe630
SHA512e31aa4b43e38c3f2c36b2041dc784adaf0ab2620699ef0d855132a8dcb577c8090af10b467283f0204b41fd93c6ae0397a67d1bc9e2ad6fa7d90c5d75aacc5a8
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_2.exeMD5
ce748a3cc2d227035478c7bfbbce6d1c
SHA11439aea074e496e3be89d1182c98802b4cd6d5db
SHA256fc89e01cff6cbe417bbfdf12984a25b14c317090471bf89a4f47eec1f82fe630
SHA512e31aa4b43e38c3f2c36b2041dc784adaf0ab2620699ef0d855132a8dcb577c8090af10b467283f0204b41fd93c6ae0397a67d1bc9e2ad6fa7d90c5d75aacc5a8
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_2.exeMD5
ce748a3cc2d227035478c7bfbbce6d1c
SHA11439aea074e496e3be89d1182c98802b4cd6d5db
SHA256fc89e01cff6cbe417bbfdf12984a25b14c317090471bf89a4f47eec1f82fe630
SHA512e31aa4b43e38c3f2c36b2041dc784adaf0ab2620699ef0d855132a8dcb577c8090af10b467283f0204b41fd93c6ae0397a67d1bc9e2ad6fa7d90c5d75aacc5a8
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_2.exeMD5
ce748a3cc2d227035478c7bfbbce6d1c
SHA11439aea074e496e3be89d1182c98802b4cd6d5db
SHA256fc89e01cff6cbe417bbfdf12984a25b14c317090471bf89a4f47eec1f82fe630
SHA512e31aa4b43e38c3f2c36b2041dc784adaf0ab2620699ef0d855132a8dcb577c8090af10b467283f0204b41fd93c6ae0397a67d1bc9e2ad6fa7d90c5d75aacc5a8
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_3.exeMD5
18fd29a7113a43375058a2788177b0ee
SHA186d2df734704de865027f6cbfbc8e5a329990fb5
SHA256088df39953be8f10f9f92ecc00b2ecb3f21bf987ddbab78b684b7760ac1b9559
SHA512c6d376890e79040b47b86b673b970cbc9606d6f5f8a11fb2ec2e3d370d44ec8d9347852d6273fa051c0f26d73cadc9312818a23a9c998cc5aa3b98dd01877688
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_3.exeMD5
18fd29a7113a43375058a2788177b0ee
SHA186d2df734704de865027f6cbfbc8e5a329990fb5
SHA256088df39953be8f10f9f92ecc00b2ecb3f21bf987ddbab78b684b7760ac1b9559
SHA512c6d376890e79040b47b86b673b970cbc9606d6f5f8a11fb2ec2e3d370d44ec8d9347852d6273fa051c0f26d73cadc9312818a23a9c998cc5aa3b98dd01877688
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_3.exeMD5
18fd29a7113a43375058a2788177b0ee
SHA186d2df734704de865027f6cbfbc8e5a329990fb5
SHA256088df39953be8f10f9f92ecc00b2ecb3f21bf987ddbab78b684b7760ac1b9559
SHA512c6d376890e79040b47b86b673b970cbc9606d6f5f8a11fb2ec2e3d370d44ec8d9347852d6273fa051c0f26d73cadc9312818a23a9c998cc5aa3b98dd01877688
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_3.exeMD5
18fd29a7113a43375058a2788177b0ee
SHA186d2df734704de865027f6cbfbc8e5a329990fb5
SHA256088df39953be8f10f9f92ecc00b2ecb3f21bf987ddbab78b684b7760ac1b9559
SHA512c6d376890e79040b47b86b673b970cbc9606d6f5f8a11fb2ec2e3d370d44ec8d9347852d6273fa051c0f26d73cadc9312818a23a9c998cc5aa3b98dd01877688
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_5.exeMD5
bcb71fb45d694263db5beb8187869059
SHA1582eda9bb90f9a64a41704b80f5ef2aded5142a3
SHA2560bcf14216198351151d34d3e6ea6c05bf06c62eee05e15804ba132ea455b3710
SHA512c3830dadd928a5986002c9c7d495915a1756700609676c9a11fc364ad08e06ce6ac93f3116b8e8a7cd9327d875d21e1f4d78446e2e85030f76aad7f21c494676
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_5.exeMD5
bcb71fb45d694263db5beb8187869059
SHA1582eda9bb90f9a64a41704b80f5ef2aded5142a3
SHA2560bcf14216198351151d34d3e6ea6c05bf06c62eee05e15804ba132ea455b3710
SHA512c3830dadd928a5986002c9c7d495915a1756700609676c9a11fc364ad08e06ce6ac93f3116b8e8a7cd9327d875d21e1f4d78446e2e85030f76aad7f21c494676
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_5.exeMD5
bcb71fb45d694263db5beb8187869059
SHA1582eda9bb90f9a64a41704b80f5ef2aded5142a3
SHA2560bcf14216198351151d34d3e6ea6c05bf06c62eee05e15804ba132ea455b3710
SHA512c3830dadd928a5986002c9c7d495915a1756700609676c9a11fc364ad08e06ce6ac93f3116b8e8a7cd9327d875d21e1f4d78446e2e85030f76aad7f21c494676
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_6.exeMD5
8c2f0a89bd8bfb029cf02e853ea30d82
SHA1d5d75a26a70a769d04ce977fe8bc774efa9de3be
SHA2566cb493755e621fed7e262241c1dc4a7baf77c08dc5eb18cae912eec57958eb47
SHA51210e2b0cb031119badf8bb1844a64e70e6cfd2034a7887d71a82df045818e41abc45f50c5733fcea0a53bbedd63d0113f4fad95c36f61c43ea71350fc04159623
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_6.exeMD5
8c2f0a89bd8bfb029cf02e853ea30d82
SHA1d5d75a26a70a769d04ce977fe8bc774efa9de3be
SHA2566cb493755e621fed7e262241c1dc4a7baf77c08dc5eb18cae912eec57958eb47
SHA51210e2b0cb031119badf8bb1844a64e70e6cfd2034a7887d71a82df045818e41abc45f50c5733fcea0a53bbedd63d0113f4fad95c36f61c43ea71350fc04159623
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_6.exeMD5
8c2f0a89bd8bfb029cf02e853ea30d82
