Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-11-2024 19:05

General

  • Target

    setup_installer.exe

  • Size

    4.8MB

  • MD5

    ec02f21e9609989b9dc71c981be1b38d

  • SHA1

    b06e15ef538626113b9a5cfbe70cb31480f2ca65

  • SHA256

    ffb56fbf4fcddd75123912dc66dab62c57bb790bb3f66fbff5f247760755fd06

  • SHA512

    20d8b49e3b770c92d084b319c6c1f0e4e643b42f0e9cb8b5d117344abce63607b30cbcdfb391ce7a82cf03aa0f4c20c419129d5394ecea4f40ed495bd3dbbd46

  • SSDEEP

    98304:xyCvLUBsgTFOLElweJs9kAo4K25044DU6GxctGSswIm5W8Nneh:xDLUCgROol6kU0TGW3Leh

Malware Config

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

nullmixer

C2

http://sornx.xyz/

Extracted

Family

redline

Botnet

pub1

C2

viacetequn.site:80

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 3 IoCs
  • Cryptbot family
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • Nullmixer family
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Privateloader family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Vidar Stealer 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1768
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon14585024febb5.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14585024febb5.exe
          Mon14585024febb5.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1912
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14585024febb5.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14585024febb5.exe" -a
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3616
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon1469355885.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4152
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon1469355885.exe
          Mon1469355885.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          PID:2136
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 360
            5⤵
            • Program crash
            PID:3680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon1467890ab07c10e.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3096
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon1467890ab07c10e.exe
          Mon1467890ab07c10e.exe
          4⤵
          • Executes dropped EXE
          PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon14f40f9f7773345d.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2224
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14f40f9f7773345d.exe
          Mon14f40f9f7773345d.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3000
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1028
            5⤵
            • Program crash
            PID:2976
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon14095335954ba1f.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14095335954ba1f.exe
          Mon14095335954ba1f.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1384
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon14365bf6c89d2abf.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14365bf6c89d2abf.exe
          Mon14365bf6c89d2abf.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1388
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon141f1ef356ba1.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3900
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon141f1ef356ba1.exe
          Mon141f1ef356ba1.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2516
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Mon14b0530bbd5cb.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14b0530bbd5cb.exe
          Mon14b0530bbd5cb.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3608
          • C:\Windows\SysWOW64\dllhost.exe
            dllhost.exe
            5⤵
              PID:4300
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c cmd < Mummia.wmz
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2256
              • C:\Windows\SysWOW64\cmd.exe
                cmd
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2704
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V /R "^utIhAQXzKFfZwKOfdWFWGYOHgvUbutPplngusOenUcoCKjfoSNGytadifqZtVmhGQyOCcHYBTuwlPjXeuMFabKtSouQdPYDxoCLEbNMlPtkXdusrrWXoUUouqWxgRHLUDGwhAaEzZcDzniBeO$" Pensavo.wmz
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1996
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com
                  Prendero.exe.com z
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3084
                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com
                    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com z
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:5032
                • C:\Windows\SysWOW64\PING.EXE
                  ping SPDEBJWH -n 30
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:5060
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Mon14541c639b30ce5.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14541c639b30ce5.exe
            Mon14541c639b30ce5.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2136 -ip 2136
      1⤵
        PID:2388
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3000 -ip 3000
        1⤵
          PID:3652

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7rHDxAw\_Files\_Information.txt

          Filesize

          1KB

          MD5

          7ca9b067d8b892ad53c2b6cff0f44b5d

          SHA1

          82b90d1dd02d7cf599766415bd2e1a71f7c7b476

          SHA256

          140bea1de9cb936d55de4f41e37b89e71610935a1382621f46701e2b83674c8f

          SHA512

          2b1d02d0db9bdf2e8b1317c5b8698959d4b10bc175c588a08e4d20a74bd711399a1fd9939c809f459272f01371974ad77098c4022e804006893ac1c8c39cdf2f

