Analysis
-
max time kernel
59s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-09-2022 01:14
Static task
static1
Behavioral task
behavioral1
Sample
1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe
Resource
win10v2004-20220812-en
General
-
Target
1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe
-
Size
3.5MB
-
MD5
e84c47fb5d47792116a7121b411481f9
-
SHA1
6e16605c8403083a70068199930e5b6a3efed072
-
SHA256
1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec
-
SHA512
a0e489ae49940f7ff8823eed6570a1d81da595b82515eda33bf210f10267042e8c1e8bf4e4d704b27417372a41a33d469c10de32736aed5859446ead52af699b
-
SSDEEP
98304:xd18QV51R2H8BbH46dTZPDN6vsyHdfthjqCvLUBsKnS:x78QD1ecbYsTZPDN6vHdHjrLUCKS
Malware Config
Extracted
redline
Cana
176.111.174.254:56328
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
redline
ServAni
87.251.71.195:82
Extracted
nymaim
208.67.104.97
85.31.46.167
Signatures
-
Detect Fabookie payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.txt family_fabookie C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exe family_fabookie \Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exe family_fabookie \Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exe family_fabookie \Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exe family_fabookie -
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1504-182-0x0000000000250000-0x0000000000259000-memory.dmp family_smokeloader behavioral1/memory/1504-220-0x0000000000250000-0x0000000000259000-memory.dmp family_smokeloader behavioral1/memory/1400-247-0x0000000000240000-0x0000000000249000-memory.dmp family_smokeloader behavioral1/memory/2004-245-0x0000000000240000-0x0000000000249000-memory.dmp family_smokeloader -
Processes:
sotema_5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sotema_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sotema_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" sotema_5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sotema_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sotema_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sotema_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sotema_5.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-187-0x00000000003B0000-0x00000000003D0000-memory.dmp family_redline behavioral1/memory/1628-188-0x00000000024B0000-0x00000000024CE000-memory.dmp family_redline behavioral1/memory/1056-202-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1056-203-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1056-204-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1056-205-0x0000000000417F26-mapping.dmp family_redline behavioral1/memory/1056-207-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1056-209-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2356-277-0x0000000004B40000-0x0000000004B8C000-memory.dmp family_redline behavioral1/memory/2356-282-0x0000000004D30000-0x0000000004D7A000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral1/memory/112-185-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral1/memory/380-216-0x0000000000400000-0x0000000000422000-memory.dmp Nirsoft behavioral1/memory/380-223-0x0000000000400000-0x0000000000422000-memory.dmp Nirsoft -
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1916-192-0x0000000000360000-0x00000000003FD000-memory.dmp family_vidar behavioral1/memory/1916-198-0x0000000000400000-0x000000000094A000-memory.dmp family_vidar behavioral1/memory/1916-227-0x0000000000400000-0x000000000094A000-memory.dmp family_vidar -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 15 IoCs
Processes:
setup_install.exesotema_3.exesotema_2.exesotema_4.exesotema_6.exesotema_5.exesotema_7.exesotema_8.exesotema_8.tmpjfiag3g_gg.exesotema_7.exejfiag3g_gg.exesotema_1.exe8Wu9LMCaIPrWfgQfkuYK0UNy.exeHfsaZCBvVwQHUBDWmwEQer5b.exepid process 1172 setup_install.exe 1916 sotema_3.exe 1504 sotema_2.exe 568 sotema_4.exe 1628 sotema_6.exe 1152 sotema_5.exe 1644 sotema_7.exe 1016 sotema_8.exe 1608 sotema_8.tmp 112 jfiag3g_gg.exe 1056 sotema_7.exe 380 jfiag3g_gg.exe 1752 sotema_1.exe 976 8Wu9LMCaIPrWfgQfkuYK0UNy.exe 2004 HfsaZCBvVwQHUBDWmwEQer5b.exe -
Processes:
resource yara_rule behavioral1/memory/112-185-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral1/memory/380-216-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/380-223-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Loads dropped DLL 64 IoCs
Processes:
