lumma | c7258d057f5072211b50e9edcda0bf1d63b8285c4a463ff81ebbe036aa850862

Analysis

max time kernel
48s
max time network
36s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-01-2025 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New folder (6).rar
Size

6.1MB
MD5

27b4dc830b401a9ef6a405b25f991c9c
SHA1

960071c674b6d7c0066ccf4ab7d9fb31c958567a
SHA256

c7258d057f5072211b50e9edcda0bf1d63b8285c4a463ff81ebbe036aa850862
SHA512

f5ec58124c86ba3f67c8c86fa1899ee6eea3a27e4c46e59c3d997258af548a2e15cd7db5e23c6c89cf4fda2b555b38e7c69b66871e09fb2e0fdd5de5e75301dd
SSDEEP

196608:1hIil4GQnWGqXX2eDUgfFlHNY6k8ak1u4:uGQWT2SJftY6khV4

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://uprootquincju.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 12 IoCs

pid	Process
2836	BoostrappersSv.exe
2760	A.com
1028	BoostrappersSv.exe
1088	BoostrappersSv.exe
2904	A.com
2948	BoostrappersSv.exe
2464	BoostrappersSv.exe
1920	BoostrappersSv.exe
2252	A.com
2260	A.com
2476	A.com
2076	A.com

Loads dropped DLL 6 IoCs

pid	Process
1744	cmd.exe
1332	cmd.exe
772	cmd.exe
2732	cmd.exe
1684	cmd.exe
2512	cmd.exe

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
2056	tasklist.exe
2932	tasklist.exe
2052	tasklist.exe
1068	tasklist.exe
3000	tasklist.exe
1476	tasklist.exe
2476	tasklist.exe
1300	tasklist.exe
2332	tasklist.exe
1612	tasklist.exe
1360	tasklist.exe
1376	tasklist.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\HourRack	BoostrappersSv.exe
File opened for modification	C:\Windows\PpcBytes	BoostrappersSv.exe
File opened for modification	C:\Windows\PpcBytes	BoostrappersSv.exe
File opened for modification	C:\Windows\HourRack	BoostrappersSv.exe
File opened for modification	C:\Windows\PpcBytes	BoostrappersSv.exe
File opened for modification	C:\Windows\PpcBytes	BoostrappersSv.exe
File opened for modification	C:\Windows\PpcBytes	BoostrappersSv.exe
File opened for modification	C:\Windows\HourRack	BoostrappersSv.exe
File opened for modification	C:\Windows\HourRack	BoostrappersSv.exe
File opened for modification	C:\Windows\HourRack	BoostrappersSv.exe
File opened for modification	C:\Windows\PpcBytes	BoostrappersSv.exe
File opened for modification	C:\Windows\HourRack	BoostrappersSv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BoostrappersSv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BoostrappersSv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BoostrappersSv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BoostrappersSv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BoostrappersSv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2760	A.com
2760	A.com
2760	A.com
2904	A.com
2904	A.com
2904	A.com
2252	A.com
2252	A.com
2252	A.com
2260	A.com
2260	A.com
2260	A.com
2476	A.com
2476	A.com
2476	A.com
2076	A.com
2076	A.com
2076	A.com

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2168	7zFM.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	2168	7zFM.exe
Token: 35	2168	7zFM.exe
Token: SeSecurityPrivilege	2168	7zFM.exe
Token: SeDebugPrivilege	1612	tasklist.exe
Token: SeDebugPrivilege	1360	tasklist.exe
Token: SeDebugPrivilege	1068	tasklist.exe
Token: SeDebugPrivilege	1376	tasklist.exe
Token: SeDebugPrivilege	3000	tasklist.exe
Token: SeDebugPrivilege	2476	tasklist.exe
Token: SeDebugPrivilege	1476	tasklist.exe
Token: SeDebugPrivilege	1300	tasklist.exe
Token: SeDebugPrivilege	2056	tasklist.exe
Token: SeDebugPrivilege	2932	tasklist.exe
Token: SeDebugPrivilege	2052	tasklist.exe
Token: SeDebugPrivilege	2332	tasklist.exe

