8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
62s
max time network
63s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27-11-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Executes dropped EXE 1 IoCs

pid	Process
1324	Solara.exe

Loads dropped DLL 11 IoCs

pid	Process
1200	MsiExec.exe
1200	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
4472	MsiExec.exe
4472	MsiExec.exe
4472	MsiExec.exe
1200	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
35	2960	msiexec.exe
37	2960	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
52	pastebin.com
53	pastebin.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\lib\tracker.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\fetch.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minimatch\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\deepest-nesting-target.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\agent.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\CONTRIBUTING.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\dist\abort-controller.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fastest-levenshtein\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\columnify\utils.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\registry.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarn	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tootallnate\once\dist\overloaded-parameters.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\logging.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\glob\glob.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\graceful-fs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-root.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\cache\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\util\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\no-tty.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrappy\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-expression-parse\AUTHORS	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\serialized.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\key.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\update-gyp.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\check-listener-leaks.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\base64-js\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\satisfies.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\neq.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\find-visualstudio.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\fetch.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\defaults\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\cert.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\gte.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\from-url.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\listener-count.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\combinator.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\peer-entry-sets.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\run-script.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\lt.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\sbcs-codec.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\p-map\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\test.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\polyfill.mjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\dns.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\smart-buffer\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\minor.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\utils\signer.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-docs.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\exit-handler.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_duplex.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-update.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\err-code\bower.json	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC4AA.tmp	msiexec.exe
File created	C:\Windows\Installer\e57be91.msi	msiexec.exe
File created	C:\Windows\Installer\e57be8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC46A.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE12.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI140B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC38E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE61.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA97.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDAD6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57be8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAD.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	msinfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msinfo32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