        • C:\Users\Admin\AppData\Local\Temp\7rHDxAw\_Files\_Information.txt

          Filesize

          1KB

          MD5

          6764fe365abbe88217d1f55605a577ab

          SHA1

          eaa2e7ab4ad1fab10389b0550ceafd08ec66f12b

          SHA256

          e69dc1daf50c3a83f8f8158f5ada238fc84bf8eb56c741303349cc529058533a

          SHA512

          fbdf5af6dbdc59c3f95e50360cf8b6f71043933074b5ab9de16ee529c6eb27b5218c7aef097fa24b9a7632b4af32baed02fd5c234b89fc4a76c3f1d6ce5f43f6

        • C:\Users\Admin\AppData\Local\Temp\7rHDxAw\_Files\_Information.txt

          Filesize

          5KB

          MD5

          bb11ba5aae14a28c7983133a03693b6a

          SHA1

          fe19203a47398b38b8cb17ae64c007c843d9f3b2

          SHA256

          4b2071bfeaf9103f5d355e3aaf60ad1829b68311b05a7d7ff048eadb06869413

          SHA512

          de8ebae8bb877f3d1832211df385dd8af93a771b9d7f23d3338b60cc63cdf73603d42cca25d7cb9d2ed787f8e799dcb7bc03744a69bc5dd1eb7a6d77def3dfc6

        • C:\Users\Admin\AppData\Local\Temp\7rHDxAw\_Files\_Screen_Desktop.jpeg

          Filesize

          47KB

          MD5

          ba9eacbb3630e0a7e208503c84302bcf

          SHA1

          e69df423ee32ce4fdcf986d737aebbc5cd914466

          SHA256

          d4dc4f7f3d14c110d0206c7c2d2dc0ed12820a28cc7cd03292102d615d5a989f

          SHA512

          9810763133178c09a1ab8f72656529714f6beba2d9345b734b20351dbcc99dd306ca9ffd5b3e656f2894c00771a1766471a9c47d6e9818a1bd817aded132290c

        • C:\Users\Admin\AppData\Local\Temp\7rHDxAw\files_\system_info.txt

          Filesize

          7KB

          MD5

          e2439cb9c891af911fb24b3f888537c0

          SHA1

          45a5feac3c6271d9651ae26d40e08f97d1968d3f

          SHA256

          20ad2647ac86ec8178845531686aaf01a13a72bf6347b22975d1982caec6001b

          SHA512

          9406ad088df175e7556d39b7a53bf9a2c8bac00e0585fbb99c6a419f0f1b6709372a9ab4507fd8f152f9a77344db18ff3c34fd16e6750e188d3866b02e4e28f7

        • C:\Users\Admin\AppData\Local\Temp\7rHDxAw\gYkDirUuhZ47n.zip

          Filesize

          41KB

          MD5

          6896c2de3ea6ebd9d67bc9696a721d05

          SHA1

          ce42c274a5eb2e8fabc5a154ea577931c6ac2e83

          SHA256

          0f80867cb6b14147f47706318c0bc16a245a3b4c8cdca9b902c52f4074d338ec

          SHA512

          9a2e3a0f8f69649edfaef6070f58e407d7e1afc9ec042f2d32b02f046ef06d2906e906510c6329d12c1844a99d597a067231de5f9ca317432e5cf3d3630f8420

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14095335954ba1f.exe

          Filesize

          248KB

          MD5

          d23c06e25b4bd295e821274472263572

          SHA1

          9ad295ec3853dc465ae77f9479f8c4f76e2748b8

          SHA256

          f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c

          SHA512

          122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon141f1ef356ba1.exe

          Filesize

          192KB

          MD5

          ea5d2a70de26a3f2ce92d1b02b2f3052

          SHA1

          66045b40d6aebc6a2930c76c6d492fb5fc81426f

          SHA256

          7abf7953b1532eec5dd50fb9098269a8cd7b65e9afc9d84031039ff9da63f909

          SHA512

          1437877ea36bf59eb74eef0415f820507fa55bb07b17b59679454e02a99bf48884bfdd0706175a168a005ce9a672b0fbdc904da7a35242402567f06bf22d322b

