Overview

overview

10

Static

static

3

Bootstrapper.exe

windows10-1703-x64

10

Bootstrapper.exe

windows10-2004-x64

10

Bootstrapper.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    101s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-08-2024 08:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bootstrapper.exe

  • Size

    427KB

  • MD5

    fa1fd1fb9ab5b24cd1f3cedcbd239c1c

  • SHA1

    8177b3bc63bccfe739fcf402070877b0e1f1ee75

  • SHA256

    fa737d8c1b29cc13fa645ea33300e76438ed0601016554475c3d258cf2a1217f

  • SHA512

    cf8eca2b4bddd4e128b2941b0e7c96b2f036567e418592058607b42c5c1ec376735026ecd2675243883623c61b1245e7836febc645b0ff34f30df07d4153010e

  • SSDEEP

    12288:zKgs2X/gDiVBQTB2zI6sJJFvn4yF8LU5:9sygDOBg3VFvTF8Lo

Score
10/10
umbralxwormcredential_accessdiscoveryexecutionratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 32 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Defender_Settings.vbs"
      2⤵
      • Modifies registry class
      PID:3200
    • C:\Users\Admin\AppData\Local\Temp\Bootstrapper-1.exe
      "C:\Users\Admin\AppData\Local\Temp\Bootstrapper-1.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3336
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
        3⤵
          PID:3156
      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4512
      • C:\Users\Admin\AppData\Local\Temp\StartMenu.exe
        "C:\Users\Admin\AppData\Local\Temp\StartMenu.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4832
        • C:\Windows\SYSTEM32\attrib.exe
          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\StartMenu.exe"
          3⤵
          • Views/modifies file attributes
          PID:3844
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\StartMenu.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:396
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2480
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" os get Caption
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4700
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" computersystem get totalphysicalmemory
          3⤵
            PID:3880
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            3⤵
              PID:4520
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2000
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                4⤵
                  PID:2704
              • C:\Windows\System32\Wbem\wmic.exe
                "wmic" path win32_VideoController get name
                3⤵
                • Detects videocard installed
                PID:3252
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\StartMenu.exe" && pause
                3⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:5104
                • C:\Windows\system32\PING.EXE
                  ping localhost
                  4⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2536
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:2716
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Blocklisted process makes network request
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1936
            • C:\Windows\System32\MsiExec.exe
              C:\Windows\System32\MsiExec.exe -Embedding 24D6739EECFE75B49AD77DA61088BDAD
              2⤵
              • Loads dropped DLL
              PID:2300
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 99F682F33CC8767ACD211B6C414FA62F
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:116
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding B9449E152656362821B557E7420DECA9 E Global\MSI0000
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1300
              • C:\Windows\SysWOW64\wevtutil.exe
                "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1700
                • C:\Windows\System32\wevtutil.exe
                  "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
                  4⤵
                    PID:4688

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Privilege Escalation

            Defense Evasion

            Hide Artifacts

            1
            T1564

            Hidden Files and Directories

            1
            T1564.001

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            2
            T1012

            Remote System Discovery

            1
            T1018

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Config.Msi\e57ed51.rbs
              Filesize

              1.0MB

              MD5

              2a1bee641db7ac440eb2f4db68a39253

              SHA1

              b56f26930822f5db0e7770926e1e4cae3167ef88

              SHA256

              7138acd63a9570210a6d973018156a16f8b15486d5b6cbf885d6fce7a6ccf470

              SHA512

              b36bd62a8d1e61121354536ab07ff5f5356608a50d4f37dc19c177d91f614e1dcb86865973cc5e09e10f70753697e9cc21f1fa12e6178810c585da5849b8a5ec

              Download Submit

            • C:\Program Files\nodejs\node_etw_provider.man
              Filesize

              10KB

              MD5

              1d51e18a7247f47245b0751f16119498

              SHA1

              78f5d95dd07c0fcee43c6d4feab12d802d194d95

              SHA256

              1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

              SHA512

              1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

              Download Submit

            • C:\Program Files\nodejs\node_etw_provider.man
              Filesize

              8KB

              MD5

              d3bc164e23e694c644e0b1ce3e3f9910

              SHA1

              1849f8b1326111b5d4d93febc2bafb3856e601bb

              SHA256

              1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

              SHA512

              91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md
              Filesize

              818B

              MD5

              2916d8b51a5cc0a350d64389bc07aef6

              SHA1

              c9d5ac416c1dd7945651bee712dbed4d158d09e1

              SHA256

              733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

              SHA512

              508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license
              Filesize