956	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2028	WMIC.exe
2028	WMIC.exe
2028	WMIC.exe
2028	WMIC.exe
4024	Bootstrapper.exe
4024	Bootstrapper.exe
2960	msiexec.exe
2960	msiexec.exe
1324	Solara.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2028	WMIC.exe
Token: SeSecurityPrivilege	2028	WMIC.exe
Token: SeTakeOwnershipPrivilege	2028	WMIC.exe
Token: SeLoadDriverPrivilege	2028	WMIC.exe
Token: SeSystemProfilePrivilege	2028	WMIC.exe
Token: SeSystemtimePrivilege	2028	WMIC.exe
Token: SeProfSingleProcessPrivilege	2028	WMIC.exe
Token: SeIncBasePriorityPrivilege	2028	WMIC.exe
Token: SeCreatePagefilePrivilege	2028	WMIC.exe
Token: SeBackupPrivilege	2028	WMIC.exe
Token: SeRestorePrivilege	2028	WMIC.exe
Token: SeShutdownPrivilege	2028	WMIC.exe
Token: SeDebugPrivilege	2028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2028	WMIC.exe
Token: SeRemoteShutdownPrivilege	2028	WMIC.exe
Token: SeUndockPrivilege	2028	WMIC.exe
Token: SeManageVolumePrivilege	2028	WMIC.exe
Token: 33	2028	WMIC.exe
Token: 34	2028	WMIC.exe
Token: 35	2028	WMIC.exe
Token: 36	2028	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2028	WMIC.exe
Token: SeSecurityPrivilege	2028	WMIC.exe
Token: SeTakeOwnershipPrivilege	2028	WMIC.exe
Token: SeLoadDriverPrivilege	2028	WMIC.exe
Token: SeSystemProfilePrivilege	2028	WMIC.exe
Token: SeSystemtimePrivilege	2028	WMIC.exe
Token: SeProfSingleProcessPrivilege	2028	WMIC.exe
Token: SeIncBasePriorityPrivilege	2028	WMIC.exe
Token: SeCreatePagefilePrivilege	2028	WMIC.exe
Token: SeBackupPrivilege	2028	WMIC.exe
Token: SeRestorePrivilege	2028	WMIC.exe
Token: SeShutdownPrivilege	2028	WMIC.exe
Token: SeDebugPrivilege	2028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2028	WMIC.exe
Token: SeRemoteShutdownPrivilege	2028	WMIC.exe
Token: SeUndockPrivilege	2028	WMIC.exe
Token: SeManageVolumePrivilege	2028	WMIC.exe
Token: 33	2028	WMIC.exe
Token: 34	2028	WMIC.exe
Token: 35	2028	WMIC.exe
Token: 36	2028	WMIC.exe
Token: SeDebugPrivilege	4024	Bootstrapper.exe
Token: SeShutdownPrivilege	3784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3784	msiexec.exe
Token: SeSecurityPrivilege	2960	msiexec.exe
Token: SeCreateTokenPrivilege	3784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3784	msiexec.exe
Token: SeLockMemoryPrivilege	3784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3784	msiexec.exe
Token: SeMachineAccountPrivilege	3784	msiexec.exe
Token: SeTcbPrivilege	3784	msiexec.exe
Token: SeSecurityPrivilege	3784	msiexec.exe
Token: SeTakeOwnershipPrivilege	3784	msiexec.exe
Token: SeLoadDriverPrivilege	3784	msiexec.exe
Token: SeSystemProfilePrivilege	3784	msiexec.exe
Token: SeSystemtimePrivilege	3784	msiexec.exe
Token: SeProfSingleProcessPrivilege	3784	msiexec.exe
Token: SeIncBasePriorityPrivilege	3784	msiexec.exe
Token: SeCreatePagefilePrivilege	3784	msiexec.exe
Token: SeCreatePermanentPrivilege	3784	msiexec.exe
Token: SeBackupPrivilege	3784	msiexec.exe
Token: SeRestorePrivilege	3784	msiexec.exe
Token: SeShutdownPrivilege	3784	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4500	4024	Bootstrapper.exe	81
PID 4024 wrote to memory of 4500	4024	Bootstrapper.exe	81
PID 4500 wrote to memory of 956	4500	cmd.exe	83
PID 4500 wrote to memory of 956	4500	cmd.exe	83
PID 4024 wrote to memory of 1676	4024	Bootstrapper.exe	88
PID 4024 wrote to memory of 1676	4024	Bootstrapper.exe	88
PID 1676 wrote to memory of 2028	1676	cmd.exe	90
PID 1676 wrote to memory of 2028	1676	cmd.exe	90
PID 4024 wrote to memory of 3784	4024	Bootstrapper.exe	94
PID 4024 wrote to memory of 3784	4024	Bootstrapper.exe	94
PID 2960 wrote to memory of 1200	2960	msiexec.exe	97
PID 2960 wrote to memory of 1200	2960	msiexec.exe	97
PID 2960 wrote to memory of 2096	2960	msiexec.exe	98
PID 2960 wrote to memory of 2096	2960	msiexec.exe	98
PID 2960 wrote to memory of 2096	2960	msiexec.exe	98
PID 2960 wrote to memory of 4472	2960	msiexec.exe	100
PID 2960 wrote to memory of 4472	2960	msiexec.exe	100
PID 2960 wrote to memory of 4472	2960	msiexec.exe	100
PID 4472 wrote to memory of 4720	4472	MsiExec.exe	101
PID 4472 wrote to memory of 4720	4472	MsiExec.exe	101
PID 4472 wrote to memory of 4720	4472	MsiExec.exe	101
PID 4720 wrote to memory of 340	4720	wevtutil.exe	103
PID 4720 wrote to memory of 340	4720	wevtutil.exe	103
PID 4024 wrote to memory of 1324	4024	Bootstrapper.exe	106
PID 4024 wrote to memory of 1324	4024	Bootstrapper.exe	106

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:956
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- C:\ProgramData\Solara\Solara.exe
  "C:\ProgramData\Solara\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1324