SHA1d5d75a26a70a769d04ce977fe8bc774efa9de3be
SHA2566cb493755e621fed7e262241c1dc4a7baf77c08dc5eb18cae912eec57958eb47
SHA51210e2b0cb031119badf8bb1844a64e70e6cfd2034a7887d71a82df045818e41abc45f50c5733fcea0a53bbedd63d0113f4fad95c36f61c43ea71350fc04159623
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_6.exeMD5
8c2f0a89bd8bfb029cf02e853ea30d82
SHA1d5d75a26a70a769d04ce977fe8bc774efa9de3be
SHA2566cb493755e621fed7e262241c1dc4a7baf77c08dc5eb18cae912eec57958eb47
SHA51210e2b0cb031119badf8bb1844a64e70e6cfd2034a7887d71a82df045818e41abc45f50c5733fcea0a53bbedd63d0113f4fad95c36f61c43ea71350fc04159623
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exeMD5
cfb846afa58b9a2fb8018e55ef841f90
SHA18a6bfe762bf3093b1fff0211752a34dc5ee57319
SHA25692f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6
SHA51273344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exeMD5
cfb846afa58b9a2fb8018e55ef841f90
SHA18a6bfe762bf3093b1fff0211752a34dc5ee57319
SHA25692f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6
SHA51273344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exeMD5
cfb846afa58b9a2fb8018e55ef841f90
SHA18a6bfe762bf3093b1fff0211752a34dc5ee57319
SHA25692f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6
SHA51273344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_7.exeMD5
cfb846afa58b9a2fb8018e55ef841f90
SHA18a6bfe762bf3093b1fff0211752a34dc5ee57319
SHA25692f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6
SHA51273344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_8.exeMD5
1299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_8.exeMD5
1299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
\Users\Admin\AppData\Local\Temp\7zS06721E66\sotema_8.exeMD5
1299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
\Users\Admin\AppData\Local\Temp\is-58NS7.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-58NS7.tmp\_isetup\_shfoldr.dllMD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-58NS7.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
\Users\Admin\AppData\Local\Temp\is-BNT5G.tmp\sotema_8.tmpMD5
fe3859b471b9dc985043bc8387e0c36f
SHA102084ecb89ccb2f102442d8d7de18cbe0ff88972
SHA256da844b9d344aadd4b2129fa650d3ba01b18f7391a9b7d4678f9ef771c6d6017c
SHA5126429d3856ce5476d95852cd4f47f69dfbe512c815b9c49a1db29a0f0b2677b2f3821d354496ca6e9d000a478ad35222f67d65584e6d22b77acf9e81b055cca09
-
memory/284-194-0x0000000073EC0000-0x00000000745AE000-memory.dmpFilesize
6.9MB
-
memory/284-159-0x0000000000170000-0x00000000001D8000-memory.dmpFilesize
416KB
-
memory/284-196-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/544-241-0x0000000000690000-0x00000000006FB000-memory.dmpFilesize
428KB
-
memory/544-242-0x0000000001E70000-0x0000000001F1C000-memory.dmpFilesize
688KB
-
memory/544-243-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/1092-195-0x00000000009D0000-0x00000000009DF000-memory.dmpFilesize
60KB
-
memory/1092-197-0x00000000003D0000-0x00000000003D9000-memory.dmpFilesize
36KB
-
memory/1092-199-0x0000000000400000-0x00000000008F7000-memory.dmpFilesize
5.0MB
-
memory/1092-160-0x00000000009D0000-0x00000000009DF000-memory.dmpFilesize
60KB
-
memory/1192-133-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1192-154-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1260-201-0x0000000002980000-0x0000000002996000-memory.dmpFilesize
88KB
-
memory/1364-200-0x0000000000250000-0x000000000027F000-memory.dmpFilesize
188KB
-
memory/1364-205-0x0000000000400000-0x0000000000909000-memory.dmpFilesize
5.0MB
-
memory/1364-203-0x0000000002540000-0x000000000255E000-memory.dmpFilesize
120KB
-
memory/1364-161-0x0000000000AB0000-0x0000000000AD1000-memory.dmpFilesize
132KB
-
memory/1364-211-0x0000000073EC0000-0x00000000745AE000-memory.dmpFilesize
6.9MB
-
memory/1364-198-0x0000000000AB0000-0x0000000000AD1000-memory.dmpFilesize
132KB
-
memory/1364-190-0x00000000024F0000-0x0000000002510000-memory.dmpFilesize
128KB
-
memory/1364-254-0x0000000004E01000-0x0000000004E02000-memory.dmpFilesize
4KB
-
memory/1364-263-0x0000000004E04000-0x0000000004E06000-memory.dmpFilesize
8KB
-
memory/1620-244-0x00000000002E0000-0x0000000000307000-memory.dmpFilesize
156KB
-
memory/1620-245-0x0000000000820000-0x0000000000864000-memory.dmpFilesize
272KB
-
memory/1620-247-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1808-207-0x0000000000830000-0x0000000000876000-memory.dmpFilesize
280KB
-
memory/1808-208-0x0000000074690000-0x00000000746DA000-memory.dmpFilesize
