Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    16s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 05:17

General

  • Target

    718b5089505fed92d1a44dc0dbeb36dc.exe

  • Size

    2.8MB

  • MD5

    718b5089505fed92d1a44dc0dbeb36dc

  • SHA1

    f4afe14c1b392514350f4495c44f998d3f19128f

  • SHA256

    df872b0b7c336241db1a1ff9e83100d6ffb2b898a46c0c7b37a47dcbd002b056

  • SHA512

    4c9d292125343b5b7edfe0051454fff957c040fd822e9b9d32f6a94d654dae778ca6fcb1e269adcb83363b3ade2893ae2ae63558f2906185ed67298c841bc807

  • SSDEEP

    49152:xcBszOxu3gCpbwOXh+1b4yFjErlsV6SP5iWyZ9KFFdZyZmj9MJ0yEwJ84vLRaBtf:xSizpbwOxKb4y8sVwWyZ0aZw9zCvLUBN

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

vidar

Version

39.7

Botnet

706

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Botnet

pub5

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe
    "C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe"
    1⤵
      PID:3920
      • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS05F14757\setup_install.exe"
        2⤵
          PID:4080
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_3.exe
            3⤵
              PID:3012
              • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_3.exe
                sonia_3.exe
                4⤵
                  PID:4544
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 524
                3⤵
                • Program crash
                PID:2760
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sonia_7.exe
                3⤵
                  PID:4996
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sonia_6.exe
                  3⤵
                    PID:760
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sonia_5.exe
                    3⤵
                      PID:4888
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sonia_4.exe
                      3⤵
                        PID:5008
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sonia_2.exe
                        3⤵
                          PID:2196
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_1.exe
                          3⤵
                            PID:1308
                      • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_1.exe
                        sonia_1.exe
                        1⤵
                          PID:4624
                          • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_1.exe
                            "C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_1.exe" -a
                            2⤵
                              PID:3340
                          • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_5.exe
                            sonia_5.exe
                            1⤵
                              PID:1812
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 4080
                              1⤵
                                PID:2168
                              • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_7.exe
                                sonia_7.exe
                                1⤵
                                  PID:5012
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c cmd < Compatto.rtf
                                  1⤵
                                    PID:1588
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd
                                      2⤵
                                        PID:2088
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1 -n 30
                                          3⤵
                                          • Runs ping.exe
                                          PID:1040
                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                          Triste.exe.com n
                                          3⤵
                                            PID:228
                                          • C:\Windows\SysWOW64\findstr.exe
                                            findstr /V /R "^jvMDwkwydQdmnxGPmMOjYlbIlopECWXOZojRKCmISYgoKPYfXOyLKoMeYraSevCxTCAdoOyWjyxqVfYxlTHNQkrRvpTHpGGccUgofIipJpnFNMuJyYIpPPDHnITYVnMGn$" Oggi.rtf
                                            3⤵
                                              PID:4416
                                        • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_4.exe
                                          sonia_4.exe
                                          1⤵
                                            PID:4484
                                          • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_6.exe
                                            sonia_6.exe
                                            1⤵
                                              PID:2264
                                            • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_2.exe
                                              sonia_2.exe
                                              1⤵
                                                PID:4120
                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com n
                                                1⤵
                                                  PID:3680

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Compatto.rtf

                                                  Filesize

                                                  478B

                                                  MD5

                                                  b96b1288ce038869fb15d4353f760613

                                                  SHA1

                                                  5a6f01cb0546a6dd4ae1e90279aaa82bdd672b60

                                                  SHA256

                                                  2c1458ecd2cc31a6d798a1c6396926cb99a66481832f774dbdbc19594ff9bd40

                                                  SHA512

                                                  36a72a5cac8b1aaa395d9efc2fc79b4525e408c57cebaaf2f00c1ba5b51bc08ee22e5676055cdcc961197c05e41d020c8d74b0d95426095d1a5b04fb14d3b04e

                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Incontrati.rtf

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  2159edf39246faecd80a5bb1638b0212

                                                  SHA1

                                                  44930f0fe67b06a73c57ff56976894632890aa6b

                                                  SHA256

                                                  8dec7534543bc983bcd6965539e3d26de768775ac117a108b545a5b4e3bb3614

                                                  SHA512

                                                  49b34aab60b12e98da6f521adf6d4c3ced8245df327a84b8c39d096fc26916ed95ddc212fb05558cf801213e62b5c40cba6cd5cde321f4d23af8bd7e54694a33