1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exesetup_install.execmd.execmd.exesotema_3.exesotema_2.execmd.execmd.execmd.execmd.execmd.exesotema_6.exesotema_5.exesotema_7.exesotema_4.exesotema_8.exesotema_8.tmpWerFault.exejfiag3g_gg.exesotema_7.exejfiag3g_gg.exeWerFault.execmd.exesotema_1.exepid process 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe 1172 setup_install.exe 1172 setup_install.exe 1172 setup_install.exe 1172 setup_install.exe 1172 setup_install.exe 1172 setup_install.exe 1172 setup_install.exe 1172 setup_install.exe 1240 cmd.exe 1240 cmd.exe 1540 cmd.exe 1540 cmd.exe 1916 sotema_3.exe 1916 sotema_3.exe 1504 sotema_2.exe 1504 sotema_2.exe 1948 cmd.exe 1620 cmd.exe 1620 cmd.exe 616 cmd.exe 520 cmd.exe 520 cmd.exe 268 cmd.exe 1628 sotema_6.exe 1628 sotema_6.exe 1152 sotema_5.exe 1152 sotema_5.exe 1644 sotema_7.exe 1644 sotema_7.exe 568 sotema_4.exe 1016 sotema_8.exe 1016 sotema_8.exe 568 sotema_4.exe 1016 sotema_8.exe 1608 sotema_8.tmp 1608 sotema_8.tmp 1608 sotema_8.tmp 1104 WerFault.exe 1104 WerFault.exe 1104 WerFault.exe 568 sotema_4.exe 568 sotema_4.exe 1504 sotema_2.exe 1104 WerFault.exe 112 jfiag3g_gg.exe 112 jfiag3g_gg.exe 1644 sotema_7.exe 1056 sotema_7.exe 1056 sotema_7.exe 568 sotema_4.exe 568 sotema_4.exe 380 jfiag3g_gg.exe 380 jfiag3g_gg.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 876 cmd.exe 1752 sotema_1.exe 1752 sotema_1.exe 1152 sotema_5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2356-269-0x0000000000400000-0x0000000000869000-memory.dmp themida behavioral1/memory/2356-268-0x0000000000400000-0x0000000000869000-memory.dmp themida behavioral1/memory/2356-270-0x0000000000400000-0x0000000000869000-memory.dmp themida behavioral1/memory/2368-291-0x0000000000400000-0x0000000000C05000-memory.dmp themida -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 35.241.7.66 -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com 47 ipinfo.io 48 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sotema_7.exedescription pid process target process PID 1644 set thread context of 1056 1644 sotema_7.exe sotema_7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1104 1172 WerFault.exe setup_install.exe 1304 1916 WerFault.exe sotema_3.exe 17888 2328 WerFault.exe BZteUrG8V2VJOIcUcfaz9fDL.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
sotema_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sotema_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sotema_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sotema_2.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
sotema_3.exesotema_5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sotema_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sotema_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sotema_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sotema_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sotema_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 sotema_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 sotema_5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 sotema_5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 sotema_5.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
Processes:
sotema_2.exejfiag3g_gg.exepid process 1504 sotema_2.exe 1504 sotema_2.exe 380 jfiag3g_gg.exe 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
sotema_2.exepid process 1504 sotema_2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
sotema_6.exesotema_7.exedescription pid process Token: SeShutdownPrivilege 1224 Token: SeDebugPrivilege 1628 sotema_6.exe Token: SeDebugPrivilege 1056 sotema_7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exesetup_install.execmd.execmd.exedescription pid process target process PID 1960 wrote to memory of 1172 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe setup_install.exe PID 1960 wrote to memory of 1172 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe setup_install.exe PID 1960 wrote to memory of 1172 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe setup_install.exe PID 1960 wrote to memory of 1172 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe setup_install.exe PID 1960 wrote to memory of 1172 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe setup_install.exe PID 1960 wrote to memory of 1172 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe setup_install.exe PID 1960 wrote to memory of 1172 1960 1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe setup_install.exe PID 