Overview

overview

10

Static

static

3

Bootstrapper.exe

windows10-1703-x64

10

Bootstrapper.exe

windows10-2004-x64

10

Bootstrapper.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    36s
  • max time network
    37s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-08-2024 08:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bootstrapper.exe

  • Size

    427KB

  • MD5

    fa1fd1fb9ab5b24cd1f3cedcbd239c1c

  • SHA1

    8177b3bc63bccfe739fcf402070877b0e1f1ee75

  • SHA256

    fa737d8c1b29cc13fa645ea33300e76438ed0601016554475c3d258cf2a1217f

  • SHA512

    cf8eca2b4bddd4e128b2941b0e7c96b2f036567e418592058607b42c5c1ec376735026ecd2675243883623c61b1245e7836febc645b0ff34f30df07d4153010e

  • SSDEEP

    12288:zKgs2X/gDiVBQTB2zI6sJJFvn4yF8LU5:9sygDOBg3VFvTF8Lo

Score
10/10
umbralxwormcredential_accessdiscoveryexecutionratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 32 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Defender_Settings.vbs"
      2⤵
      • Modifies registry class
      PID:1616
    • C:\Users\Admin\AppData\Local\Temp\Bootstrapper-1.exe
      "C:\Users\Admin\AppData\Local\Temp\Bootstrapper-1.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
        3⤵
          PID:912
      • C:\Users\Admin\AppData\Local\Temp\Solara.exe
        "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2372
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3696
      • C:\Users\Admin\AppData\Local\Temp\StartMenu.exe
        "C:\Users\Admin\AppData\Local\Temp\StartMenu.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2092
        • C:\Windows\SYSTEM32\attrib.exe
          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\StartMenu.exe"
          3⤵
          • Views/modifies file attributes
          PID:2892
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\StartMenu.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1168
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3924
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3376
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" os get Caption
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2684
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" computersystem get totalphysicalmemory
          3⤵
            PID:5012
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            3⤵
              PID:2516
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4588
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_VideoController get name
              3⤵
              • Detects videocard installed
              PID:2076
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\StartMenu.exe" && pause
              3⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:1484
              • C:\Windows\system32\PING.EXE
                ping localhost
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1880
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2708
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Blocklisted process makes network request
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2832
          • C:\Windows\System32\MsiExec.exe
            C:\Windows\System32\MsiExec.exe -Embedding 62818F3F2ACF08F0BD7E27638045BB96
            2⤵
            • Loads dropped DLL
            PID:2140
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding ED8456E0539D61F0282D3ED3252081A1
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2548
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 2E1B332D9AF6B1FEC1CC79AF3D1B8E01 E Global\MSI0000
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4104
            • C:\Windows\SysWOW64\wevtutil.exe
              "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1508
              • C:\Windows\System32\wevtutil.exe
                "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
                4⤵
                  PID:4636

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Privilege Escalation

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          1
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Config.Msi\e57a00c.rbs
            Filesize

            1.0MB

            MD5

            557a16f1f9ec7a268863651b17f620b6

            SHA1

            1364163090bcf4d01c5cae7d72d85962b6b41cd6

            SHA256

            aa06ab3c4c48602eb55a5e3ee3858df9783ece884fd1d007aa280e1f7f5439f1

            SHA512

            3a7b27c9570773df56a3901120b53efb2a3b9ffbd153a626c4c46c9ba8c90327d01546b42ad527eb7790e001b1089d3226f4319d108c8c5bee13a929f8b7f4bc

            Download Submit

          • C:\Program Files\nodejs\node_etw_provider.man
            Filesize

            10KB

            MD5

            1d51e18a7247f47245b0751f16119498

            SHA1

            78f5d95dd07c0fcee43c6d4feab12d802d194d95

            SHA256

            1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

            SHA512

            1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

            Download Submit

          • C:\Program Files\nodejs\node_etw_provider.man
            Filesize

            8KB

            MD5

            d3bc164e23e694c644e0b1ce3e3f9910

            SHA1

            1849f8b1326111b5d4d93febc2bafb3856e601bb

            SHA256

            1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

            SHA512

            91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md
            Filesize

            818B

            MD5

            2916d8b51a5cc0a350d64389bc07aef6

            SHA1

            c9d5ac416c1dd7945651bee712dbed4d158d09e1

            SHA256

            733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

            SHA512

            508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license
            Filesize

