lumma | 5aa9d099dfc103dc52a33655e57845c6084b5d6bfab65abf4f3daea9911c613a

Analysis

max time kernel
315s
max time network
882s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/09/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper_1725724037599_1sly5.exe
Size

146KB
MD5

bc832d4fef741681578a87eb5d95b292
SHA1

75a89d287b15af8c6b8bcd9fa7887badc1850c5d
SHA256

5aa9d099dfc103dc52a33655e57845c6084b5d6bfab65abf4f3daea9911c613a
SHA512

270298becb80e7398ee608c780185caa6cfe1b48319c87302efd1fbc17f73f5acf9926295420e3dc8caeaa6e80f57db235e0d9adc2e37dda674d6d85c01be4f8
SSDEEP

3072:8PCyYwC+M2FEv80IZOA/CyYwC+M2FEv80IZOAU80IZOA4:ghY7X2Kvh4hY7X2Kvhvh

Score

10^/10

lumma discovery execution stealer

Malware Config

Extracted

Family

lumma

https://chocolatedwq.shop/api

https://condedqpwqm.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	200	2076	powershell.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	164	2076	powershell.exe	74
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	2076	powershell.exe	74

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
200	powershell.exe
164	powershell.exe
4240	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
2400	soles.exe
1892	soles.tmp
4964	soles.exe
2996	soles.tmp
2900	AutoIt3.exe
2796	AutoIt3.exe
4384	BootstrapperV1.16.exe