1172 wrote to memory of 876 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 876 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 876 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 876 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 876 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 876 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 876 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1540 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1540 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1540 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1540 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1540 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1540 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1540 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1240 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1240 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1240 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1240 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1240 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1240 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1240 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1948 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1948 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1948 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1948 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1948 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1948 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1948 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 616 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 616 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 616 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 616 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 616 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 616 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 616 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1620 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1620 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1620 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1620 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1620 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1620 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 1620 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 520 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 520 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 520 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 520 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 520 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 520 1172 setup_install.exe cmd.exe PID 1172 wrote to memory of 520 1172 setup_install.exe cmd.exe PID 1240 wrote to memory of 1916 1240 cmd.exe sotema_3.exe PID 1240 wrote to memory of 1916 1240 cmd.exe sotema_3.exe PID 1240 wrote to memory of 1916 1240 cmd.exe sotema_3.exe PID 1240 wrote to memory of 1916 1240 cmd.exe sotema_3.exe PID 1240 wrote to memory of 1916 1240 cmd.exe sotema_3.exe PID 1240 wrote to memory of 1916 1240 cmd.exe sotema_3.exe PID 1240 wrote to memory of 1916 1240 cmd.exe sotema_3.exe PID 1540 wrote to memory of 1504 1540 cmd.exe sotema_2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe"C:\Users\Admin\AppData\Local\Temp\1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_3.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_3.exesotema_3.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 9805⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_5.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_5.exesotema_5.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\Documents\8Wu9LMCaIPrWfgQfkuYK0UNy.exe"C:\Users\Admin\Documents\8Wu9LMCaIPrWfgQfkuYK0UNy.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\tqNhqCu5szkjOrY\Cleaner.exe"6⤵
-
C:\Users\Admin\Documents\HfsaZCBvVwQHUBDWmwEQer5b.exe"C:\Users\Admin\Documents\HfsaZCBvVwQHUBDWmwEQer5b.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sxf0WbKFJ1oucdKjuV0dtQbd.exe"C:\Users\Admin\Documents\sxf0WbKFJ1oucdKjuV0dtQbd.exe"5⤵
-
C:\Users\Admin\Documents\VZefXumGMqjUIEG2lIAZ6Tqp.exe"C:\Users\Admin\Documents\VZefXumGMqjUIEG2lIAZ6Tqp.exe"5⤵
-