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14365bf6c89d2abf.exe

          Filesize

          1.5MB

          MD5

          df80b76857b74ae1b2ada8efb2a730ee

          SHA1

          5653be57533c6eb058fed4963a25a676488ef832

          SHA256

          5545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd

          SHA512

          060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14541c639b30ce5.exe

          Filesize

          8KB

          MD5

          408f2c9252ad66429a8d5401f1833db3

          SHA1

          3829d2d03a728ecd59b38cc189525220a60c05db

          SHA256

          890db580fac738971bc7c714735ff6f1f2ee31edccd7881044da3e98452af664

          SHA512

          d4c89dfd928023b9f4380808b27e032342d2a85963b95bbed3191cc03b455dbc6f5ffecf29828a53b1d9011b3881f1cda9d15d269a2cbcbd4be5c993bcd9643b

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14585024febb5.exe

          Filesize

          56KB

          MD5

          3263859df4866bf393d46f06f331a08f

          SHA1

          5b4665de13c9727a502f4d11afb800b075929d6c

          SHA256

          9dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2

          SHA512

          58205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon1467890ab07c10e.exe

          Filesize

          900KB

          MD5

          0a0d22f1c9179a67d04166de0db02dbb

          SHA1

          106e55bd898b5574f9bd33dac9f3c0b95cecd90d

          SHA256

          a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac

          SHA512

          8abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon1469355885.exe

          Filesize

          272KB

          MD5

          fa37623638231d4c2b671b04a021a984

          SHA1

          7a446ffddc37e4a6dafd3f45d3d7c34c26885ce6

          SHA256

          26a9fde966bc459d278a1ce94d59cb95b1a152efb217164ca62fc15a15c68fbe

          SHA512

          730ba1cc1d9febba94572669a424695c06f03ac478255a61202f68eab45d8cdc60b0c341c005fc0b48b9f2048c7ebdfeaec8e28cf8b040be345790c930f6588b

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14b0530bbd5cb.exe

          Filesize

          1.3MB

          MD5

          12b8842dded9134ad0cae031c4f06530

          SHA1

          c0ecd0ac8cf3e4851661f62fe283ecec0e6ca25e

          SHA256

          abd87ec324df8d74245e1671f21e832b563eb8dc3c13b1688a9e85a2f809fe17

          SHA512

          967d70105549641beaa3283c42143aac22e016c911f99ab1c7ef5b4eff2577790fc679a74af6d2df14e87c278762e2c39c96bbdeabeaa1b62fb9072f0baa1825

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\Mon14f40f9f7773345d.exe

          Filesize

          609KB

          MD5

          3b2ca1aae0f3a277efde19ed66785e07

          SHA1

          edfd0bb11c0baec2475149259c8a88a61a669de9

          SHA256

          c65369fd8f5f8a6bcee8325879e912f7f5e5f37e40281077a4902668458887b1

          SHA512

          191aa807ec2c9a663eef6439084fcc68cdba245d9924773d65f42286af1df31238931425de1c18a4b643c7cd9ac4e98e638994630af440b7a1556c1497c8bb25

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\libcurl.dll

          Filesize

          218KB

          MD5

          d09be1f47fd6b827c81a4812b4f7296f

          SHA1

          028ae3596c0790e6d7f9f2f3c8e9591527d267f7

          SHA256

          0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

          SHA512

          857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\libcurlpp.dll

          Filesize

          54KB

          MD5

          e6e578373c2e416289a8da55f1dc5e8e

          SHA1

          b601a229b66ec3d19c2369b36216c6f6eb1c063e

          SHA256

          43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

          SHA512

          9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\libgcc_s_dw2-1.dll

          Filesize

          113KB

          MD5

          9aec524b616618b0d3d00b27b6f51da1

          SHA1

          64264300801a353db324d11738ffed876550e1d3

          SHA256

          59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

          SHA512

          0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\libstdc++-6.dll

          Filesize

          647KB

          MD5

          5e279950775baae5fea04d2cc4526bcc

          SHA1

          8aef1e10031c3629512c43dd8b0b5d9060878453

          SHA256

          97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

          SHA512

          666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\libwinpthread-1.dll

          Filesize

          69KB

          MD5

          1e0d62c34ff2e649ebc5c372065732ee

          SHA1

          fcfaa36ba456159b26140a43e80fbd7e9d9af2de

          SHA256

          509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

          SHA512

          3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

        • C:\Users\Admin\AppData\Local\Temp\7zSC2A417C7\setup_install.exe

          Filesize

          2.1MB

          MD5

          febbfc26db3b9b63c26a253d83685c61

          SHA1

          96efbac726821400049db0a1508566e0bce7ce1a

          SHA256

          76b67dbf3cdf622e3266419e7acbbf9d7e3e22c1a3ef5eceec90ebda296b65ff

          SHA512

          f14bf151bf40064f3ef9bee9671c7f5f3689a17bbfaa9319394f8b7178c82fdb29a133f48c8d0ad3ae89b63733667ff695d762dc031659a01714d823320b556c