              1KB

              MD5

              5ad87d95c13094fa67f25442ff521efd

              SHA1

              01f1438a98e1b796e05a74131e6bb9d66c9e8542

              SHA256

              67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

              SHA512

              7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
              Filesize

              754B

              MD5

              d2cf52aa43e18fdc87562d4c1303f46a

              SHA1

              58fb4a65fffb438630351e7cafd322579817e5e1

              SHA256

              45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

              SHA512

              54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md
              Filesize

              771B

              MD5

              e9dc66f98e5f7ff720bf603fff36ebc5

              SHA1

              f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

              SHA256

              b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

              SHA512

              8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE
              Filesize

              730B

              MD5

              072ac9ab0c4667f8f876becedfe10ee0

              SHA1

              0227492dcdc7fb8de1d14f9d3421c333230cf8fe

              SHA256

              2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

              SHA512

              f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
              Filesize

              1KB

              MD5

              d116a360376e31950428ed26eae9ffd4

              SHA1

              192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

              SHA256

              c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

              SHA512

              5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
              Filesize

              802B

              MD5

              d7c8fab641cd22d2cd30d2999cc77040

              SHA1

              d293601583b1454ad5415260e4378217d569538e

              SHA256

              04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

              SHA512

              278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
              Filesize

              16KB

              MD5

              bc0c0eeede037aa152345ab1f9774e92

              SHA1

              56e0f71900f0ef8294e46757ec14c0c11ed31d4e

              SHA256

              7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

              SHA512

              5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE
              Filesize

              780B

              MD5

              b020de8f88eacc104c21d6e6cacc636d

              SHA1

              20b35e641e3a5ea25f012e13d69fab37e3d68d6b

              SHA256

              3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

              SHA512

              4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
              Filesize

              763B

              MD5

              7428aa9f83c500c4a434f8848ee23851

              SHA1

              166b3e1c1b7d7cb7b070108876492529f546219f

              SHA256

              1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

              SHA512

              c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
              Filesize

              4KB

              MD5

              f0bd53316e08991d94586331f9c11d97

              SHA1

              f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

              SHA256

              dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

              SHA512

              fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

              Download Submit

            • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE
              Filesize

              771B

              MD5

              1d7c74bcd1904d125f6aff37749dc069

              SHA1

              21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

              SHA256

              24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

              SHA512

              b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

              Download Submit

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
              Filesize

              168B

              MD5

              db7dbbc86e432573e54dedbcc02cb4a1

              SHA1

              cff9cfb98cff2d86b35dc680b405e8036bbbda47

              SHA256

              7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

              SHA512

              8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              1KB

              MD5

              88be3bc8a7f90e3953298c0fdbec4d72

              SHA1

              f4969784ad421cc80ef45608727aacd0f6bf2e4b

              SHA256

              533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

              SHA512

              4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              1KB

              MD5

              c3b84be2bbf3c65d814edb1e6d8df10f

              SHA1

              1e23ead985215ee938f5280a0144529654ed5f3c

              SHA256

              a4f8c5af90aedc806d37e2b2adc3f80d0d0d99b681b497988b44c826d7093b2b

              SHA512

              397860732aadd6e68d2193ae93ce9307779d267e64e21787ff6edc5428b388c132ddf69af3fb353a4f316f6ba86a5993e6d7da04d0475fe21accfac4b8ac6ae7

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              1ff7c767b41e57bd6662b9b45b7e4331

              SHA1

              e484ee08429d6403c5beb97582f2bc88567d2d45

              SHA256

              c37e94da3e67f9473d2f0f51725c4246eefdbd2c01b3603d1b218842afc05048

              SHA512

              310cdae4625b1c391eab4adc7e139da6da6cbc2f8eda386ec6aa23da7967fe3dad6792ccd4bed0a0a320c466363051927ff376487080f77b50bf325098651483

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              6d42b6da621e8df5674e26b799c8e2aa