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B9664368B33A9BD0BB18EB52B8D82DC8
  2⤵
  - Loads dropped DLL
  PID:1200
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 67B6B51F95265349B2B9829F492640C4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0F88C231634C249CBB79998F8A4FBCD5 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:340

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\SetResume.nfo"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57be90.rbs

Filesize
1.0MB

MD5
552d71cd27d781cedddde337aacc1774

SHA1
fac7731f764d83c887bf0112749b2f236ba5e7d8

SHA256
4cc22ec4b2c4091ad3a65cf30762c325255b514dda343b30b032402da69dd5cc

SHA512
63bbded8acd9c45eeacdf1ae39d9f330b78d79dbcb195906df6813247c234ea2d4acbbaad05785c8527b749f6d014ae2d8914f816a58e56ad8a504569571f07e

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\Desktop\AddWatch.svg

Filesize
277KB

MD5
a13315d894387c62dec89a114cdf7f75

SHA1
0ce58957d29f2c0fcec88b5dd0f953cadf95e4dc

SHA256
d0bf69b1c93ae1829659fa99cbee5d5918f1a7d2d14889c596aa5af13d0b7942

SHA512
14f8d58997e60056dae79cd10774c2d819fd0e145e1b10574197497300fa9bc1d548834eb9ea1be7401aad78ce9f2e478ad6c6844753ad0276dd5bffdfdc13c6

Download Submit
C:\Users\Admin\Desktop\AssertRemove.avi

Filesize
508KB

MD5
1b7a3612994da43003674e9bdea070c9

SHA1
d0a3d5f1fa6b17a79583e79271c242857a2d61da

SHA256
f840d2e49d60e9592c0430d0909a69a8d62e8aaabf07afd4970312d7369731fe

SHA512
f4f6706a270b564d2d80a9aba26014e7b58a1fb837a5d62835d564ed4cebbb3ccd07bf5a3d81a0aee66c501739bdd9f2b98e662e5c4032e051a2ebd98bca9ad2

Download Submit
C:\Users\Admin\Desktop\ConvertUninstall.bat

Filesize
531KB

MD5
7d43ea92439737048e13cf7c4fd99065

SHA1
b2a53b36b54304dedc7af537993f921a12184085

SHA256
90268bb5ec30253db33ad297a37cf38e7415b7eb5df14e51253ca201019f0a30

SHA512
a5d17d5a3cff696241e98bc1c7f2b207524164e0d351b9081d419c7786f3539018fc8050eda7270b1b0788a133c9e6078d82528127eb1216bd3fb4e836735561

Download Submit
C:\Users\Admin\Desktop\CopySwitch.mp4v

Filesize
739KB

MD5
2609545d5aca27ab6ad699e8ddae1b15

SHA1
e447dd75c36a830fcd6e45a7105ff9e829be5dc4

SHA256
85e8f0de7cbf64e50e8958d164ae69f1ef40039b8bbc91bdfada159c767cb3c5

SHA512
04f5c1c8497ae3cae9b66bfddf55d045d4bcfcd4d0dc786c1d47797a48f4499d5dea6362d5ebaf00f81c3091dad0c2a9dbfd6883d11fa1749972a4deab07e87c

Download Submit
C:\Users\Admin\Desktop\DismountUnblock.vstx

Filesize
670KB

MD5
cbfe3f0dad62ee1ad63b84476a81b4ad

SHA1
718ce275cea3a5a8e4553f09c76c397e0fef68de

SHA256
55eea87ec29a3b1612bb362f5669d239186df54d3e208bbe50e59bc588a2eeb2

SHA512
437fb747b494cdc349661887b0d64074e621b8d857653c66d422e51ce33a8980f405810e6db162171b302fa01f371c6b6f989ea3eb18d09d14d5e4977e98a825

