Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 19:05

General

  • Target

    setup_x86_x64_install.exe

  • Size

    4.8MB

  • MD5

    af731b30910bac47cdd0974c662a490c

  • SHA1

    243d8250836f5c3f14c6ef41a2c627728ebde372

  • SHA256

    6df17c7749ef2051fe3e97d23958e277a4febcf48c0179a3ae2fff1b4038640f

  • SHA512

    3ff71df7b4bf790e5598ae5e2bacdb325b6458c1a7f7b97ed585279edf96890b1d97394a7618878448e7621cd068f344608d418181ad719bfa0922ff7a9ecaab

  • SSDEEP

    98304:yWN+wY/DEU5lsIopxgVcEn5tbb5CggBGyslZMwr4+Kc36gBo3rCWAb0WPIoR66L:yPwsDqpxgBn5t/4KXlZD4PGKhsJPIoEy

Malware Config

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

nullmixer

C2

http://sornx.xyz/

Extracted

Family

redline

Botnet

pub1

C2

viacetequn.site:80

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • Nullmixer family
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Privateloader family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Vidar Stealer 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 13 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 44 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4456
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4068
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon14585024febb5.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14585024febb5.exe
            Mon14585024febb5.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4024
            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14585024febb5.exe
              "C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14585024febb5.exe" -a
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4964
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon1469355885.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon1469355885.exe
            Mon1469355885.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            PID:2984
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 360
              6⤵
              • Program crash
              PID:2328
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon1467890ab07c10e.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3852
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon1467890ab07c10e.exe
            Mon1467890ab07c10e.exe
            5⤵
            • Executes dropped EXE
            PID:2316
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon14f40f9f7773345d.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14f40f9f7773345d.exe
            Mon14f40f9f7773345d.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2844
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1784
              6⤵
              • Program crash
              PID:4812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon14095335954ba1f.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14095335954ba1f.exe
            Mon14095335954ba1f.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3300
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon14365bf6c89d2abf.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14365bf6c89d2abf.exe
            Mon14365bf6c89d2abf.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2916
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon141f1ef356ba1.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:760
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon141f1ef356ba1.exe
            Mon141f1ef356ba1.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:824
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon14b0530bbd5cb.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14b0530bbd5cb.exe
            Mon14b0530bbd5cb.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1348
            • C:\Windows\SysWOW64\dllhost.exe
              dllhost.exe
              6⤵
                PID:4880
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c cmd < Mummia.wmz
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1440
                • C:\Windows\SysWOW64\cmd.exe
                  cmd
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4852
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /V /R "^utIhAQXzKFfZwKOfdWFWGYOHgvUbutPplngusOenUcoCKjfoSNGytadifqZtVmhGQyOCcHYBTuwlPjXeuMFabKtSouQdPYDxoCLEbNMlPtkXdusrrWXoUUouqWxgRHLUDGwhAaEzZcDzniBeO$" Pensavo.wmz
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3088
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com
                    Prendero.exe.com z
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:4872
                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com
                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com z
                      9⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:1736
                  • C:\Windows\SysWOW64\PING.EXE
                    ping GUMLNLFE -n 30
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:428
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Mon14541c639b30ce5.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3060
            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14541c639b30ce5.exe
              Mon14541c639b30ce5.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2984 -ip 2984
      1⤵
        PID:5108
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2844 -ip 2844
        1⤵
          PID:3336
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          1⤵
          • Checks SCSI registry key(s)
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:2716
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          1⤵
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:4484
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2460
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          1⤵
            PID:3748
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1136
            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
              1⤵
              • Modifies data under HKEY_USERS
              PID:1396

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14095335954ba1f.exe

              Filesize

              248KB

              MD5

              d23c06e25b4bd295e821274472263572

              SHA1

              9ad295ec3853dc465ae77f9479f8c4f76e2748b8

              SHA256

              f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c

              SHA512

              122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon141f1ef356ba1.exe

              Filesize

              192KB

              MD5

              ea5d2a70de26a3f2ce92d1b02b2f3052

              SHA1

              66045b40d6aebc6a2930c76c6d492fb5fc81426f

              SHA256

              7abf7953b1532eec5dd50fb9098269a8cd7b65e9afc9d84031039ff9da63f909

              SHA512

              1437877ea36bf59eb74eef0415f820507fa55bb07b17b59679454e02a99bf48884bfdd0706175a168a005ce9a672b0fbdc904da7a35242402567f06bf22d322b