              SHA1

              ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

              SHA256

              5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

              SHA512

              53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              948B

              MD5

              c65738617888921a153bd9b1ef516ee7

              SHA1

              5245e71ea3c181d76320c857b639272ac9e079b1

              SHA256

              4640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26

              SHA512

              2e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Bootstrapper-1.exe
              Filesize

              796KB

              MD5

              4b94b989b0fe7bec6311153b309dfe81

              SHA1

              bb50a4bb8a66f0105c5b74f32cd114c672010b22

              SHA256

              7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

              SHA512

              fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Defender_Settings.vbs
              Filesize

              313B

              MD5

              b0bf0a477bcca312021177572311e666

              SHA1

              ea77332d7779938ae8e92ad35d6dea4f4be37a92

              SHA256

              af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9

              SHA512

              09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Solara.exe
              Filesize

              84KB

              MD5

              32d66fa285a7675247940a88a3e769a7

              SHA1

              e84adbd91dfeb480cd694e41fbef4beeadfe30ef

              SHA256

              36cd4e911af166e6b3e72a5fd957c99779cdcd8a86aa5a38788302f02a94dce1

              SHA512

              15f66dbc0595ca36931860ca769d75f7f56226eeed137a3451d491b3eb8d52850bbff2cd5c7729a5f529850ce4c3cd133958d94bb88a142d4455e1e65ff73453

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\StartMenu.exe
              Filesize

              229KB

              MD5

              46dada61944a20f74ebc3723450a414a

              SHA1

              0ebfb78421ec8d8e84c4edb14dc9c493d83be78d

              SHA256

              25c60664ed6534d445c98ae922ad708410f7546a059dd31a38086097c236494c

              SHA512

              aa40fa81013bb6e9df2e1e0b9c3b06b7afbf85dbb77eaf58ffa8694358a35ee703ffbe761f3241a5df244ce95c9c2d223f101b136c3ba50bc8893e48177550af

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1ipd1h4.axn.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
              Filesize

              30.1MB

              MD5

              0e4e9aa41d24221b29b19ba96c1a64d0

              SHA1

              231ade3d5a586c0eb4441c8dbfe9007dc26b2872

              SHA256

              5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

              SHA512

              e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

              Download Submit

            • C:\Windows\Installer\MSIF05B.tmp
              Filesize

              122KB

              MD5

              9fe9b0ecaea0324ad99036a91db03ebb

              SHA1

              144068c64ec06fc08eadfcca0a014a44b95bb908

              SHA256

              e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

              SHA512

              906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

              Download Submit

            • C:\Windows\Installer\MSIF0F9.tmp
              Filesize

              211KB

              MD5

              a3ae5d86ecf38db9427359ea37a5f646

              SHA1

              eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

              SHA256

              c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

              SHA512

              96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

              Download Submit

            • C:\Windows\Installer\MSIFA42.tmp
              Filesize

              297KB

              MD5

              7a86ce1a899262dd3c1df656bff3fb2c

              SHA1

              33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

              SHA256

              b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

              SHA512

              421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

              Download Submit

            • memory/620-44-0x00007FFD39AA0000-0x00007FFD3A561000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/620-1-0x00000000002D0000-0x0000000000342000-memory.dmp

              Filesize

              456KB

              Download

            • memory/620-3-0x00007FFD39AA0000-0x00007FFD3A561000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/620-0-0x00007FFD39AA3000-0x00007FFD39AA5000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2184-42-0x00000000003D0000-0x00000000003EC000-memory.dmp

              Filesize

              112KB

              Download

            • memory/2208-40-0x000001F46FC40000-0x000001F46FC80000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2208-72-0x000001F472130000-0x000001F4721A6000-memory.dmp

              Filesize

              472KB

              Download

            • memory/2208-74-0x000001F4718C0000-0x000001F4718DE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/2208-110-0x000001F471900000-0x000001F47190A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2208-111-0x000001F472200000-0x000001F472212000-memory.dmp

              Filesize

              72KB

              Download

            • memory/2208-73-0x000001F4721B0000-0x000001F472200000-memory.dmp

              Filesize

              320KB

              Download

            • memory/2696-46-0x0000023978D60000-0x0000023978D82000-memory.dmp

              Filesize

              136KB

              Download

            • memory/3336-43-0x0000024C43420000-0x0000024C434EE000-memory.dmp

              Filesize

              824KB

              Download