Loads dropped DLL 2 IoCs

pid	Process
1892	soles.tmp
2996	soles.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com
21	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
4920	tasklist.exe
5060	tasklist.exe
3192	tasklist.exe
4236	tasklist.exe
3604	tasklist.exe
5084	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 3648	2796	AutoIt3.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1108	3648	WerFault.exe	116
2096	3648	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper_1725724037599_1sly5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soles.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soles.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4196	cmd.exe
4268	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4268	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
200	powershell.exe
164	powershell.exe
4240	powershell.exe
164	powershell.exe
164	powershell.exe
200	powershell.exe
4240	powershell.exe
4240	powershell.exe
200	powershell.exe
2996	soles.tmp
2996	soles.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	200	powershell.exe
Token: SeDebugPrivilege	164	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeIncreaseQuotaPrivilege	4240	powershell.exe
Token: SeSecurityPrivilege	4240	powershell.exe
Token: SeTakeOwnershipPrivilege	4240	powershell.exe
Token: SeLoadDriverPrivilege	4240	powershell.exe
Token: SeSystemProfilePrivilege	4240	powershell.exe
Token: SeSystemtimePrivilege	4240	powershell.exe
Token: SeProfSingleProcessPrivilege	4240	powershell.exe
Token: SeIncBasePriorityPrivilege	4240	powershell.exe
Token: SeCreatePagefilePrivilege	4240	powershell.exe
Token: SeBackupPrivilege	4240	powershell.exe
Token: SeRestorePrivilege	4240	powershell.exe
Token: SeShutdownPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeSystemEnvironmentPrivilege	4240	powershell.exe
Token: SeRemoteShutdownPrivilege	4240	powershell.exe
Token: SeUndockPrivilege	4240	powershell.exe
Token: SeManageVolumePrivilege	4240	powershell.exe
Token: 33	4240	powershell.exe
Token: 34	4240	powershell.exe
Token: 35	4240	powershell.exe
Token: 36	4240	powershell.exe
Token: SeIncreaseQuotaPrivilege	164	powershell.exe
Token: SeSecurityPrivilege	164	powershell.exe
Token: SeTakeOwnershipPrivilege	164	powershell.exe
Token: SeLoadDriverPrivilege	164	powershell.exe
Token: SeSystemProfilePrivilege	164	powershell.exe
Token: SeSystemtimePrivilege	164	powershell.exe
Token: SeProfSingleProcessPrivilege	164	powershell.exe
Token: SeIncBasePriorityPrivilege	164	powershell.exe
Token: SeCreatePagefilePrivilege	164	powershell.exe
Token: SeBackupPrivilege	164	powershell.exe
Token: SeRestorePrivilege	164	powershell.exe
Token: SeShutdownPrivilege	164	powershell.exe
Token: SeDebugPrivilege	164	powershell.exe
Token: SeSystemEnvironmentPrivilege	164	powershell.exe
Token: SeRemoteShutdownPrivilege	164	powershell.exe
Token: SeUndockPrivilege	164	powershell.exe
Token: SeManageVolumePrivilege	164	powershell.exe
Token: 33	164	powershell.exe
Token: 34	164	powershell.exe
Token: 35	164	powershell.exe
Token: 36	164	powershell.exe
Token: SeIncreaseQuotaPrivilege	200	powershell.exe
Token: SeSecurityPrivilege	200	powershell.exe
Token: SeTakeOwnershipPrivilege	200	powershell.exe
Token: SeLoadDriverPrivilege	200	powershell.exe
Token: SeSystemProfilePrivilege	200	powershell.exe
Token: SeSystemtimePrivilege	200	powershell.exe
Token: SeProfSingleProcessPrivilege	200	powershell.exe
Token: SeIncBasePriorityPrivilege	200	powershell.exe
Token: SeCreatePagefilePrivilege	200	powershell.exe
Token: SeBackupPrivilege	200	powershell.exe
Token: SeRestorePrivilege	200	powershell.exe
Token: SeShutdownPrivilege	200	powershell.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeSystemEnvironmentPrivilege	200	powershell.exe