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14365bf6c89d2abf.exe

              Filesize

              1.5MB

              MD5

              df80b76857b74ae1b2ada8efb2a730ee

              SHA1

              5653be57533c6eb058fed4963a25a676488ef832

              SHA256

              5545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd

              SHA512

              060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14541c639b30ce5.exe

              Filesize

              8KB

              MD5

              408f2c9252ad66429a8d5401f1833db3

              SHA1

              3829d2d03a728ecd59b38cc189525220a60c05db

              SHA256

              890db580fac738971bc7c714735ff6f1f2ee31edccd7881044da3e98452af664

              SHA512

              d4c89dfd928023b9f4380808b27e032342d2a85963b95bbed3191cc03b455dbc6f5ffecf29828a53b1d9011b3881f1cda9d15d269a2cbcbd4be5c993bcd9643b

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14585024febb5.exe

              Filesize

              56KB

              MD5

              3263859df4866bf393d46f06f331a08f

              SHA1

              5b4665de13c9727a502f4d11afb800b075929d6c

              SHA256

              9dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2

              SHA512

              58205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon1467890ab07c10e.exe

              Filesize

              900KB

              MD5

              0a0d22f1c9179a67d04166de0db02dbb

              SHA1

              106e55bd898b5574f9bd33dac9f3c0b95cecd90d

              SHA256

              a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac

              SHA512

              8abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon1469355885.exe

              Filesize

              272KB

              MD5

              fa37623638231d4c2b671b04a021a984

              SHA1

              7a446ffddc37e4a6dafd3f45d3d7c34c26885ce6

              SHA256

              26a9fde966bc459d278a1ce94d59cb95b1a152efb217164ca62fc15a15c68fbe

              SHA512

              730ba1cc1d9febba94572669a424695c06f03ac478255a61202f68eab45d8cdc60b0c341c005fc0b48b9f2048c7ebdfeaec8e28cf8b040be345790c930f6588b

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14b0530bbd5cb.exe

              Filesize

              1.3MB

              MD5

              12b8842dded9134ad0cae031c4f06530

              SHA1

              c0ecd0ac8cf3e4851661f62fe283ecec0e6ca25e

              SHA256

              abd87ec324df8d74245e1671f21e832b563eb8dc3c13b1688a9e85a2f809fe17

              SHA512

              967d70105549641beaa3283c42143aac22e016c911f99ab1c7ef5b4eff2577790fc679a74af6d2df14e87c278762e2c39c96bbdeabeaa1b62fb9072f0baa1825

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14f40f9f7773345d.exe

              Filesize

              609KB

              MD5

              3b2ca1aae0f3a277efde19ed66785e07

              SHA1

              edfd0bb11c0baec2475149259c8a88a61a669de9

              SHA256

              c65369fd8f5f8a6bcee8325879e912f7f5e5f37e40281077a4902668458887b1

              SHA512

              191aa807ec2c9a663eef6439084fcc68cdba245d9924773d65f42286af1df31238931425de1c18a4b643c7cd9ac4e98e638994630af440b7a1556c1497c8bb25