                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Oggi.rtf

                                                  Filesize

                                                  117KB

                                                  MD5

                                                  d0792296bd202a5527cd006cbfaaac7f

                                                  SHA1

                                                  1d019787dc775a73864a9c49c6d6fb132d3180e7

                                                  SHA256

                                                  d179558ac3b8c934489cab0ae993383bbbbbf4d41e669c223357e8b5b1a28bf6

                                                  SHA512

                                                  95754132a3e901f90601abaf45a2fe35f80a724594f824448785a8ceaf115b10b68a665a5805b659ad72943d2c567934c1d7343a0bfc21d0ef2a352a355fe6db

                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com

                                                  Filesize

                                                  53KB

                                                  MD5

                                                  39a8e401eab4c39e8eeb2fc7428b1f44

                                                  SHA1

                                                  88cee795f29234fbba35868b4763f8695b8b1acf

                                                  SHA256

                                                  cd523413408b0853983ec7bad1af490e820fde85c62a8b6a6d310c06dd0cbebb

                                                  SHA512

                                                  fcfe5431f84a7e77faa2ef854b17c877f0f67968b9b9c8ce931031128f3ad04638e54703fdd16b3623d9f14543b3af0cda1808ef30aa9c460be40787e1c0806e

                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com

                                                  Filesize

                                                  69KB

                                                  MD5

                                                  08d2cb0d26667adb72c52b945b5bc5fa

                                                  SHA1

                                                  801e093bdc0b7353a2d3cb11e984d4ca35b1b9b6

                                                  SHA256

                                                  513c6d285f3efc233229878f07003ccd7a07a9df62531983945bb1680b254c8d

                                                  SHA512

                                                  b957f784755f2f8129abe2784476d8db713154755766fed6b6df6538dd808c9e0d13a22a1250310494e8e9c41c6b9e61fb647c6009f51e9d5f922bf0bf9f076f

                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Troverai.rtf

                                                  Filesize

                                                  112KB

                                                  MD5

                                                  3ba04c5932454d38a82cd2d099d16cb7

                                                  SHA1

                                                  91d61f75fe22a12d196b76d58cb5f5299802dcc6

                                                  SHA256

                                                  77096744e15c68b2d19301db8f2761aba3c25445d4e9284ec69c3feb2349a6cf

                                                  SHA512

                                                  a3bee17112dc3427631df961d4712926fb186e38242fea7f5988169ffd960b1a24229334c4bd009270619a3dab229a485f96fbe4affa000f738030cef8836781

                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\n

                                                  Filesize

                                                  79KB

                                                  MD5

                                                  459f502498a0e2d588f6313862ba5c36

                                                  SHA1

                                                  39356426505bd9b1db805865f0328bae719622ee

                                                  SHA256

                                                  5155e2b2897084159b7047f468868acee23d83a76e663b8ef4cb62494d0d0f9e

                                                  SHA512

                                                  5f7a6edd526dffeb49e4197402dddf7dbde47fb63ec38461d69b58d8fe3e5e964b16a67eaa67529c327509b8fd3b5a2039b65d4e511cbbe616bdc2e017808df5

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\libcurl.dll

                                                  Filesize

                                                  218KB

                                                  MD5

                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                  SHA1

                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                  SHA256

                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                  SHA512

                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\libcurlpp.dll

                                                  Filesize

                                                  54KB

                                                  MD5

                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                  SHA1

                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                  SHA256

                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                  SHA512

                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\libgcc_s_dw2-1.dll

                                                  Filesize

                                                  113KB

                                                  MD5

                                                  9aec524b616618b0d3d00b27b6f51da1

                                                  SHA1

                                                  64264300801a353db324d11738ffed876550e1d3

                                                  SHA256

                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                  SHA512

                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\libgcc_s_dw2-1.dll

                                                  Filesize

                                                  87KB

                                                  MD5

                                                  7ef64cac44c2b7a7530511877c2ce2ac

                                                  SHA1

                                                  946342327b0802e0451668b842d8aa5dd0d66d01

                                                  SHA256

                                                  4e5f2cff0f9b6ec277a6a99aae7b8e53f4e2c076f712244292a3c76afc0df48a

                                                  SHA512

                                                  a6d4d9588a002f39952c1dd44a3585c47df417d625bfcd49d9e2ac10de18eefdaa4ce82e9808c6529296ce1571d7d8a35af319558d1de0301cef210278c8b0bd