Suspicious use of FindShellTrayWindow 20 IoCs

pid	Process
2168	7zFM.exe
2168	7zFM.exe
2760	A.com
2760	A.com
2760	A.com
2904	A.com
2904	A.com
2904	A.com
2252	A.com
2252	A.com
2252	A.com
2260	A.com
2260	A.com
2260	A.com
2476	A.com
2476	A.com
2476	A.com
2076	A.com
2076	A.com
2076	A.com

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2760	A.com
2760	A.com
2760	A.com
2904	A.com
2904	A.com
2904	A.com
2252	A.com
2252	A.com
2252	A.com
2260	A.com
2260	A.com
2260	A.com
2476	A.com
2476	A.com
2476	A.com
2076	A.com
2076	A.com
2076	A.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1744	2836	BoostrappersSv.exe	33
PID 2836 wrote to memory of 1744	2836	BoostrappersSv.exe	33
PID 2836 wrote to memory of 1744	2836	BoostrappersSv.exe	33
PID 2836 wrote to memory of 1744	2836	BoostrappersSv.exe	33
PID 1744 wrote to memory of 1612	1744	cmd.exe	35
PID 1744 wrote to memory of 1612	1744	cmd.exe	35
PID 1744 wrote to memory of 1612	1744	cmd.exe	35
PID 1744 wrote to memory of 1612	1744	cmd.exe	35
PID 1744 wrote to memory of 916	1744	cmd.exe	36
PID 1744 wrote to memory of 916	1744	cmd.exe	36
PID 1744 wrote to memory of 916	1744	cmd.exe	36
PID 1744 wrote to memory of 916	1744	cmd.exe	36
PID 1744 wrote to memory of 1360	1744	cmd.exe	38
PID 1744 wrote to memory of 1360	1744	cmd.exe	38
PID 1744 wrote to memory of 1360	1744	cmd.exe	38
PID 1744 wrote to memory of 1360	1744	cmd.exe	38
PID 1744 wrote to memory of 1156	1744	cmd.exe	39
PID 1744 wrote to memory of 1156	1744	cmd.exe	39
PID 1744 wrote to memory of 1156	1744	cmd.exe	39
PID 1744 wrote to memory of 1156	1744	cmd.exe	39
PID 1744 wrote to memory of 2056	1744	cmd.exe	40
PID 1744 wrote to memory of 2056	1744	cmd.exe	40
PID 1744 wrote to memory of 2056	1744	cmd.exe	40
PID 1744 wrote to memory of 2056	1744	cmd.exe	40
PID 1744 wrote to memory of 772	1744	cmd.exe	41
PID 1744 wrote to memory of 772	1744	cmd.exe	41
PID 1744 wrote to memory of 772	1744	cmd.exe	41
PID 1744 wrote to memory of 772	1744	cmd.exe	41
PID 1744 wrote to memory of 2724	1744	cmd.exe	42
PID 1744 wrote to memory of 2724	1744	cmd.exe	42
PID 1744 wrote to memory of 2724	1744	cmd.exe	42
PID 1744 wrote to memory of 2724	1744	cmd.exe	42
PID 1744 wrote to memory of 2908	1744	cmd.exe	43
PID 1744 wrote to memory of 2908	1744	cmd.exe	43
PID 1744 wrote to memory of 2908	1744	cmd.exe	43
PID 1744 wrote to memory of 2908	1744	cmd.exe	43
PID 1744 wrote to memory of 2936	1744	cmd.exe	44
PID 1744 wrote to memory of 2936	1744	cmd.exe	44
PID 1744 wrote to memory of 2936	1744	cmd.exe	44
PID 1744 wrote to memory of 2936	1744	cmd.exe	44
PID 1744 wrote to memory of 2760	1744	cmd.exe	45
PID 1744 wrote to memory of 2760	1744	cmd.exe	45
PID 1744 wrote to memory of 2760	1744	cmd.exe	45
PID 1744 wrote to memory of 2760	1744	cmd.exe	45
PID 1744 wrote to memory of 2296	1744	cmd.exe	46
PID 1744 wrote to memory of 2296	1744	cmd.exe	46
PID 1744 wrote to memory of 2296	1744	cmd.exe	46
PID 1744 wrote to memory of 2296	1744	cmd.exe	46
PID 1028 wrote to memory of 1332	1028	BoostrappersSv.exe	48
PID 1028 wrote to memory of 1332	1028	BoostrappersSv.exe	48
PID 1028 wrote to memory of 1332	1028	BoostrappersSv.exe	48
PID 1028 wrote to memory of 1332	1028	BoostrappersSv.exe	48
PID 1332 wrote to memory of 1068	1332	cmd.exe	50
PID 1332 wrote to memory of 1068	1332	cmd.exe	50
PID 1332 wrote to memory of 1068	1332	cmd.exe	50
PID 1332 wrote to memory of 1068	1332	cmd.exe	50
PID 1332 wrote to memory of 856	1332	cmd.exe	51
PID 1332 wrote to memory of 856	1332	cmd.exe	51
PID 1332 wrote to memory of 856	1332	cmd.exe	51
PID 1332 wrote to memory of 856	1332	cmd.exe	51
PID 1332 wrote to memory of 1376	1332	cmd.exe	53
PID 1332 wrote to memory of 1376	1332	cmd.exe	53
PID 1332 wrote to memory of 1376	1332	cmd.exe	53
PID 1332 wrote to memory of 1376	1332	cmd.exe	53