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\libcurl.dll

              Filesize

              218KB

              MD5

              d09be1f47fd6b827c81a4812b4f7296f

              SHA1

              028ae3596c0790e6d7f9f2f3c8e9591527d267f7

              SHA256

              0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

              SHA512

              857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\libcurlpp.dll

              Filesize

              54KB

              MD5

              e6e578373c2e416289a8da55f1dc5e8e

              SHA1

              b601a229b66ec3d19c2369b36216c6f6eb1c063e

              SHA256

              43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

              SHA512

              9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\libgcc_s_dw2-1.dll

              Filesize

              113KB

              MD5

              9aec524b616618b0d3d00b27b6f51da1

              SHA1

              64264300801a353db324d11738ffed876550e1d3

              SHA256

              59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

              SHA512

              0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\libstdc++-6.dll

              Filesize

              647KB

              MD5

              5e279950775baae5fea04d2cc4526bcc

              SHA1

              8aef1e10031c3629512c43dd8b0b5d9060878453

              SHA256

              97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

              SHA512

              666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\libwinpthread-1.dll

              Filesize

              69KB

              MD5

              1e0d62c34ff2e649ebc5c372065732ee

              SHA1

              fcfaa36ba456159b26140a43e80fbd7e9d9af2de

              SHA256

              509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

              SHA512

              3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

            • C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\setup_install.exe

              Filesize

              2.1MB

              MD5

              febbfc26db3b9b63c26a253d83685c61

              SHA1

              96efbac726821400049db0a1508566e0bce7ce1a

              SHA256

              76b67dbf3cdf622e3266419e7acbbf9d7e3e22c1a3ef5eceec90ebda296b65ff

              SHA512

              f14bf151bf40064f3ef9bee9671c7f5f3689a17bbfaa9319394f8b7178c82fdb29a133f48c8d0ad3ae89b63733667ff695d762dc031659a01714d823320b556c

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Copia.wmz

              Filesize

              4.3MB

              MD5

              a1ac3489d2401d26e3aea9bcb0a85b10

              SHA1

              6a4c4004ef746ed16d25c3fe425a6c78fcefe9b4

              SHA256

              1cb9452373f7b755b1c64b41bd7ffcfe4fe0ab92fd08c61c283c5deccfd89146

              SHA512

              293a84faadb89219945fde5836786cbcf4bdcaf36638603a5e95e80df4f5daf0b180d1f768deecee77b828ef736a337925479c37ae1e1f7126934f80be7b5e2e

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mummia.wmz

              Filesize

              576B

              MD5

              6f6fe96279c933c2170e75f49cf43718

              SHA1

              bbe211eaebbeb120b9ca3cd204aacbbeef20cb7e

              SHA256

              e6919da4e2658c82ebbcca670053d77e1231a5a600bf5aeaba71e5852e09022f

              SHA512

              76160b79d3cbe2fca6d95b096043641a96b13007f287f8e55b94eab16cbb98691a8e8fa8d035da434e84f689bb8d36478f632976481b56c7170889553a629748

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pensavo.wmz

              Filesize

              872KB

              MD5

              3928f9cc043cfb53823761dac703fd04

              SHA1

              c825e75ae21b995996763487de07176230c2535e

              SHA256

              c2d4ebb0b7be8eb8683cc1fdcd0b95c834888c56d555e6d23497ae211835f412

              SHA512

              8739619195c9d1409819822ae3c53415ac57a1c485b6947022d81981c9a0c7811ea5a30af0ef32e0a34aacf589f74366866dc1e7e03cd4addf56b71b6b25d9c5

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com

              Filesize

              872KB

              MD5

              c56b5f0201a3b3de53e561fe76912bfd

              SHA1

              2a4062e10a5de813f5688221dbeb3f3ff33eb417

              SHA256

              237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

              SHA512

              195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e0jhmppm.guv.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

              Filesize

              4.8MB

              MD5

              ec02f21e9609989b9dc71c981be1b38d

              SHA1

              b06e15ef538626113b9a5cfbe70cb31480f2ca65

              SHA256

              ffb56fbf4fcddd75123912dc66dab62c57bb790bb3f66fbff5f247760755fd06

              SHA512

              20d8b49e3b770c92d084b319c6c1f0e4e643b42f0e9cb8b5d117344abce63607b30cbcdfb391ce7a82cf03aa0f4c20c419129d5394ecea4f40ed495bd3dbbd46