Download Submit
C:\Users\Admin\Desktop\EnterCompare.exe

Filesize
439KB

MD5
6ee0b20580bca9a370097a58e57f7fa5

SHA1
ec259915040995cb4aac1d9045629c831c37af3f

SHA256
28019842b8c947760b3315fc7bfd1ee5587faccee67c12ea5d51ea2c6f053c65

SHA512
0da5e8c7eb1df512b1099e3282dcc88700293e8eca23c3a9bcdd3703f26c3ae3bb606384b69cbda2b35f2578bbefa51b3361c24eaadfa1244439fda278614666

Download Submit
C:\Users\Admin\Desktop\ImportGroup.scf

Filesize
647KB

MD5
5ae523b35b7a411d2b95dbb2a04573f6

SHA1
3ac4c8c9431d5eaa7376b8de782857285a12607a

SHA256
2b9f08d8d2f75bf704fd47228d7be27887db84228e351a4c3d6e763c2bc98bee

SHA512
435cf7f278391e4f9bcf9b1daf377bab354d8eaf3200c91ed8329c34460d33f67fcfb350ecab295a3165df8c2cda3827d1ba63029756652dfff92ca856c40cd2

Download Submit
C:\Users\Admin\Desktop\LockRepair.ini

Filesize
600KB

MD5
f356a142fb4f422418d93c393490cd47

SHA1
747a88b5b9a8f3b7015c3ef5bbe4f841f6359119

SHA256
218e6193456b3ff84618074d6a93495030fc2633f9f650b57ff6147607034214

SHA512
c929dea8a07db1a649b5e7bab6791e36c039499c5d334460ab57e911cf72c3db1bd302472bb3618a5a9f6991d171a5bd338c0e50162c90f4084534b7b1fe70fc

Download Submit
C:\Users\Admin\Desktop\LockSuspend.cmd

Filesize
462KB

MD5
7bbb7f3fd400680a8c8e3caa1cfdd0c9

SHA1
df96b5c38157b0f02e2d37e2af63278885e7afd3

SHA256
e10f9fc1e78066df15eb8cc3a231bde4b365236fd7ff18116e6503588d67cf1f

SHA512
5b9dc47fc0cff47e9031173d798c462823a2a8e803df8d3ca252aa43fe120c328af7e118bce1f8f3b68c14bfb8028c6b4f82b00cb86e063f180f2d77dd5d4a8d

Download Submit
C:\Users\Admin\Desktop\MergeConvertTo.3g2

Filesize
554KB

MD5
c19d816a68a5dd24103c50c962d3f9af

SHA1
7921aba6207296e10b74600fc8b317a47e8de952

SHA256
bb165f341fd55cd92b12794ebfec7d15e4199305ea119d445643d8ad7a3892f4

SHA512
a07e3e7e0ad64c4806e9d9d42ee6cf5ad8c760f20227bc329c2db450f8104bbfab692171531b8e27a848d6d2e589ea8f736649172cd6e1988d0c59646500dc70

Download Submit
C:\Users\Admin\Desktop\NewShow.rle

Filesize
762KB

MD5
e4f8112c7d35b40c820521c3e0692dea

SHA1
e3591b8085ed62a027b00db52993b43e88c15255

SHA256
6b703346f77b93c6d8d23a3eca8e32abe3ac256e79716da3f1f7dcc4f07e9e1b

SHA512
d8a8045f1eb810bfe034b765dceb2cebebf486f6744c5f381420bc4b0bbf4c4ed36a2630239b2746c4f2a3a160a0b8340ab760d48894333f97e94d64f32b2477

Download Submit
C:\Users\Admin\Desktop\OutDisconnect.docx

Filesize
14KB

MD5
c82c22c461d7e312e8c1ab4b732fba47

SHA1
b679059e048aa9963340e0cac53059089665ecb0

SHA256
32eef84260c73d414f52f9d81079c63fa30ebb55a42482a539f85510cdd7a740

SHA512
9007e829e4eb458f19161f2daf3b917944aeae02651d68f534cbaab3518d0c3dc9f1382992ac79b9181c674b8c1574253b1a6d77ee0264a5dda623e1498db4c9