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\libstdc++-6.dll

                                                  Filesize

                                                  177KB

                                                  MD5

                                                  7ef2efd7cbfc2f2cca9fac1e0dd55332

                                                  SHA1

                                                  2c52386989d5d1a38f7bb3d12cdd17ec98c10eda

                                                  SHA256

                                                  1ab448584160177d1e2ae51cb7018916d378e1389500c7c3c02379d52f14ec31

                                                  SHA512

                                                  1591878a6345b265635e9619cfdc9b9be787835d3ba42a3b0a96f306c9f79ae16f7688713bda52b74bdf54ca2812ad45f7468d65de5abd1fd2d55b9b204898a3

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\libstdc++-6.dll

                                                  Filesize

                                                  434KB

                                                  MD5

                                                  56035affc0c490ed8e20bb1934fefe8a

                                                  SHA1

                                                  21e62294c929f05a555d9bc018e11f81aad231a3

                                                  SHA256

                                                  1c17a0262f740725c146227f6aedb36afe201f7285a0c2fe009613ecbca10df2

                                                  SHA512

                                                  ce277145bc91098be4743843db7661bf7c59f8d4608f07fd52b5e56c42b6fc28c4b5a396e696ef1c795ce1423f031f43027469ee75d9be0c350b92b19800d4bc

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\libwinpthread-1.dll

                                                  Filesize

                                                  69KB

                                                  MD5

                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                  SHA1

                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                  SHA256

                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                  SHA512

                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\setup_install.exe

                                                  Filesize

                                                  290KB

                                                  MD5

                                                  b4a67b6fec9465dd0ec68dd89161871b

                                                  SHA1

                                                  96e7f9107283b6bb16a32cfcef54cee69f60fd12

                                                  SHA256

                                                  44bca303abba91a91aae37648d0ed6de6fac5260be3e28eb1a2decd7a6f01aff

                                                  SHA512

                                                  a7f6c7832537e9a693f672416cfe5e1e3de7d2fd13a6078976154f75d542fdaaf00e417e7e65b7e5609c30807ba99e969f6dbc42229c1e6e3ddbfd5aed5f2565

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\setup_install.exe

                                                  Filesize

                                                  247KB

                                                  MD5

                                                  6d5e0621a15761f96602ea2364452e24

                                                  SHA1

                                                  5256f07bf68e9a93e5f74e9665733294ac04e5e8

                                                  SHA256

                                                  4a9d6ac945a91886a961b985f2cc44a685a3b873c1e5327ed600a7be70ae8fa5

                                                  SHA512

                                                  208ebb50d7c1910ebe093c6ad71dcd212563b870ec444cccb5038d2315378f1d0f3c41aefa015f284ed1bf36fd50e7ab80e372d173d1f5fb626a4bd09a631257

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_1.exe

                                                  Filesize

                                                  56KB

                                                  MD5

                                                  c0d18a829910babf695b4fdaea21a047

                                                  SHA1

                                                  236a19746fe1a1063ebe077c8a0553566f92ef0f

                                                  SHA256

                                                  78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98

                                                  SHA512

                                                  cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_2.exe

                                                  Filesize

                                                  149KB

                                                  MD5

                                                  9c42062a5c40ae976700dd7583c45508

                                                  SHA1

                                                  534fe6221debf96a3443c1cfbfa083b83aca0c2f

                                                  SHA256

                                                  4f3cec8d0f2918bcbbb0e9607f71b528f1d3ad39e0bdbab67ce4af1d89e4e5f8

                                                  SHA512

                                                  463834892734fd8d76b7c9ee63714eb45f6253c1f10505c63fc9897f934c02fe94c14b5b59030517a21f38b7ede16ff100937459bf133bc93ece780eddb3c795

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_2.txt

                                                  Filesize

                                                  317KB

                                                  MD5

                                                  b428de5cabd26eb0172e0b62a2dbdbf9

                                                  SHA1

                                                  c5536d8dd412d21f3bb133080b4a07c3bed47694

                                                  SHA256

                                                  6b5c2a9df24511f0d3d94ad6b9632496a6ef4ab623c5e4ef9496765d7ecaf456

                                                  SHA512

                                                  04b9a5bff30e5422f1976d558343a5fa64aee2d93d44f0ab36330f1bce246dd1c4458d52f001d9ebf4d229688f6e2613e8297fbd87e4381914dfb0b044c10506