C:\Users\Admin\Documents\m0eGd6KWfCkHlMJcNvNF3qz5.exe"C:\Users\Admin\Documents\m0eGd6KWfCkHlMJcNvNF3qz5.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS63D3.tmp\Install.exe.\Install.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSE9E3.tmp\Install.exe.\Install.exe /S /site_id "525403"7⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"8⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&9⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3210⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6410⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"8⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&9⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3210⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6410⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gTVrIdAPW" /SC once /ST 00:34:52 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gTVrIdAPW"8⤵
-
C:\Users\Admin\Documents\BZteUrG8V2VJOIcUcfaz9fDL.exe"C:\Users\Admin\Documents\BZteUrG8V2VJOIcUcfaz9fDL.exe"5⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2328 -s 1006⤵
- Program crash
-
C:\Users\Admin\Documents\dLzPFvIqZ_5tHmYgAPK_F2fE.exe"C:\Users\Admin\Documents\dLzPFvIqZ_5tHmYgAPK_F2fE.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Users\Admin\Documents\rOjYibNQG4hzttvJxTHGDvLy.exe"C:\Users\Admin\Documents\rOjYibNQG4hzttvJxTHGDvLy.exe"5⤵
-
C:\Users\Admin\Documents\rOjYibNQG4hzttvJxTHGDvLy.exe"C:\Users\Admin\Documents\rOjYibNQG4hzttvJxTHGDvLy.exe" -h6⤵
-
C:\Users\Admin\Documents\Rhtg3cp3g6moxPkTyehaD76M.exe"C:\Users\Admin\Documents\Rhtg3cp3g6moxPkTyehaD76M.exe"5⤵
-
C:\Users\Admin\Documents\47s6ClYJF98pUAps6_7qeDpE.exe"C:\Users\Admin\Documents\47s6ClYJF98pUAps6_7qeDpE.exe"5⤵
-
C:\Users\Admin\Documents\upi3DNRW8bm1viFxeQCvlwji.exe"C:\Users\Admin\Documents\upi3DNRW8bm1viFxeQCvlwji.exe"5⤵
-
C:\Users\Admin\Documents\t8tv2jIbcspdcqSBPJJMbXCR.exe"C:\Users\Admin\Documents\t8tv2jIbcspdcqSBPJJMbXCR.exe"5⤵
-
C:\Users\Admin\Documents\Js_fOr9Vpw4xpUmxmOKw7LPB.exe"C:\Users\Admin\Documents\Js_fOr9Vpw4xpUmxmOKw7LPB.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_7.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exesotema_7.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exeC:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_6.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_6.exesotema_6.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_4.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exesotema_4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_2.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_2.exesotema_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_1.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_1.exesotema_1.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sotema_8.exe3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 4203⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\is-K97CQ.tmp\sotema_8.tmp"C:\Users\Admin\AppData\Local\Temp\is-K97CQ.tmp\sotema_8.tmp" /SL5="$80152,161510,77824,C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_8.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_8.exesotema_8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_1.txtFilesize
680KB
MD57837314688b7989de1e8d94f598eb2dd
SHA1889ae8ce433d5357f8ea2aff64daaba563dc94e3
SHA256d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247
SHA5123df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_2.exeFilesize
346KB
MD526f28b36de526ec0d11d076891b2b512
SHA1ffd51664691399b0be7f1b35c6ceaa28ad5aae22
SHA25636fa8e2c3e02c7915016234f6b73386d3e43f410c3ae55657520aae0a7d741b0
SHA512e881f620ff994d9a585c8f40605eba0ffd7293c672b917c9e78daab31b0a28cf77dc64f774155c844a579e652ac88dbda440a2b7db1e019ce764096bee4a29b6
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_2.txtFilesize
346KB
MD526f28b36de526ec0d11d076891b2b512
SHA1ffd51664691399b0be7f1b35c6ceaa28ad5aae22
SHA25636fa8e2c3e02c7915016234f6b73386d3e43f410c3ae55657520aae0a7d741b0
SHA512e881f620ff994d9a585c8f40605eba0ffd7293c672b917c9e78daab31b0a28cf77dc64f774155c844a579e652ac88dbda440a2b7db1e019ce764096bee4a29b6
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_3.exeFilesize
687KB
MD572ad275d10ff7ead7726ed338d7d289a
SHA19abfc439880d6f19c1c6307cd98b60ba2c6e7e29
SHA256a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad
SHA512c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_3.txtFilesize
687KB
MD572ad275d10ff7ead7726ed338d7d289a
SHA19abfc439880d6f19c1c6307cd98b60ba2c6e7e29
SHA256a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad
SHA512c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exeFilesize