Download Submit
C:\Users\Admin\Desktop\PingSplit.tif

Filesize
785KB

MD5
8506df709101b7fb5f48bfb0c078aa05

SHA1
fb3d2a69390971310e09670b249e5d28c72aae02

SHA256
af15e06886609449c7db7fb2078165d1cf267cac294063e9537dd7f123e3312b

SHA512
93580a19c9e1a92b27258a1cce61400663041b669b983df618ae9f9f23794249728782c532a46239f458e468555176bdde05d20a4365fd83b618d29f28658d2f

Download Submit
C:\Users\Admin\Desktop\ReadAdd.scf

Filesize
392KB

MD5
b4c3c2e5528fcafd8c7c3a83237e153f

SHA1
4c3eaa970bc38722f7c92c1105b4d720270f181c

SHA256
e2487ff0bc56ebc55036c099d2013016b802d1568297b0807409b302d468ab06

SHA512
466a4fc14c4dd63c012796866be9501b962a8820c40e5192e9ee880dcb1fa78cc53cc126a7fc4a6f1a479e925d48b9e1b1ae104b153e7d2706de415532e51ad2

Download Submit
C:\Users\Admin\Desktop\RedoBlock.pptm

Filesize
346KB

MD5
19a8cd6ca0cbd80fe3c32b2b676c797d

SHA1
86a405c05ccaf865eb102acf6ee17eb2adff1181

SHA256
1ec6fdf2156cc5296a61b8374f124e3694e8c7b47c0f8d2dbafbe83bfb99a0e3

SHA512
7858a80f843b459a316729a303de038562053fd9fb28edc8a85ad0b4bf178df6b7f4cdce9d6f213901e325df18d5b44b6d26ecba45a176aa85adcd61bb2adeda

Download Submit
C:\Users\Admin\Desktop\ResumeWatch.dib

Filesize
693KB

MD5
6fb5f261c46a07a92c9c6659b2e287a0

SHA1
006da747b0c4bd023f646f74e5491585ff2a74c4

SHA256
14cf0c5dad9b84c52f9cfcb908dcb657f1cc71f226ecf6f6c6d9e5c8c6a031fe

SHA512
f73ff1b7dee5cdc3370b577a128a9d85d5f8b916e8b8bc95d7729e816e721ca5eaa754383fd180c1af7ecd8a464861be624fe40d16ad3e84a54c4e2b27761dd2

Download Submit
C:\Users\Admin\Desktop\SearchCompress.xlsx

Filesize
12KB

MD5
cb1222bca7362b5adc758b52903c9d6c

SHA1
74f9daa8f64940e64976603d6519c96ba2dfcca1

SHA256
f20a7ab1d7554e129c563a6c75a29b70907f83df994c785eda70f1e3de56ad1c

SHA512
8a5216e8c453c26c2cea1c026f02c9ed52a63bb277bd220a3f854bd4e3db82b2c2693c43abc2fa3bb50ff3571d37fb0b8ca6ec6e68fd8a88a23d645f1fa15412

Download Submit
C:\Users\Admin\Desktop\SetResume.nfo

Filesize
577KB

MD5
8a00d404e1316eb249c659b9011b7952

SHA1
a4b048597d9d9efb0dc28634e21a5e03475e93ed

SHA256
a3a79277db9cc5ebad68619d1faf5696d9b66843944ef8bfc0370bdaed6dfd46

SHA512
c296064d47ebabd1c315f3e194f77445a0248993bc7623277910732835a1e9b85e4d51e229ed66ca0b47d530ad4709f6cb55dfd0715c700d3c2efeb701940b02