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New folder (6).rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2168

C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe
"C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sherman Sherman.cmd & Sherman.cmd
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 775095
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Wells
    3⤵
    - System Location Discovery: System Language Discovery
    PID:772
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Unity" Parker
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 775095\A.com + Isolation + Gaming + Just + Restaurants + Lined + Cisco + Memorabilia + Javascript + Till + Copied 775095\A.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Minute + ..\Troubleshooting + ..\Adopt + ..\Ng + ..\Junior + ..\Dome + ..\Hardcover D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\775095\A.com
    A.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2760
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296

C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe
"C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sherman Sherman.cmd & Sherman.cmd
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:856
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 775095
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1928
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Wells
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 775095\A.com + Isolation + Gaming + Just + Restaurants + Lined + Cisco + Memorabilia + Javascript + Till + Copied 775095\A.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Minute + ..\Troubleshooting + ..\Adopt + ..\Ng + ..\Junior + ..\Dome + ..\Hardcover D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\775095\A.com
    A.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2904
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2776

C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe
"C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sherman Sherman.cmd & Sherman.cmd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:772
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 775095
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Wells
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 775095\A.com + Isolation + Gaming + Just + Restaurants + Lined + Cisco + Memorabilia + Javascript + Till + Copied 775095\A.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Minute + ..\Troubleshooting + ..\Adopt + ..\Ng + ..\Junior + ..\Dome + ..\Hardcover D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\775095\A.com
    A.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2252
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1812

C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe
"C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2948
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sherman Sherman.cmd & Sherman.cmd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2732
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 775095
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1884
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Wells
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 775095\A.com + Isolation + Gaming + Just + Restaurants + Lined + Cisco + Memorabilia + Javascript + Till + Copied 775095\A.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Minute + ..\Troubleshooting + ..\Adopt + ..\Ng + ..\Junior + ..\Dome + ..\Hardcover D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\775095\A.com
    A.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2260
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2200

C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe
"C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sherman Sherman.cmd & Sherman.cmd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1684
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 775095
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2268
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Wells
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 775095\A.com + Isolation + Gaming + Just + Restaurants + Lined + Cisco + Memorabilia + Javascript + Till + Copied 775095\A.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Minute + ..\Troubleshooting + ..\Adopt + ..\Ng + ..\Junior + ..\Dome + ..\Hardcover D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\775095\A.com
    A.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2476
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2424

C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe
"C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sherman Sherman.cmd & Sherman.cmd
  2⤵
  - Loads dropped DLL
  PID:2512
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:768
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 775095
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Wells
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 775095\A.com + Isolation + Gaming + Just + Restaurants + Lined + Cisco + Memorabilia + Javascript + Till + Copied 775095\A.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Minute + ..\Troubleshooting + ..\Adopt + ..\Ng + ..\Junior + ..\Dome + ..\Hardcover D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:992
- - C:\Users\Admin\AppData\Local\Temp\775095\A.com
    A.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2076
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\775095\A.com