972KB
MD55668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.txtFilesize
972KB
MD55668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_5.exeFilesize
773KB
MD551e7f03ae54c977764c32b0dedf0b9ac
SHA103cf8e81b1b8a96097c9e3da11f925e7dc6819b7
SHA2560580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b
SHA51203ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_5.txtFilesize
773KB
MD551e7f03ae54c977764c32b0dedf0b9ac
SHA103cf8e81b1b8a96097c9e3da11f925e7dc6819b7
SHA2560580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b
SHA51203ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_6.exeFilesize
420KB
MD5c04ec49f084f51d033df6013abbb29f7
SHA1b56ebfe04c872646aafa43d45f2da2d61ecf624e
SHA256de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807
SHA512ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_6.txtFilesize
420KB
MD5c04ec49f084f51d033df6013abbb29f7
SHA1b56ebfe04c872646aafa43d45f2da2d61ecf624e
SHA256de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807
SHA512ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exeFilesize
380KB
MD5b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.txtFilesize
380KB
MD5b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_8.exeFilesize
405KB
MD51299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
C:\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_8.txtFilesize
405KB
MD51299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
C:\Users\Admin\AppData\Local\Temp\is-K97CQ.tmp\sotema_8.tmpFilesize
715KB
MD5fe3859b471b9dc985043bc8387e0c36f
SHA102084ecb89ccb2f102442d8d7de18cbe0ff88972
SHA256da844b9d344aadd4b2129fa650d3ba01b18f7391a9b7d4678f9ef771c6d6017c
SHA5126429d3856ce5476d95852cd4f47f69dfbe512c815b9c49a1db29a0f0b2677b2f3821d354496ca6e9d000a478ad35222f67d65584e6d22b77acf9e81b055cca09
-
C:\Users\Admin\AppData\Local\Temp\is-K97CQ.tmp\sotema_8.tmpFilesize
715KB
MD5fe3859b471b9dc985043bc8387e0c36f
SHA102084ecb89ccb2f102442d8d7de18cbe0ff88972
SHA256da844b9d344aadd4b2129fa650d3ba01b18f7391a9b7d4678f9ef771c6d6017c
SHA5126429d3856ce5476d95852cd4f47f69dfbe512c815b9c49a1db29a0f0b2677b2f3821d354496ca6e9d000a478ad35222f67d65584e6d22b77acf9e81b055cca09
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\setup_install.exeFilesize
290KB
MD5eb7386bae270cefcef941d6f5f1bdbda
SHA15fb2c69dd0aa026ea36cca84b2808c77e0132451
SHA256c44498f53b471059284d772c3f0a96d611b1cde32bdc58fc6c9dc764ffbe5599
SHA512d167021c743bf23ed1506c5342f3c5ae05fb244838a0e5b0ff7e6a4f2931cc697f420fb8d690f1c8dbc88b12f8a189e160ac1aa5e82d03c0f11e50c46bbc3a19
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_2.exeFilesize
346KB
MD526f28b36de526ec0d11d076891b2b512
SHA1ffd51664691399b0be7f1b35c6ceaa28ad5aae22
SHA25636fa8e2c3e02c7915016234f6b73386d3e43f410c3ae55657520aae0a7d741b0
SHA512e881f620ff994d9a585c8f40605eba0ffd7293c672b917c9e78daab31b0a28cf77dc64f774155c844a579e652ac88dbda440a2b7db1e019ce764096bee4a29b6
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_2.exeFilesize
346KB
MD526f28b36de526ec0d11d076891b2b512
SHA1ffd51664691399b0be7f1b35c6ceaa28ad5aae22
SHA25636fa8e2c3e02c7915016234f6b73386d3e43f410c3ae55657520aae0a7d741b0
SHA512e881f620ff994d9a585c8f40605eba0ffd7293c672b917c9e78daab31b0a28cf77dc64f774155c844a579e652ac88dbda440a2b7db1e019ce764096bee4a29b6
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_2.exeFilesize
346KB
MD526f28b36de526ec0d11d076891b2b512
SHA1ffd51664691399b0be7f1b35c6ceaa28ad5aae22
SHA25636fa8e2c3e02c7915016234f6b73386d3e43f410c3ae55657520aae0a7d741b0
SHA512e881f620ff994d9a585c8f40605eba0ffd7293c672b917c9e78daab31b0a28cf77dc64f774155c844a579e652ac88dbda440a2b7db1e019ce764096bee4a29b6
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_2.exeFilesize
346KB
MD526f28b36de526ec0d11d076891b2b512
SHA1ffd51664691399b0be7f1b35c6ceaa28ad5aae22
SHA25636fa8e2c3e02c7915016234f6b73386d3e43f410c3ae55657520aae0a7d741b0
SHA512e881f620ff994d9a585c8f40605eba0ffd7293c672b917c9e78daab31b0a28cf77dc64f774155c844a579e652ac88dbda440a2b7db1e019ce764096bee4a29b6
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_3.exeFilesize
687KB
MD572ad275d10ff7ead7726ed338d7d289a
SHA19abfc439880d6f19c1c6307cd98b60ba2c6e7e29
SHA256a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad
SHA512c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_3.exeFilesize
687KB
MD572ad275d10ff7ead7726ed338d7d289a
SHA19abfc439880d6f19c1c6307cd98b60ba2c6e7e29
SHA256a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad
SHA512c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_3.exeFilesize
687KB
MD572ad275d10ff7ead7726ed338d7d289a
SHA19abfc439880d6f19c1c6307cd98b60ba2c6e7e29
SHA256a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad
SHA512c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_3.exeFilesize
687KB
MD572ad275d10ff7ead7726ed338d7d289a
SHA19abfc439880d6f19c1c6307cd98b60ba2c6e7e29
SHA256a0907f07a70cf4ebe9ffe525c75f29147211a45568f842c77e6193d3b5e58aad
SHA512c23892733593b36a4e86e97ef0554f6da833a0b226c30ecf5962809589148230b24490d3b38bf6f1d3fcfc93a2c4d67360e84c1081f3735dfddfe46b7b644d67
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exeFilesize
972KB
MD55668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exeFilesize
972KB
MD55668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_4.exeFilesize
972KB
MD55668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_5.exeFilesize
773KB
MD551e7f03ae54c977764c32b0dedf0b9ac
SHA103cf8e81b1b8a96097c9e3da11f925e7dc6819b7
SHA2560580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b
SHA51203ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_5.exeFilesize
773KB
MD551e7f03ae54c977764c32b0dedf0b9ac
SHA103cf8e81b1b8a96097c9e3da11f925e7dc6819b7
SHA2560580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b
SHA51203ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_5.exeFilesize
773KB
MD551e7f03ae54c977764c32b0dedf0b9ac
SHA103cf8e81b1b8a96097c9e3da11f925e7dc6819b7
SHA2560580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b
SHA51203ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_6.exeFilesize
420KB
MD5c04ec49f084f51d033df6013abbb29f7
SHA1b56ebfe04c872646aafa43d45f2da2d61ecf624e
SHA256de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807
SHA512ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_6.exeFilesize
420KB
MD5c04ec49f084f51d033df6013abbb29f7
SHA1b56ebfe04c872646aafa43d45f2da2d61ecf624e
SHA256de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807
SHA512ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_6.exeFilesize
420KB
MD5c04ec49f084f51d033df6013abbb29f7
SHA1b56ebfe04c872646aafa43d45f2da2d61ecf624e
SHA256de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807
SHA512ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_6.exeFilesize
420KB
MD5c04ec49f084f51d033df6013abbb29f7
SHA1b56ebfe04c872646aafa43d45f2da2d61ecf624e
SHA256de939e1fa24047c838e318812291e6d9750d29a4643210f4e35e1544e5dad807
SHA512ea57eccf64ba49371dcd354ecd26e8a4284d6bd664e49ab8f65f1a50a14b615112fd3478741adccf9a7f50847eed1d3241c1585e66b24756e2d0a21e69da1ab4
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exeFilesize
380KB
MD5b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exeFilesize
380KB
MD5b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exeFilesize
380KB
MD5b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_7.exeFilesize
380KB
MD5b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_8.exeFilesize
405KB
MD51299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_8.exeFilesize
405KB
MD51299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
\Users\Admin\AppData\Local\Temp\7zS8A77E44C\sotema_8.exeFilesize
405KB
MD51299cbed543bacc3c4923a4cb589d4fc
SHA1546c943125b7d1ebf6f80f6eee3e9d03f64073e4
SHA256e0ebdc9b770cc324034b53551b696fd8d7a0e2c49ae22271c747940ecbcc2730
SHA512da1ae97fbc1336fb1a65e722221343f07b8d57932b200af4f1578d8250604044f855cc580fd249fa604e302cae73967d6e87c28ea93da420c4f53feca2146770
-
\Users\Admin\AppData\Local\Temp\is-9KFAK.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-9KFAK.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-9KFAK.tmp\idp.dllFilesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
\Users\Admin\AppData\Local\Temp\is-K97CQ.tmp\sotema_8.tmpFilesize
715KB
MD5fe3859b471b9dc985043bc8387e0c36f
SHA102084ecb89ccb2f102442d8d7de18cbe0ff88972
SHA256da844b9d344aadd4b2129fa650d3ba01b18f7391a9b7d4678f9ef771c6d6017c
SHA5126429d3856ce5476d95852cd4f47f69dfbe512c815b9c49a1db29a0f0b2677b2f3821d354496ca6e9d000a478ad35222f67d65584e6d22b77acf9e81b055cca09
-
memory/112-183-0x0000000000000000-mapping.dmp
-
memory/112-185-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/112-186-0x00000000002C0000-0x00000000002CD000-memory.dmpFilesize
52KB
-
memory/268-125-0x0000000000000000-mapping.dmp
-
memory/380-222-0x0000000000820000-0x0000000000842000-memory.dmpFilesize
136KB
-
memory/380-216-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/380-211-0x0000000000000000-mapping.dmp
-