Download Submit
C:\Users\Admin\Desktop\SuspendRegister.css

Filesize
716KB

MD5
55384c74fd83a3ce04619d7ce8ccaa42

SHA1
7f16a94a3ec5ee7cf4548506f847562ffa5ec283

SHA256
660f91add36e78d891eacca553a992fc5a970232def41ba7c1ec66a2e74c3118

SHA512
3f69b82934e250374a37b0e9293a5427123601136141bcdfbbd225c29d3f2f906f84ff16fe0f79ecb8f96029d87627555322d41a0560b58d11af2c14acff4868

Download Submit
C:\Users\Admin\Desktop\TraceRequest.TS

Filesize
624KB

MD5
75219947f9195e03e134a612f7b0ba72

SHA1
c294e512bea8dd142eec2be6a54b8cf2a1e0cd97

SHA256
6fdfe531c7ce2230aa7b4f66b564dba209ddd7a5053b715f7208f5d39fd77317

SHA512
d38fce1a1294aa0e5fc41cb6cea41896c5ea0e09c6eacd9b509bc80a333d0633475c8e17e690a591df02fed5808a03b6fd5a269d8f691cac3a0f79596d045959

Download Submit
C:\Users\Admin\Desktop\TraceResize.ram

Filesize
323KB

MD5
878e6c1526453c72e6ee1a8b585e03e7

SHA1
243474651016af262614fa38e9604bc803bf5ebd

SHA256
7fa5122a62b6bcb4c3e65225012c2d8056a3140466a0edcd1157da72bf9c649e

SHA512
0d733b705d88a4d10457fab98a5df4ca8367804b527df70bf918b6cab897f9e2b9fcabcf04e7dd9d8f673874d67c08afb240c8bdb3e8b7c8c22c4447949c0d20

Download Submit
C:\Users\Admin\Desktop\UnblockRevoke.ogg

Filesize
416KB

MD5
475c3bc5a50266ee6825ca18e0952112

SHA1
92c2012fffcca97040a4a6f4a21128ec5cb220ec

SHA256
8d17d16734f425b847a0440a25f39ed7f02a7ef55cfec652c48ef369b1831d60

SHA512
da9586477d0dc941862050005be9ee33b03830e449ac4814bfab6c1857258d2ba6b21a1c4a6e2896874fda593b7342f82bb67ee25be1ef6e3d14b5d57e9ee346

Download Submit
C:\Users\Admin\Desktop\UndoJoin.xhtml

Filesize
300KB

MD5
5bc0ebb3f8ed77d6a6ca0c4ff1041e24

SHA1
99bc6d5129d9cae745dfb7806801baa63f0969c7

SHA256
cc1b477bbc8dd2878d2d28c5e98ed9dd113794703de20919249de687a61a05da

SHA512
0ae0c789157fcf01b24da085eaf0a24fac9faef666541afa5feed69a1c2d377af9d9e2692916854ec3edcc941a3b075e78b83eda78bc1efe073617489d1b4cc0

Download Submit
C:\Users\Admin\Desktop\UnlockPublish.bin

Filesize
369KB

MD5
af2980241847c316e7dea28257ee7f3c

SHA1
fa6ed81dd486170e67c66100b7a901603cd32dae

SHA256
567f770bcf55419308a4d6daaebb621b15dc8152408a448a1d816b602a05840c

SHA512
b9354c0f53c4767b93b632dd5cba547a99423902cb1eecd7a0a6af51eefa28abf81eac3b8cd4c518e2fed229a18eeba995bafc66d7f704f2dd768daf382ba5ea

Download Submit
C:\Users\Admin\Desktop\UnpublishResume.svgz

Filesize
485KB

MD5
0d7a682d267f798ca5148d3b401ddf06

SHA1
ee8792795589380c99ecc2546d7891681ca94c51

SHA256
f98f6d391358ff3dbd7fddffc108cd6c8544890b82a00af44b0ff579308fe015

SHA512
24d8a21e7c434be60dfb2f218c034a8d1b8573ed20beb968775897db1f7c8e489ad6d5858a4aee27c7b52ffef6e495e5577387267244fe8a78b6dd9c8e6611d6