            1KB

            MD5

            5ad87d95c13094fa67f25442ff521efd

            SHA1

            01f1438a98e1b796e05a74131e6bb9d66c9e8542

            SHA256

            67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

            SHA512

            7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
            Filesize

            754B

            MD5

            d2cf52aa43e18fdc87562d4c1303f46a

            SHA1

            58fb4a65fffb438630351e7cafd322579817e5e1

            SHA256

            45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

            SHA512

            54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md
            Filesize

            771B

            MD5

            e9dc66f98e5f7ff720bf603fff36ebc5

            SHA1

            f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

            SHA256

            b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

            SHA512

            8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE
            Filesize

            730B

            MD5

            072ac9ab0c4667f8f876becedfe10ee0

            SHA1

            0227492dcdc7fb8de1d14f9d3421c333230cf8fe

            SHA256

            2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

            SHA512

            f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
            Filesize

            1KB

            MD5

            d116a360376e31950428ed26eae9ffd4

            SHA1

            192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

            SHA256

            c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

            SHA512

            5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
            Filesize

            802B

            MD5

            d7c8fab641cd22d2cd30d2999cc77040

            SHA1

            d293601583b1454ad5415260e4378217d569538e

            SHA256

            04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

            SHA512

            278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
            Filesize

            16KB

            MD5

            bc0c0eeede037aa152345ab1f9774e92

            SHA1

            56e0f71900f0ef8294e46757ec14c0c11ed31d4e

            SHA256

            7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

            SHA512

            5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE
            Filesize

            780B

            MD5

            b020de8f88eacc104c21d6e6cacc636d

            SHA1

            20b35e641e3a5ea25f012e13d69fab37e3d68d6b

            SHA256

            3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

            SHA512

            4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
            Filesize

            763B

            MD5

            7428aa9f83c500c4a434f8848ee23851

            SHA1

            166b3e1c1b7d7cb7b070108876492529f546219f

            SHA256

            1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

            SHA512

            c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
            Filesize

            4KB

            MD5

            f0bd53316e08991d94586331f9c11d97

            SHA1

            f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

            SHA256

            dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

            SHA512

            fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

            Download Submit

          • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE
            Filesize

            771B

            MD5

            1d7c74bcd1904d125f6aff37749dc069

            SHA1

            21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

            SHA256

            24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

            SHA512

            b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

            Download Submit

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
            Filesize

            133B

            MD5

            35b86e177ab52108bd9fed7425a9e34a

            SHA1

            76a1f47a10e3ab829f676838147875d75022c70c

            SHA256

            afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

            SHA512

            3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            627073ee3ca9676911bee35548eff2b8

            SHA1

            4c4b68c65e2cab9864b51167d710aa29ebdcff2e

            SHA256

            85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

            SHA512

            3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            0ac871344dc49ae49f13f0f88acb4868

            SHA1

            5a073862375c7e79255bb0eab32c635b57a77f98

            SHA256

            688f15b59a784f6f4c62554f00b5d0840d1489cef989c18126c70dfee0806d37

            SHA512

            ace5c50303bd27998607cf34ac4322bcf5edfbd19bbb24309acf4d037b6f3f7636c7c14b6ac0b924114e036252d3a1b998951c7068f41548728fa5d92f5f9006

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            1KB

            MD5

            5ea3327eacf4267694da8db0a3e1ae01

            SHA1

            81331a00784b84e045225ba8f90247933e1a6fa0

            SHA256

            65ab24a37883a340cad2c240fbb5b76c48de5a76b60759fb223e353854f678b5

            SHA512

            6c90e220d6fa68b0db76f5f890d19264e56139c7eb280caf14d865c18d7cbf08f41fdf155f9ae09c16bab21bec69106ad19ebf94018f6bac8403e8803cd4d24a

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            6f7e58dc0324e88a9ceea590312af7ab

            SHA1

            1683c95765361e5bc375a62153e9008ded5453b2

            SHA256

            ef5f02185be53e56a10aa767a3d3d5ff4a6525a86ef70c48ecbfeb7d642adbc1

            SHA512

            cf06dd98fabea89b8e3dfb62115a933fdc8a4a56f53e80d7d51791bbc65a0c67f05e9ab36e13247b331eae8ebc2d8100892569aae61a7268c45dfb83059dd4bb

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            944B

            MD5

            1a9fa92a4f2e2ec9e244d43a6a4f8fb9

            SHA1

            9910190edfaccece1dfcc1d92e357772f5dae8f7

            SHA256

            0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

            SHA512

            5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            948B

            MD5

            441a842138038e6385e430a90d7ea608

            SHA1

            7b3712d2cdd37e10ee9b3994131ee5175e920f01

            SHA256

            47592f3324179912d3bdba336b9e75568c2c5f1a9fb37c1ba9f0db9df822164c

            SHA512

            9dbddc3216f2a132ae3961b3aeac2c5b8828dcc9292f6c5bf1171c47453aa8687f92658818d771413492c0ea565e9ede17b9c03e427af9dc2ac21a78369a6666