memory/380-217-0x0000000000820000-0x0000000000842000-memory.dmpFilesize
136KB
-
memory/380-223-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/520-116-0x0000000000000000-mapping.dmp
-
memory/568-225-0x0000000000E90000-0x0000000000EEB000-memory.dmpFilesize
364KB
-
memory/568-137-0x0000000000000000-mapping.dmp
-
memory/568-229-0x0000000000970000-0x0000000000992000-memory.dmpFilesize
136KB
-
memory/568-214-0x0000000000970000-0x0000000000992000-memory.dmpFilesize
136KB
-
memory/568-228-0x0000000000970000-0x0000000000992000-memory.dmpFilesize
136KB
-
memory/568-193-0x0000000000E90000-0x0000000000EEB000-memory.dmpFilesize
364KB
-
memory/568-215-0x0000000000970000-0x0000000000992000-memory.dmpFilesize
136KB
-
memory/568-194-0x0000000000E90000-0x0000000000EEB000-memory.dmpFilesize
364KB
-
memory/616-113-0x0000000000000000-mapping.dmp
-
memory/876-104-0x0000000000000000-mapping.dmp
-
memory/880-274-0x0000000000930000-0x00000000009A1000-memory.dmpFilesize
452KB
-
memory/880-273-0x0000000000870000-0x00000000008BC000-memory.dmpFilesize
304KB
-
memory/976-246-0x00000000002C0000-0x00000000002FF000-memory.dmpFilesize
252KB
-
memory/976-232-0x0000000000000000-mapping.dmp
-
memory/976-249-0x0000000000400000-0x00000000005A2000-memory.dmpFilesize
1.6MB
-
memory/976-243-0x000000000066F000-0x0000000000695000-memory.dmpFilesize
152KB
-
memory/1016-189-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1016-170-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1016-168-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1016-151-0x0000000000000000-mapping.dmp
-
memory/1056-199-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1056-205-0x0000000000417F26-mapping.dmp
-
memory/1056-209-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1056-207-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1056-200-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1056-202-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1056-203-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1056-204-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1104-179-0x0000000000000000-mapping.dmp
-
memory/1152-279-0x0000000005D90000-0x0000000006595000-memory.dmpFilesize
8.0MB
-
memory/1152-143-0x0000000000000000-mapping.dmp
-
memory/1172-81-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1172-82-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1172-110-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1172-93-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1172-94-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1172-58-0x0000000000000000-mapping.dmp
-
memory/1172-77-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1172-79-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1172-83-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1172-108-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1172-78-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1172-103-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1172-80-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1172-90-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1172-76-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1172-86-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1172-213-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1172-75-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1172-84-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1172-87-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1172-85-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/1240-107-0x0000000000000000-mapping.dmp
-
memory/1244-240-0x0000000000000000-mapping.dmp
-
memory/1244-258-0x0000000000610000-0x00000000006A2000-memory.dmpFilesize
584KB
-
memory/1304-221-0x0000000000000000-mapping.dmp
-
memory/1400-237-0x0000000000000000-mapping.dmp
-
memory/1400-242-0x00000000006AF000-0x00000000006BF000-memory.dmpFilesize
64KB
-
memory/1400-250-0x0000000000400000-0x000000000058C000-memory.dmpFilesize
1.5MB
-
memory/1400-247-0x0000000000240000-0x0000000000249000-memory.dmpFilesize
36KB
-
memory/1504-190-0x0000000000400000-0x00000000008F5000-memory.dmpFilesize
5.0MB
-
memory/1504-123-0x0000000000000000-mapping.dmp
-
memory/1504-218-0x0000000000A70000-0x0000000000A7F000-memory.dmpFilesize
60KB
-
memory/1504-219-0x0000000000400000-0x00000000008F5000-memory.dmpFilesize
5.0MB
-
memory/1504-220-0x0000000000250000-0x0000000000259000-memory.dmpFilesize
36KB
-
memory/1504-182-0x0000000000250000-0x0000000000259000-memory.dmpFilesize