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Copia.wmz

          Filesize

          4.3MB

          MD5

          a1ac3489d2401d26e3aea9bcb0a85b10

          SHA1

          6a4c4004ef746ed16d25c3fe425a6c78fcefe9b4

          SHA256

          1cb9452373f7b755b1c64b41bd7ffcfe4fe0ab92fd08c61c283c5deccfd89146

          SHA512

          293a84faadb89219945fde5836786cbcf4bdcaf36638603a5e95e80df4f5daf0b180d1f768deecee77b828ef736a337925479c37ae1e1f7126934f80be7b5e2e

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mummia.wmz

          Filesize

          576B

          MD5

          6f6fe96279c933c2170e75f49cf43718

          SHA1

          bbe211eaebbeb120b9ca3cd204aacbbeef20cb7e

          SHA256

          e6919da4e2658c82ebbcca670053d77e1231a5a600bf5aeaba71e5852e09022f

          SHA512

          76160b79d3cbe2fca6d95b096043641a96b13007f287f8e55b94eab16cbb98691a8e8fa8d035da434e84f689bb8d36478f632976481b56c7170889553a629748

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pensavo.wmz

          Filesize

          872KB

          MD5

          3928f9cc043cfb53823761dac703fd04

          SHA1

          c825e75ae21b995996763487de07176230c2535e

          SHA256

          c2d4ebb0b7be8eb8683cc1fdcd0b95c834888c56d555e6d23497ae211835f412

          SHA512

          8739619195c9d1409819822ae3c53415ac57a1c485b6947022d81981c9a0c7811ea5a30af0ef32e0a34aacf589f74366866dc1e7e03cd4addf56b71b6b25d9c5

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com

          Filesize

          872KB

          MD5

          c56b5f0201a3b3de53e561fe76912bfd

          SHA1

          2a4062e10a5de813f5688221dbeb3f3ff33eb417

          SHA256

          237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

          SHA512

          195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fynzk5fc.q10.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1384-161-0x0000000004B60000-0x0000000004B80000-memory.dmp