296KB
-
memory/1808-214-0x0000000000FD0000-0x0000000001155000-memory.dmpFilesize
1.5MB
-
memory/1808-216-0x0000000000FD0000-0x0000000001155000-memory.dmpFilesize
1.5MB
-
memory/1808-229-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1888-54-0x00000000763D1000-0x00000000763D3000-memory.dmpFilesize
8KB
-
memory/1956-166-0x0000000000370000-0x00000000003D0000-memory.dmpFilesize
384KB
-
memory/1956-165-0x0000000000400000-0x0000000000914000-memory.dmpFilesize
5.1MB
-
memory/1960-238-0x00000000029E0000-0x00000000029E1000-memory.dmpFilesize
4KB
-
memory/1960-249-0x0000000002A10000-0x0000000002A11000-memory.dmpFilesize
4KB
-
memory/1960-252-0x00000000036D0000-0x00000000036D1000-memory.dmpFilesize
4KB
-
memory/1960-250-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB
-
memory/1960-248-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/1960-240-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB
-
memory/1960-235-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/1960-233-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/1960-232-0x0000000002A00000-0x0000000002A01000-memory.dmpFilesize
4KB
-
memory/1960-231-0x00000000029F0000-0x00000000029F1000-memory.dmpFilesize
4KB
-
memory/1960-225-0x0000000000920000-0x0000000000980000-memory.dmpFilesize
384KB
-
memory/1960-223-0x0000000000400000-0x000000000091A000-memory.dmpFilesize
5.1MB
-
memory/1960-206-0x0000000000174000-0x0000000000176000-memory.dmpFilesize
8KB
-
memory/1980-78-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1980-75-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1980-85-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1980-74-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1980-86-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1980-77-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1980-80-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1980-87-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1980-143-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1980-149-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1980-153-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1980-84-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1980-76-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1980-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1980-151-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1980-83-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1980-82-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1980-81-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1980-79-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2004-202-0x00000000002A0000-0x0000000000304000-memory.dmpFilesize
400KB
-
memory/2004-162-0x00000000002A0000-0x0000000000304000-memory.dmpFilesize
400KB
-
memory/2004-204-0x0000000000950000-0x00000000009ED000-memory.dmpFilesize
628KB
-
memory/2004-221-0x0000000000400000-0x000000000094C000-memory.dmpFilesize
5.3MB
-
memory/2024-209-0x0000000073EC0000-0x00000000745AE000-memory.dmpFilesize
6.9MB
-
memory/2024-172-0x00000000010C0000-0x0000000001190000-memory.dmpFilesize
832KB
-
memory/2064-182-0x00000000002D0000-0x0000000000330000-memory.dmpFilesize
384KB
-
memory/2064-181-0x0000000000400000-0x00000000005DC000-memory.dmpFilesize
1.9MB
-
memory/2124-273-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/2124-188-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2124-276-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/2124-191-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2124-269-0x00000000035A0000-0x00000000035A1000-memory.dmpFilesize
4KB
-
memory/2124-258-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2124-259-0x0000000000340000-0x00000000003A0000-memory.dmpFilesize
384KB
-
memory/2124-186-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2124-266-0x00000000035B0000-0x00000000035B1000-memory.dmpFilesize
4KB
-
memory/2132-193-0x00000000000A0000-0x00000000000A2000-memory.dmpFilesize
8KB
-
memory/2132-256-0x0000000000730000-0x0000000000779000-memory.dmpFilesize
292KB
-
memory/2132-260-0x00000000000D0000-0x000000000045C000-memory.dmpFilesize
3.5MB
-
memory/2328-210-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2656-272-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/2656-253-0x00000000003E0000-0x000000000040E000-memory.dmpFilesize
184KB
-
memory/2656-251-0x0000000073EC0000-0x00000000745AE000-memory.dmpFilesize
6.9MB