36KB
-
memory/1504-181-0x0000000000A70000-0x0000000000A7F000-memory.dmpFilesize
60KB
-
memory/1540-105-0x0000000000000000-mapping.dmp
-
memory/1596-252-0x0000000002090000-0x0000000002191000-memory.dmpFilesize
1.0MB
-
memory/1596-236-0x0000000000000000-mapping.dmp
-
memory/1596-254-0x0000000001F30000-0x0000000001F8D000-memory.dmpFilesize
372KB
-
memory/1608-172-0x0000000000000000-mapping.dmp
-
memory/1620-115-0x0000000000000000-mapping.dmp
-
memory/1628-195-0x0000000000AA0000-0x0000000000AC1000-memory.dmpFilesize
132KB
-
memory/1628-226-0x0000000000AA0000-0x0000000000AC1000-memory.dmpFilesize
132KB
-
memory/1628-196-0x0000000000240000-0x000000000026F000-memory.dmpFilesize
188KB
-
memory/1628-140-0x0000000000000000-mapping.dmp
-
memory/1628-197-0x0000000000400000-0x0000000000907000-memory.dmpFilesize
5.0MB
-
memory/1628-187-0x00000000003B0000-0x00000000003D0000-memory.dmpFilesize
128KB
-
memory/1628-188-0x00000000024B0000-0x00000000024CE000-memory.dmpFilesize
120KB
-
memory/1644-180-0x0000000000E70000-0x0000000000ED6000-memory.dmpFilesize
408KB
-
memory/1644-146-0x0000000000000000-mapping.dmp
-
memory/1752-230-0x0000000000000000-mapping.dmp
-
memory/1916-191-0x0000000000AB0000-0x0000000000B14000-memory.dmpFilesize
400KB
-
memory/1916-192-0x0000000000360000-0x00000000003FD000-memory.dmpFilesize
628KB
-
memory/1916-198-0x0000000000400000-0x000000000094A000-memory.dmpFilesize
5.3MB
-
memory/1916-227-0x0000000000400000-0x000000000094A000-memory.dmpFilesize
5.3MB
-
memory/1916-224-0x0000000000AB0000-0x0000000000B14000-memory.dmpFilesize
400KB
-
memory/1916-120-0x0000000000000000-mapping.dmp
-
memory/1948-112-0x0000000000000000-mapping.dmp
-
memory/1960-54-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/1960-89-0x0000000002CC0000-0x0000000002DDE000-memory.dmpFilesize
1.1MB
-
memory/1960-91-0x0000000002CC0000-0x0000000002DDE000-memory.dmpFilesize
1.1MB
-
memory/1960-88-0x0000000002CC0000-0x0000000002DDE000-memory.dmpFilesize
1.1MB
-
memory/2004-248-0x0000000000400000-0x000000000058C000-memory.dmpFilesize
1.5MB
-
memory/2004-241-0x000000000078F000-0x000000000079F000-memory.dmpFilesize
64KB
-
memory/2004-245-0x0000000000240000-0x0000000000249000-memory.dmpFilesize
36KB
-
memory/2004-234-0x0000000000000000-mapping.dmp
-
memory/2180-251-0x00000000000E0000-0x000000000012C000-memory.dmpFilesize
304KB
-
memory/2180-255-0x00000000FF79246C-mapping.dmp
-
memory/2180-266-0x0000000000280000-0x00000000002F1000-memory.dmpFilesize
452KB
-
memory/2180-262-0x00000000000E0000-0x000000000012C000-memory.dmpFilesize
304KB
-
memory/2260-256-0x0000000000000000-mapping.dmp
-
memory/2296-259-0x0000000000000000-mapping.dmp
-
memory/2308-260-0x0000000000000000-mapping.dmp
-
memory/2328-261-0x0000000000000000-mapping.dmp
-
memory/2344-263-0x0000000000000000-mapping.dmp
-
memory/2356-264-0x0000000000000000-mapping.dmp
-
memory/2356-269-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/2356-270-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/2356-284-0x0000000000F00000-0x0000000001369000-memory.dmpFilesize
4.4MB
-
memory/2356-268-0x0000000000400000-0x0000000000869000-memory.dmpFilesize
4.4MB
-
memory/2356-277-0x0000000004B40000-0x0000000004B8C000-memory.dmpFilesize
304KB
-
memory/2356-283-0x0000000000F00000-0x0000000001369000-memory.dmpFilesize
4.4MB
-
memory/2356-282-0x0000000004D30000-0x0000000004D7A000-memory.dmpFilesize
296KB
-
memory/2356-286-0x0000000077540000-0x00000000776C0000-memory.dmpFilesize
1.5MB
-
memory/2368-265-0x0000000000000000-mapping.dmp
-
memory/2368-291-0x0000000000400000-0x0000000000C05000-memory.dmpFilesize
8.0MB
-
memory/2508-278-0x0000000000000000-mapping.dmp
-
memory/8012-285-0x0000000000000000-mapping.dmp
-
memory/9576-287-0x0000000000000000-mapping.dmp
-
memory/14440-295-0x0000000000000000-mapping.dmp
-
memory/17888-299-0x0000000000000000-mapping.dmp
-
memory/46796-316-0x0000000000000000-mapping.dmp
-
memory/54576-320-0x0000000000000000-mapping.dmp
-
memory/100972-357-0x0000000000000000-mapping.dmp
-
memory/101000-358-0x0000000000000000-mapping.dmp
-
memory/101052-361-0x0000000000000000-mapping.dmp
-
memory/101064-362-0x0000000000000000-mapping.dmp
-
memory/101084-365-0x0000000000000000-mapping.dmp
-
memory/101096-366-0x0000000000000000-mapping.dmp
-
memory/101112-368-0x0000000000000000-mapping.dmp
-
memory/101132-371-0x0000000000000000-mapping.dmp
-
memory/101164-373-0x0000000000000000-mapping.dmp
-
memory/101212-375-0x0000000000000000-mapping.dmp