          Filesize

          128KB

        • memory/1384-158-0x0000000004B10000-0x0000000004B32000-memory.dmp

          Filesize

          136KB

        • memory/1384-160-0x00000000072F0000-0x0000000007894000-memory.dmp

          Filesize

          5.6MB

        • memory/1384-162-0x00000000078A0000-0x0000000007EB8000-memory.dmp

          Filesize

          6.1MB

        • memory/1384-163-0x0000000007EC0000-0x0000000007ED2000-memory.dmp

          Filesize

          72KB

        • memory/1384-164-0x0000000007EE0000-0x0000000007F1C000-memory.dmp

          Filesize

          240KB

        • memory/1384-168-0x00000000080D0000-0x00000000081DA000-memory.dmp

          Filesize

          1.0MB

        • memory/1384-180-0x0000000000400000-0x0000000002CCD000-memory.dmp

          Filesize

          40.8MB

        • memory/1768-108-0x00000000051D0000-0x00000000051F2000-memory.dmp

          Filesize

          136KB

        • memory/1768-155-0x0000000007630000-0x00000000076C6000-memory.dmp

          Filesize

          600KB

        • memory/1768-175-0x00000000076E0000-0x00000000076E8000-memory.dmp

          Filesize

          32KB

        • memory/1768-174-0x00000000076F0000-0x000000000770A000-memory.dmp

          Filesize

          104KB

        • memory/1768-170-0x0000000007600000-0x0000000007614000-memory.dmp

          Filesize

          80KB

        • memory/1768-169-0x00000000075F0000-0x00000000075FE000-memory.dmp

          Filesize

          56KB

        • memory/1768-159-0x00000000075C0000-0x00000000075D1000-memory.dmp

          Filesize

          68KB

        • memory/1768-151-0x0000000007440000-0x000000000744A000-memory.dmp

          Filesize

          40KB

        • memory/1768-109-0x0000000005370000-0x00000000053D6000-memory.dmp

          Filesize

          408KB

        • memory/1768-110-0x0000000005A70000-0x0000000005AD6000-memory.dmp

          Filesize

          408KB

        • memory/1768-148-0x0000000007A00000-0x000000000807A000-memory.dmp

          Filesize

          6.5MB

        • memory/1768-111-0x0000000005AE0000-0x0000000005E34000-memory.dmp

          Filesize

          3.3MB

        • memory/1768-99-0x0000000005440000-0x0000000005A68000-memory.dmp

          Filesize

          6.2MB

        • memory/1768-98-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

          Filesize

          216KB

        • memory/1768-124-0x0000000006070000-0x000000000608E000-memory.dmp

          Filesize

          120KB

        • memory/1768-126-0x00000000060A0000-0x00000000060EC000-memory.dmp

          Filesize

          304KB

        • memory/1768-150-0x00000000073C0000-0x00000000073DA000-memory.dmp

          Filesize

          104KB

        • memory/1768-145-0x0000000007060000-0x0000000007103000-memory.dmp

          Filesize

          652KB

        • memory/1768-134-0x000000006EE20000-0x000000006EE6C000-memory.dmp

          Filesize

          304KB

        • memory/1768-133-0x0000000007020000-0x0000000007052000-memory.dmp

          Filesize

          200KB

        • memory/1768-144-0x0000000006630000-0x000000000664E000-memory.dmp

          Filesize

          120KB

        • memory/2136-128-0x0000000000400000-0x00000000023AE000-memory.dmp

          Filesize

          31.7MB

        • memory/2516-87-0x00000000012E0000-0x00000000012E6000-memory.dmp

          Filesize

          24KB

        • memory/2516-102-0x00000000012F0000-0x0000000001314000-memory.dmp

          Filesize

          144KB

        • memory/2516-107-0x0000000001310000-0x0000000001316000-memory.dmp

          Filesize

          24KB

        • memory/2516-86-0x0000000000B00000-0x0000000000B36000-memory.dmp

          Filesize

          216KB

        • memory/2644-81-0x00000000001F0000-0x00000000001F8000-memory.dmp

          Filesize

          32KB

        • memory/3000-178-0x0000000000400000-0x0000000002402000-memory.dmp

          Filesize

          32.0MB

        • memory/4040-92-0x000000006EB40000-0x000000006EB63000-memory.dmp

          Filesize

          140KB

        • memory/4040-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/4040-52-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/4040-54-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/4040-55-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/4040-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/4040-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/4040-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/4040-88-0x0000000000400000-0x000000000051B000-memory.dmp

          Filesize

          1.1MB

        • memory/4040-59-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/4040-94-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/4040-95-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/4040-51-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/4040-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/4040-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp

          Filesize

          1.5MB

        • memory/4040-50-0x000000006B440000-0x000000006B4CF000-memory.dmp

          Filesize

          572KB

        • memory/4040-96-0x0000000064940000-0x0000000064959000-memory.dmp

          Filesize

          100KB

        • memory/4040-62-0x0000000064940000-0x0000000064959000-memory.dmp

          Filesize

          100KB

        • memory/4040-61-0x0000000064941000-0x000000006494F000-memory.dmp

          Filesize

          56KB

        • memory/4040-60-0x000000006B280000-0x000000006B2A6000-memory.dmp

          Filesize

          152KB

        • memory/5032-192-0x0000000006060000-0x0000000006103000-memory.dmp

          Filesize

          652KB

        • memory/5032-191-0x0000000006060000-0x0000000006103000-memory.dmp

          Filesize

          652KB

        • memory/5032-190-0x0000000006060000-0x0000000006103000-memory.dmp

          Filesize

          652KB

        • memory/5032-189-0x0000000006060000-0x0000000006103000-memory.dmp

          Filesize

          652KB

        • memory/5032-188-0x0000000006060000-0x0000000006103000-memory.dmp

          Filesize

          652KB

        • memory/5032-187-0x0000000006060000-0x0000000006103000-memory.dmp

          Filesize

          652KB