Download Submit
C:\Users\Admin\Desktop\UnregisterSwitch.potx

Filesize
1.1MB

MD5
cea55b762fc4d89bb3c161c4cf703a70

SHA1
5800b63343bcd9d9754921c8d1d91cb2f2792e8e

SHA256
ef31d539d2a90d836f9caa24b566e6fd3ea4acd4104d67a055f83b323eb26d74

SHA512
e0997047d4d017b2c32ccd05e9506c7be830b5dc18b5daf9072b96451a6c44d29e5912b448634ddcf709dda1e98f1b4136c2af9d7fe284cb1101eb97ae97d08c

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
ca7d7a322a8623c0b1ebf7aea40c73bc

SHA1
258faa924b9d8ab7496888a0d755b778258930e9

SHA256
c62e0c0d7acd363f5477963f4ddafdf3156723ec3806b7883b6f1fc3f20941d5

SHA512
ba7e4145840bd45a7e074fbbee44a283ac5b49157fabe8f1eca7fb077b7e9d5ed8375cdfe9a66fd5761c267c6ae82b8d2f0535ac5b3c79e22b0b74bcf07e410e

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
a3b11a568ad9943b80eb6229c1b32cd3

SHA1
c68234b806ca5c4ce1b145a6e6a7efcfe76edcca

SHA256
9f058ee00e262e4718cba1637f42e4a58f092f7749fdb8973edd060ce415584f

SHA512
5919624eef220d99fe062042e5c158eb9f54bad0c10a2a4badc0f2eb07d1e6ca72ff38ff0f65cd168fd42b159c192c4b8ae1817c3981fb8099880e02cb221c93

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
e8b0e66fd86e6ce5295c2990e8efe6cc

SHA1
cc257e50ef50e14692445b7613d2b8030b56a407

SHA256
daf7886bd86f3b16004d68c0c77d40c0e9b57108e582953e08ae25d5b0eccf39

SHA512
64d0c16b1cdc0f12d521e73abeb98e9ce3325eba45c34e96ee946cd7bcd461de8d72901ddffa53e87fdbd2e8b54732655cac0e23f2fb38668d4c4b84c1788887

Download Submit
C:\Windows\Installer\MSIC38E.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIC4AA.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSICE12.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
memory/1324-2811-0x0000023669500000-0x00000236695B2000-memory.dmp

Filesize
712KB

Download
memory/1324-2804-0x000002364EC20000-0x000002364EC44000-memory.dmp

Filesize
144KB

Download
memory/1324-2806-0x00000236698C0000-0x0000023669DFC000-memory.dmp

Filesize
5.2MB

Download
memory/1324-2809-0x0000023669440000-0x00000236694FA000-memory.dmp

Filesize
744KB

Download
memory/4024-2808-0x00007FF9721E0000-0x00007FF972CA2000-memory.dmp

Filesize
10.8MB

Download
memory/4024-2383-0x0000029AE9680000-0x0000029AE968A000-memory.dmp

Filesize
40KB

Download
memory/4024-2385-0x0000029AE9730000-0x0000029AE9742000-memory.dmp

Filesize
72KB

Download
memory/4024-4-0x0000029AE9600000-0x0000029AE9622000-memory.dmp

Filesize
136KB

Download
memory/4024-6-0x00007FF9721E0000-0x00007FF972CA2000-memory.dmp

Filesize
10.8MB

Download
memory/4024-0-0x00007FF9721E3000-0x00007FF9721E5000-memory.dmp

Filesize
8KB

Download
memory/4024-5-0x00007FF9721E3000-0x00007FF9721E5000-memory.dmp

Filesize
8KB

Download
memory/4024-2-0x00007FF9721E0000-0x00007FF972CA2000-memory.dmp

Filesize
10.8MB

Download
memory/4024-1-0x0000029ACEFD0000-0x0000029ACF09E000-memory.dmp

Filesize
824KB

Download