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_3.exe

                                                  Filesize

                                                  51KB

                                                  MD5

                                                  4950a478f7536fb3c7a8bc19e0943a86

                                                  SHA1

                                                  d6577c107accba2cd6079ed39cfdde6c230c7223

                                                  SHA256

                                                  cb5139aee40487de0c198826a8ffe762fe3015c5513827459fff84c013db7042

                                                  SHA512

                                                  1fa5284c873475e9aad423115c550d7059545ee1316ba0c0dfed1982d9d2ca185d9f8593333adc823b7cecb9b4c2aab53c099fd7d6ca4a741765fdd2abd04186

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_3.txt

                                                  Filesize

                                                  242KB

                                                  MD5

                                                  562bc0e336fd6097e0c7d4361606f491

                                                  SHA1

                                                  1bab08ba3a65dd38490611cd24f818af1725cb4a

                                                  SHA256

                                                  962c791b532b209b48265e99ca678b6a125c41be5f1b5870da4fbd95a4fce705

                                                  SHA512

                                                  c35de0f85cd77261b38affe3db53d0c08cf241292eb5fbf416618f56b0fc19369674adf20ee46da47e3c2ee10ba67b1e2bdb2b2e90f7f7a28ce47105e0b59134

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_4.exe

                                                  Filesize

                                                  117KB

                                                  MD5

                                                  7dd2640ec31132a5496cad4094d5077f

                                                  SHA1

                                                  76aa4cdafa07236e3869192d3a253d29e77644ba

                                                  SHA256

                                                  62a55fe169c776651d2c4061597373cc19a9fd89660eb1c6d0a17c0231cb7e18

                                                  SHA512

                                                  83b35f90d02055c738670c7216ef68d6a2abbcb767be034a52df789063eb8771babd1720e47963be05d4b099f73696a5ebda2b170acfa386ed402160d8685095

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_5.exe

                                                  Filesize

                                                  85KB

                                                  MD5

                                                  7bc11a96437ad6c113c2e180d934606f

                                                  SHA1

                                                  d4659cea7618e273aecebff9b47c4a7fe378b25d

                                                  SHA256

                                                  f43b3477ec51b668730c855523f910e659b7ff15fe800727c47368a41de6588b

                                                  SHA512

                                                  961dd2af9df29c6cdf7fb5c18f644726399ea44aded7837adb5518dd3294f9b5c1bd076737daaa4e5a033a299606b620bc1e6715d185f837171ada7a8feefc8f

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_5.txt

                                                  Filesize

                                                  309KB

                                                  MD5

                                                  6fb155ae5481a3f897faa60d4de66bf9

                                                  SHA1

                                                  213b33d6efc50746526c0af2edca9fef981334a6

                                                  SHA256

                                                  48923cc30082ac5c4ec2ff1d999464af898fa5e3e15044e21ed8ca2e240c1029

                                                  SHA512

                                                  abdfedcc23ffd8d26b61390e1fd34568a6e0013f1b26caa517ed03458dd6824ec9bd03a9ab011c19e6d7235f58771383b8c5b01e3d3497577d3a0a1f13bd5953

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_6.exe

                                                  Filesize

                                                  76KB

                                                  MD5

                                                  4691dc7af6d92d63c101746980419198

                                                  SHA1

                                                  aac94b8f5fa01bd1b88b1672a07f037fc47ba5a6

                                                  SHA256

                                                  2c274726a1f8908205b0800e878f58b411063bd6b9e37a72be4073524df1ee01

                                                  SHA512

                                                  cd50a1d0689ab7e446fc0f0578ae82d5e7c1f9538d53ffcd89d6ebc0e2215ae1312121fc4a7694ec321b1ef9df1c2be79612df67b2b7ec63e6e710e2f3c79b68

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_6.txt

                                                  Filesize

                                                  342KB

                                                  MD5

                                                  72094f09bcf5b945d445ab01b4468476

                                                  SHA1

                                                  c4cecbeb2ed05db3086b66b95c50d3f73bb78426

                                                  SHA256

                                                  6353943593e2feaf8fd0013e930a6197caf4dc240c20abab89266dc8fa6cfa00

                                                  SHA512

                                                  7af85cd8f1162e7c37568da9e736d7dccd0d3f67c44713c2953e5709346df07571f7d1059c1336f6f58ff2579e9208442174798f15fbccecd0fb9f5e982e899d