Token: SeRemoteShutdownPrivilege	200	powershell.exe
Token: SeUndockPrivilege	200	powershell.exe
Token: SeManageVolumePrivilege	200	powershell.exe
Token: 33	200	powershell.exe
Token: 34	200	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2996	soles.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2400	3660	Bootstrapper_1725724037599_1sly5.exe	82
PID 3660 wrote to memory of 2400	3660	Bootstrapper_1725724037599_1sly5.exe	82
PID 3660 wrote to memory of 2400	3660	Bootstrapper_1725724037599_1sly5.exe	82
PID 2400 wrote to memory of 1892	2400	soles.exe	83
PID 2400 wrote to memory of 1892	2400	soles.exe	83
PID 2400 wrote to memory of 1892	2400	soles.exe	83
PID 1892 wrote to memory of 4964	1892	soles.tmp	84
PID 1892 wrote to memory of 4964	1892	soles.tmp	84
PID 1892 wrote to memory of 4964	1892	soles.tmp	84
PID 4964 wrote to memory of 2996	4964	soles.exe	85
PID 4964 wrote to memory of 2996	4964	soles.exe	85
PID 4964 wrote to memory of 2996	4964	soles.exe	85
PID 2996 wrote to memory of 1680	2996	soles.tmp	86
PID 2996 wrote to memory of 1680	2996	soles.tmp	86
PID 1680 wrote to memory of 3604	1680	cmd.exe	88
PID 1680 wrote to memory of 3604	1680	cmd.exe	88
PID 1680 wrote to memory of 2312	1680	cmd.exe	89
PID 1680 wrote to memory of 2312	1680	cmd.exe	89
PID 2996 wrote to memory of 2340	2996	soles.tmp	90
PID 2996 wrote to memory of 2340	2996	soles.tmp	90
PID 2340 wrote to memory of 5084	2340	cmd.exe	92
PID 2340 wrote to memory of 5084	2340	cmd.exe	92
PID 2340 wrote to memory of 2256	2340	cmd.exe	93
PID 2340 wrote to memory of 2256	2340	cmd.exe	93
PID 2996 wrote to memory of 2652	2996	soles.tmp	94
PID 2996 wrote to memory of 2652	2996	soles.tmp	94
PID 2652 wrote to memory of 4920	2652	cmd.exe	96
PID 2652 wrote to memory of 4920	2652	cmd.exe	96
PID 2652 wrote to memory of 3672	2652	cmd.exe	97
PID 2652 wrote to memory of 3672	2652	cmd.exe	97
PID 2996 wrote to memory of 1464	2996	soles.tmp	98
PID 2996 wrote to memory of 1464	2996	soles.tmp	98
PID 1464 wrote to memory of 5060	1464	cmd.exe	100
PID 1464 wrote to memory of 5060	1464	cmd.exe	100
PID 1464 wrote to memory of 648	1464	cmd.exe	101
PID 1464 wrote to memory of 648	1464	cmd.exe	101
PID 2996 wrote to memory of 4164	2996	soles.tmp	102
PID 2996 wrote to memory of 4164	2996	soles.tmp	102
PID 4164 wrote to memory of 3192	4164	cmd.exe	104
PID 4164 wrote to memory of 3192	4164	cmd.exe	104
PID 4164 wrote to memory of 4644	4164	cmd.exe	105
PID 4164 wrote to memory of 4644	4164	cmd.exe	105
PID 2996 wrote to memory of 3184	2996	soles.tmp	106
PID 2996 wrote to memory of 3184	2996	soles.tmp	106
PID 3184 wrote to memory of 4236	3184	cmd.exe	108
PID 3184 wrote to memory of 4236	3184	cmd.exe	108
PID 3184 wrote to memory of 2576	3184	cmd.exe	109
PID 3184 wrote to memory of 2576	3184	cmd.exe	109
PID 2996 wrote to memory of 2900	2996	soles.tmp	110
PID 2996 wrote to memory of 2900	2996	soles.tmp	110
PID 2996 wrote to memory of 2900	2996	soles.tmp	110
PID 2900 wrote to memory of 4196	2900	AutoIt3.exe	111
PID 2900 wrote to memory of 4196	2900	AutoIt3.exe	111
PID 2900 wrote to memory of 4196	2900	AutoIt3.exe	111
PID 4196 wrote to memory of 4268	4196	cmd.exe	113
PID 4196 wrote to memory of 4268	4196	cmd.exe	113
PID 4196 wrote to memory of 4268	4196	cmd.exe	113
PID 4196 wrote to memory of 2796	4196	cmd.exe	114
PID 4196 wrote to memory of 2796	4196	cmd.exe	114
PID 4196 wrote to memory of 2796	4196	cmd.exe	114
PID 2796 wrote to memory of 2488	2796	AutoIt3.exe	115
PID 2796 wrote to memory of 2488	2796	AutoIt3.exe	115
PID 2796 wrote to memory of 2488	2796	AutoIt3.exe	115
PID 2796 wrote to memory of 3648	2796	AutoIt3.exe	116