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Bootstrapper-1.exe
            Filesize

            796KB

            MD5

            4b94b989b0fe7bec6311153b309dfe81

            SHA1

            bb50a4bb8a66f0105c5b74f32cd114c672010b22

            SHA256

            7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

            SHA512

            fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Defender_Settings.vbs
            Filesize

            313B

            MD5

            b0bf0a477bcca312021177572311e666

            SHA1

            ea77332d7779938ae8e92ad35d6dea4f4be37a92

            SHA256

            af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9

            SHA512

            09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Solara.exe
            Filesize

            84KB

            MD5

            32d66fa285a7675247940a88a3e769a7

            SHA1

            e84adbd91dfeb480cd694e41fbef4beeadfe30ef

            SHA256

            36cd4e911af166e6b3e72a5fd957c99779cdcd8a86aa5a38788302f02a94dce1

            SHA512

            15f66dbc0595ca36931860ca769d75f7f56226eeed137a3451d491b3eb8d52850bbff2cd5c7729a5f529850ce4c3cd133958d94bb88a142d4455e1e65ff73453

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\StartMenu.exe
            Filesize

            229KB

            MD5

            46dada61944a20f74ebc3723450a414a

            SHA1

            0ebfb78421ec8d8e84c4edb14dc9c493d83be78d

            SHA256

            25c60664ed6534d445c98ae922ad708410f7546a059dd31a38086097c236494c

            SHA512

            aa40fa81013bb6e9df2e1e0b9c3b06b7afbf85dbb77eaf58ffa8694358a35ee703ffbe761f3241a5df244ce95c9c2d223f101b136c3ba50bc8893e48177550af

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_voa0opm3.2r4.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
            Filesize

            30.1MB

            MD5

            0e4e9aa41d24221b29b19ba96c1a64d0

            SHA1

            231ade3d5a586c0eb4441c8dbfe9007dc26b2872

            SHA256

            5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

            SHA512

            e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

            Download Submit

          • C:\Windows\Installer\MSIA5E5.tmp
            Filesize

            122KB

            MD5

            9fe9b0ecaea0324ad99036a91db03ebb

            SHA1

            144068c64ec06fc08eadfcca0a014a44b95bb908

            SHA256

            e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

            SHA512

            906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

            Download Submit

          • C:\Windows\Installer\MSIA635.tmp
            Filesize

            211KB

            MD5

            a3ae5d86ecf38db9427359ea37a5f646

            SHA1

            eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

            SHA256

            c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

            SHA512

            96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

            Download Submit

          • C:\Windows\Installer\MSIB337.tmp
            Filesize

            297KB

            MD5

            7a86ce1a899262dd3c1df656bff3fb2c

            SHA1

            33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

            SHA256

            b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

            SHA512

            421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

            Download Submit

          • memory/756-45-0x0000025587EA0000-0x0000025587F6E000-memory.dmp

            Filesize

            824KB

            Download

          • memory/940-41-0x00000000002A0000-0x00000000002BC000-memory.dmp

            Filesize

            112KB

            Download

          • memory/940-42-0x00007FFCED9D0000-0x00007FFCEE492000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/940-141-0x00007FFCED9D0000-0x00007FFCEE492000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1168-54-0x00000226473B0000-0x00000226473D2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2180-73-0x0000017198470000-0x000001719848E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/2180-71-0x00000171B0E50000-0x00000171B0EC6000-memory.dmp

            Filesize

            472KB

            Download

          • memory/2180-72-0x00000171B0CC0000-0x00000171B0D10000-memory.dmp

            Filesize

            320KB

            Download

          • memory/2180-108-0x00000171B0ED0000-0x00000171B0EE2000-memory.dmp

            Filesize

            72KB

            Download

          • memory/2180-107-0x00000171B0D10000-0x00000171B0D1A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2180-40-0x0000017196650000-0x0000017196690000-memory.dmp

            Filesize

            256KB

            Download

          • memory/3016-0-0x00007FFCED9D3000-0x00007FFCED9D5000-memory.dmp

            Filesize

            8KB

            Download

          • memory/3016-43-0x00007FFCED9D0000-0x00007FFCEE492000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3016-5-0x00007FFCED9D0000-0x00007FFCEE492000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3016-1-0x0000000000E30000-0x0000000000EA2000-memory.dmp

            Filesize

            456KB

            Download