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_7.exe

                                                  Filesize

                                                  63KB

                                                  MD5

                                                  21fb1bb5a1a708a252db1429e106fe27

                                                  SHA1

                                                  c897302071cfb5edaec046473326bd704a7de552

                                                  SHA256

                                                  a7567f8fbd8055ca2b0a57acc6431ceedc4cc9f04c51861beaf13c6c646b6004

                                                  SHA512

                                                  9bc2c125d85708f12ccafc5dd9d76def41a3b78ac131285e30f36ba832dd86aca54bba123888d02e36947d231b07b0111e235eb995366a46edf0788c3dfa0df9

                                                • C:\Users\Admin\AppData\Local\Temp\7zS05F14757\sonia_7.txt

                                                  Filesize

                                                  200KB

                                                  MD5

                                                  f18b00637d6ca1b055fd248e1e65479c

                                                  SHA1

                                                  e5f2a7c663c3fa2fedcd7a9d3f9282c8c39e80f9

                                                  SHA256

                                                  51d8a60d5f05f2c0ca012ca79e28995476fcbef648fa5bd171eb967cab2705d7

                                                  SHA512

                                                  297e48ea42846270369cf3845326319a437b641d86a81d6c5b044947c43d73f0049b8ed3201938596a85b97a181fb0605dcc91ceaa65529bb90e6b7f525fea7e

                                                • C:\Users\Admin\AppData\Local\Temp\CC4F.tmp

                                                  Filesize

                                                  30KB

                                                  MD5

                                                  5349331dde95489cf756cf445ea721a0

                                                  SHA1

                                                  3f3bffdbb2d00376a712ff7b500f9d7cf700b556

                                                  SHA256

                                                  f17fc98af0fcf7f28c7d2df49f7ce8252253bcfa47a605c7fa772d2b4392b655

                                                  SHA512

                                                  ff1aca5b78c518ee143b1ac535694d8f87cb8601c3c1129845605b6f3a6853621c4a1ad280d1cb3cfaa78cbf79d52b86b4a0eb6324825b20965cffe9247df4e6

                                                • memory/4080-61-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4080-51-0x0000000064940000-0x0000000064959000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/4080-32-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4080-96-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                  Filesize

                                                  152KB

                                                • memory/4080-94-0x0000000064940000-0x0000000064959000-memory.dmp

                                                  Filesize

                                                  100KB

                                                • memory/4080-93-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4080-46-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                  Filesize

                                                  572KB

                                                • memory/4080-45-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                  Filesize

                                                  572KB

                                                • memory/4080-49-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4080-50-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4080-47-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                  Filesize

                                                  152KB

                                                • memory/4080-48-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                  Filesize

                                                  572KB

                                                • memory/4080-105-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4080-97-0x000000006EB40000-0x000000006EB63000-memory.dmp

                                                  Filesize

                                                  140KB

                                                • memory/4080-95-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                  Filesize

                                                  572KB

                                                • memory/4080-52-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4080-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4080-55-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                  Filesize

                                                  152KB

                                                • memory/4080-58-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4080-57-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4080-56-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                  Filesize

                                                  152KB

                                                • memory/4080-62-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4080-54-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                  Filesize

                                                  1.5MB

                                                • memory/4080-60-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4080-59-0x0000000000400000-0x000000000051D000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/4120-107-0x0000000000400000-0x000000000046C000-memory.dmp

                                                  Filesize

                                                  432KB

                                                • memory/4120-134-0x0000000000400000-0x0000000000409000-memory.dmp

                                                  Filesize

                                                  36KB

                                                • memory/4120-98-0x00000000005F0000-0x00000000006F0000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/4120-104-0x00000000004B0000-0x00000000004B9000-memory.dmp

                                                  Filesize

                                                  36KB

                                                • memory/4484-90-0x0000000002960000-0x0000000002970000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/4484-106-0x00007FFA4A530000-0x00007FFA4AFF1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/4484-79-0x0000000000860000-0x0000000000886000-memory.dmp

                                                  Filesize

                                                  152KB

                                                • memory/4484-78-0x00007FFA4A530000-0x00007FFA4AFF1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/4484-81-0x00000000028E0000-0x00000000028FE000-memory.dmp

                                                  Filesize

                                                  120KB

                                                • memory/4544-108-0x0000000000850000-0x0000000000950000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                • memory/4544-109-0x0000000000790000-0x000000000082D000-memory.dmp

                                                  Filesize

                                                  628KB

                                                • memory/4544-110-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                  Filesize

                                                  768KB

                                                • memory/4544-133-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                  Filesize

                                                  768KB

                                                • memory/4544-132-0x0000000000790000-0x000000000082D000-memory.dmp

                                                  Filesize

                                                  628KB