C:\Users\Admin\AppData\Local\Temp\Bootstrapper_1725724037599_1sly5.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper_1725724037599_1sly5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Sola\soles.exe
  "C:\Sola\soles.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\is-RF4DE.tmp\soles.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-RF4DE.tmp\soles.tmp" /SL5="$9020C,10256339,804864,C:\Sola\soles.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Sola\soles.exe
      "C:\Sola\soles.exe" /VERYSILENT /NORESTART
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\is-4R7Q9.tmp\soles.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4R7Q9.tmp\soles.tmp" /SL5="$A020C,10256339,804864,C:\Sola\soles.exe" /VERYSILENT /NORESTART
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2996
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3604
        
        C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        7⤵
        
        PID:2312
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5084
        
        C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        7⤵
        
        PID:2256
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4920
        
        C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        7⤵
        
        PID:3672
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:5060
        
        C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        7⤵
        
        PID:648
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:3192
        
        C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        7⤵
        
        PID:4644
      - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        7⤵
        Enumerates processes with tasklist
        
        PID:4236
        
        C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        7⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\nuclear\AutoIt3.exe
        
        "C:\Users\Admin\AppData\Local\nuclear\\AutoIt3.exe" "C:\Users\Admin\AppData\Local\nuclear\\braise.a3x"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && AutoIt3.exe C:\ProgramData\\kBvddF.a3x && del C:\ProgramData\\kBvddF.a3x
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\nuclear\AutoIt3.exe
        
        AutoIt3.exe C:\ProgramData\\kBvddF.a3x
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        9⤵
        
        PID:2488
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 1108
        10⤵
        Program crash
        
        PID:1108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 1076
        10⤵
        Program crash
        
        PID:2096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Sola'"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Users\Public\Desktop\BootstrapperV1.16.exe
"C:\Users\Public\Desktop\BootstrapperV1.16.exe"
1⤵
- Executes dropped EXE
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Sola\soles.exe

Filesize
10.7MB

MD5
6ae74315bdb5b5f757005d23967bcf73

SHA1
834c5b96f91e9349ae91ed4cd5cc8897f58a3fdb

SHA256
66397977e36190a9f7ca77e93bfceb8e731838e5ce824bcd22222339b007891d

SHA512
bf54808fd4ad33d0929868c90fc7b8cf0e9a9ab5c8507d9de676966143b8a9556dadd7ffd7365f3bbc7065ef98b0f75c78267558824df8bea4a358ef52973b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
764520cf3955cacaf41b3ae895722a3b

SHA1
f4e3184d4dd31ee9cfdd4fc601211a123f1d56eb

SHA256
293c219f770dfaaeae310ca4271896edcbb0c557b4dd2dd7f95859a9a3fa2a01

SHA512
9315de9a25d64f455e796694867304833ede0416769b6734feb1b9d712469f2f1b0a7587c9b2d294e66dfe514cb6057e916fb5e175c4c927c812926fcaeafadd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3fe20f5f8dcd6e42a7d1116d8b283364

SHA1
28c0d5beb83f9b168fb3ea54e5b7c2c2e9f2197f

SHA256
653457bfd3826191c6ffc6ad2bb413ac265effec16b33b7d07d381880da1b497

SHA512
de33af9e4166ac2cb9674eba4e2a182375d17717114a7fc44828ddf920b26036a77f710f2785a7496e75532d54b5ec221b5822eafda4a80ec2d9e10360938968

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfbgnh0n.epz.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RF4DE.tmp\soles.tmp

Filesize
3.1MB

MD5
92a8f182782b7676afc20be2333e7677

SHA1
82d7e177cb3e40add5d01b68f5ae13264afb2df8

SHA256
326db8668e61efa37036e9e7e6934b565e4d4af0454c9c3e6a9799191edabbbc

SHA512
afedb24077040b81ab761450d4bc1c680862c77291d5c5f9542e5c8cb52d3b0807d3bae02433c3362f88f8bcb5f84dd44d840546f24612e63f35204c2ae69716

Download Submit
C:\Users\Admin\AppData\Local\nuclear\AutoIt3.exe

Filesize
921KB

MD5
3f58a517f1f4796225137e7659ad2adb

SHA1
e264ba0e9987b0ad0812e5dd4dd3075531cfe269

SHA256
1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

SHA512
acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

Download Submit
C:\Users\Admin\AppData\Local\nuclear\braise.a3x

Filesize
60KB

MD5
8e1a70b54af4c2bcc655f944bb833453

SHA1
e3364c0bc8bc33dced566816061ce84ca06f0fb4

SHA256
8e7a44ea4294d797392441f86aa2090041040c83938ff585bec1f8ccb3b20b29

SHA512
f81c34bfd738d7d7ba04a35db243c24b2c980576a756d174ab916710ed06c3f2c09f1a92866d89a6985fd6c874fbb97091e4ab188452173e1e0ff60a1b2416e4

Download Submit
C:\Users\Admin\AppData\Local\nuclear\braise.adt

Filesize
476KB

MD5
10e368548939707ba299e05a5a285f7a

SHA1
0c190ced4b2746d72bed6240fc4414c4a0b22add

SHA256
14458c1c57a94145e00116826e6c60e0646a9b62799ecd966b81d957b25dfc90

SHA512
1cd819c5a83c7965a8998678ab6675673f881df5cfbe7b10b24b0963954d5e85da42e7507e6fdc1d6b68175063ba600a803a56e50e6aca4a949ede4059fdbcb8