            • memory/824-113-0x0000000001520000-0x0000000001544000-memory.dmp

              Filesize

              144KB

            • memory/824-100-0x00000000014F0000-0x00000000014F6000-memory.dmp

              Filesize

              24KB

            • memory/824-114-0x0000000001500000-0x0000000001506000-memory.dmp

              Filesize

              24KB

            • memory/824-98-0x0000000000D10000-0x0000000000D46000-memory.dmp

              Filesize

              216KB

            • memory/1348-201-0x00007FF8EE890000-0x00007FF8EEA85000-memory.dmp

              Filesize

              2.0MB

            • memory/2844-191-0x0000000000400000-0x0000000002402000-memory.dmp

              Filesize

              32.0MB

            • memory/2984-137-0x0000000000400000-0x00000000023AE000-memory.dmp

              Filesize

              31.7MB

            • memory/3300-167-0x00000000080D0000-0x00000000081DA000-memory.dmp

              Filesize

              1.0MB

            • memory/3300-157-0x00000000073E0000-0x0000000007984000-memory.dmp

              Filesize

              5.6MB

            • memory/3300-158-0x0000000007220000-0x0000000007240000-memory.dmp

              Filesize

              128KB

            • memory/3300-156-0x00000000049E0000-0x0000000004A02000-memory.dmp

              Filesize

              136KB

            • memory/3300-160-0x0000000007990000-0x0000000007FA8000-memory.dmp

              Filesize

              6.1MB

            • memory/3300-164-0x00000000072E0000-0x00000000072F2000-memory.dmp

              Filesize

              72KB

            • memory/3300-166-0x0000000007300000-0x000000000733C000-memory.dmp

              Filesize

              240KB

            • memory/3624-197-0x0000000000640000-0x000000000069A000-memory.dmp

              Filesize

              360KB

            • memory/3716-109-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/3716-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/3716-70-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/3716-69-0x0000000064941000-0x000000006494F000-memory.dmp

              Filesize

              56KB

            • memory/3716-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/3716-66-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/3716-65-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/3716-64-0x00000000007E0000-0x000000000086F000-memory.dmp

              Filesize

              572KB

            • memory/3716-63-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/3716-62-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/3716-75-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/3716-102-0x0000000000400000-0x000000000051B000-memory.dmp

              Filesize

              1.1MB

            • memory/3716-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/3716-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/3716-67-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/3716-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/3716-76-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/3716-107-0x000000006EB40000-0x000000006EB63000-memory.dmp

              Filesize

              140KB

            • memory/3716-110-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/3716-112-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/3716-111-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/3848-93-0x0000000000770000-0x0000000000778000-memory.dmp

              Filesize

              32KB

            • memory/3848-204-0x00007FF8EC2B0000-0x00007FF8EC333000-memory.dmp

              Filesize

              524KB

            • memory/3852-196-0x0000000000640000-0x000000000069A000-memory.dmp

              Filesize

              360KB

            • memory/4068-155-0x0000000007400000-0x000000000740A000-memory.dmp

              Filesize

              40KB

            • memory/4068-174-0x00000000076B0000-0x00000000076CA000-memory.dmp

              Filesize

              104KB

            • memory/4068-123-0x00000000059D0000-0x00000000059F2000-memory.dmp

              Filesize

              136KB

            • memory/4068-159-0x00000000075F0000-0x0000000007686000-memory.dmp

              Filesize

              600KB

            • memory/4068-133-0x0000000005C90000-0x0000000005FE4000-memory.dmp

              Filesize

              3.3MB

            • memory/4068-154-0x0000000007390000-0x00000000073AA000-memory.dmp

              Filesize

              104KB

            • memory/4068-163-0x0000000007580000-0x0000000007591000-memory.dmp

              Filesize

              68KB

            • memory/4068-153-0x0000000007A10000-0x000000000808A000-memory.dmp

              Filesize

              6.5MB

            • memory/4068-152-0x00000000070E0000-0x0000000007183000-memory.dmp

              Filesize

              652KB

            • memory/4068-171-0x00000000075B0000-0x00000000075BE000-memory.dmp

              Filesize

              56KB

            • memory/4068-172-0x00000000075C0000-0x00000000075D4000-memory.dmp

              Filesize

              80KB

            • memory/4068-128-0x0000000005B60000-0x0000000005BC6000-memory.dmp

              Filesize

              408KB

            • memory/4068-175-0x00000000076A0000-0x00000000076A8000-memory.dmp

              Filesize

              32KB

            • memory/4068-151-0x00000000065F0000-0x000000000660E000-memory.dmp

              Filesize

              120KB

            • memory/4068-101-0x0000000005120000-0x0000000005748000-memory.dmp

              Filesize

              6.2MB

            • memory/4068-99-0x0000000004AB0000-0x0000000004AE6000-memory.dmp

              Filesize

              216KB

            • memory/4068-140-0x0000000007010000-0x0000000007042000-memory.dmp

              Filesize

              200KB

            • memory/4068-141-0x000000006FA40000-0x000000006FA8C000-memory.dmp

              Filesize

              304KB

            • memory/4068-127-0x0000000005A80000-0x0000000005AE6000-memory.dmp

              Filesize

              408KB

            • memory/4068-136-0x0000000006080000-0x00000000060CC000-memory.dmp

              Filesize

              304KB

            • memory/4068-135-0x0000000006060000-0x000000000607E000-memory.dmp

              Filesize

              120KB

            • memory/4852-202-0x0000000000640000-0x000000000069A000-memory.dmp

              Filesize

              360KB