Download Submit
C:\Users\Public\Desktop\BootstrapperV1.16.exe

Filesize
796KB

MD5
76639ab92661f5c384302899934051ab

SHA1
9b33828f8ad3a686ff02b1a4569b8ae38128caed

SHA256
6bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178

SHA512
928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee

Download Submit
\Users\Admin\AppData\Local\Temp\is-7S42F.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/164-21-0x00007FFAB45F0000-0x00007FFAB4FDC000-memory.dmp

Filesize
9.9MB

Download
memory/164-26-0x000002743D680000-0x000002743D6F6000-memory.dmp

Filesize
472KB

Download
memory/164-24-0x00007FFAB45F0000-0x00007FFAB4FDC000-memory.dmp

Filesize
9.9MB

Download
memory/164-141-0x00007FFAB45F0000-0x00007FFAB4FDC000-memory.dmp

Filesize
9.9MB

Download
memory/164-14-0x00007FFAB45F0000-0x00007FFAB4FDC000-memory.dmp

Filesize
9.9MB

Download
memory/200-27-0x00007FFAB45F0000-0x00007FFAB4FDC000-memory.dmp

Filesize
9.9MB

Download
memory/200-19-0x0000021A6FC80000-0x0000021A6FCA2000-memory.dmp

Filesize
136KB

Download
memory/200-145-0x00007FFAB45F0000-0x00007FFAB4FDC000-memory.dmp

Filesize
9.9MB

Download
memory/200-13-0x00007FFAB45F0000-0x00007FFAB4FDC000-memory.dmp

Filesize
9.9MB

Download
memory/200-7-0x00007FFAB45F3000-0x00007FFAB45F4000-memory.dmp

Filesize
4KB

Download
memory/1892-167-0x0000000001160000-0x0000000001492000-memory.dmp

Filesize
3.2MB

Download
memory/2400-169-0x0000000001300000-0x00000000013D2000-memory.dmp

Filesize
840KB

Download
memory/2400-151-0x0000000001300000-0x00000000013D2000-memory.dmp

Filesize
840KB

Download
memory/2996-326-0x0000000001290000-0x00000000015C2000-memory.dmp

Filesize
3.2MB

Download
memory/3648-335-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3648-337-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3648-336-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3660-22-0x000000000A5C0000-0x000000000A5F8000-memory.dmp

Filesize
224KB

Download
memory/3660-154-0x0000000073A00000-0x00000000740EE000-memory.dmp

Filesize
6.9MB

Download
memory/3660-146-0x0000000073A0E000-0x0000000073A0F000-memory.dmp

Filesize
4KB

Download
memory/3660-0-0x0000000073A0E000-0x0000000073A0F000-memory.dmp

Filesize
4KB

Download
memory/3660-20-0x0000000009710000-0x0000000009718000-memory.dmp

Filesize
32KB

Download
memory/3660-3-0x00000000050C0000-0x0000000005126000-memory.dmp

Filesize
408KB

Download
memory/3660-2-0x0000000073A00000-0x00000000740EE000-memory.dmp

Filesize
6.9MB

Download
memory/3660-340-0x0000000073A00000-0x00000000740EE000-memory.dmp

Filesize
6.9MB

Download
memory/3660-1-0x0000000000540000-0x000000000056A000-memory.dmp

Filesize
168KB

Download
memory/4384-343-0x00000298302A0000-0x000002983036E000-memory.dmp

Filesize
824KB

Download
memory/4964-165-0x0000000001300000-0x00000000013D2000-memory.dmp

Filesize
840KB

Download
memory/4964-328-0x0000000001300000-0x00000000013D2000-memory.dmp

Filesize
840KB

Download