Filesize
141KB

MD5
f3ce50ceff989c02845462f2dc949dfe

SHA1
423dd26e93a634ef6c970da50801e5d92c697751

SHA256
a6a41f67a2aa65e817df6e739f0fd5de0dd0403cdad1c361938a30168ef3e9e2

SHA512
52f436d544e0b97ddd9ca6a89e8ca2fff057b4a1ac591c7a7ef07970ecb7dfc8cfa80b2b1fbfe9e8179d4cda7fadaebb6610db3ccb11bb260a014bddd3d3b079

Download Submit
C:\Users\Admin\AppData\Local\Temp\775095\D

Filesize
484KB

MD5
101d2c136ecb5eae9e2227fbd135e0a0

SHA1
f7aee294ea6f373a2b68d2e026f8b3d3e0534a13

SHA256
e53c04ac34b0555dc18e6f54c76cb89a8da454db1395088a6ae2b4d60c501d5f

SHA512
0ee219f476acde0659b0403814f37c2d6d2c8231795429b12595d7e44620fa826ee91d8bd95bd83d0b50ab268599cf70267421111b2b085b8f58b425c7282f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Adopt

Filesize
79KB

MD5
6886393beba38c97b27d8d410e134cb2

SHA1
b75691e8212f1ca5a85553d6f478e0b392f2f470

SHA256
5c31646d53f90cbfe38dbe77efdefd5a502fb59cf507b3aec2d14abeb2343371

SHA512
b1cedade0e55c9b6ea1440ed603d3a2aff741af1332b8602e6563b463741c4f937ab918bfde7bc64de406a99dd7be871a12863d8d6659e060c38d8a93a43fe43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cisco

Filesize
148KB

MD5
eee05379e23f6e331e15b9d2fde3c144

SHA1
d2bcc1e4125ae79589c7a2f0c972136af5f7e29a

SHA256
cd74f7e02a5f11c189511903cada1da73765d3eae7da789654d59f63864c80f3

SHA512
f757ae548979f679b7d1f3c472e10545bb88b894593d99fa0845c62949ddbb0197cf6e11900ca5800682b180212d24eb397f417ae80576301a3ef5548f1839ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Copied

Filesize
3KB

MD5
e9cf3188318dcae0f4e26c3ab6d40dfe

SHA1
d349eb704fd4e36108046e31572bbcbd486f00f2

SHA256
aa3f703259f1901e8614031dd85eae67813e2d5c45d5ade80258677419d45e43

SHA512
7627f779d60827c6d946c71f3731c8c905b2ba0f5049c242f2f15c0191ef7430b7f3fc14bdb1314fda964be94d88c3fc1089d2ca3c17aad62525b735c90d2407

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dome

Filesize
82KB

MD5
e9dc6ae91b63467a414d7341ff4bd3de

SHA1
5d2c0a6a9138f01e347697b7dae668c6059e25c9

SHA256
5a39f3de169fcc32ff697dbaf9ae7c02aefc043313627394c1c900ad53d904a3

SHA512
10685b5fa93d96734990a6a17380149f9733efc49f98ef43ec1ee7e861518057e6c70118c1f4791da9f54435910455e145283ff6ac90ca2b2adadf0e7b78c9d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gaming

Filesize
95KB

MD5
6e0620d62576848bb6aa925488f163a7

SHA1
dbf3b470e7bce8ca4dcc3776683f2f65d0bfb679

SHA256
5bd48ec4e3f92fb5dd323ea694ac2468763e68e4b2600c7329a1a7cc4776ffbe

SHA512
6aa3bc0a2d427a9a325cab94b09301c41272d9b3e6177c356b8695ce6e6d935bb49ea5c398b0393171f07e0455f698c5d2d95a190bedf01af79f7e59034a2efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hardcover

Filesize
19KB

MD5
81bf0ed2db7a09fbf8c49fbb59083d44

SHA1
12200e7d89dae29b220c8820ed5ad56969a83c91

SHA256
639e5cf9dc34e768c546f955d0ea1e2f59b29b9721182dd53e5d55ae7ee05d59

SHA512
bc372e9d4884a817666121038512635c2bc6cf13ab3fc41d37acc0991aa9722f4cb3b3bf9ee1bfdf329ea9c037e996acec5870ec633595838f5ed7324fe4da91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hardcover

Filesize
15KB

MD5
d6981de1cf300241c319ce578b87eebf

SHA1
d9c7a67b0356a8e0aeff1a10d5139fa4dda1ebe9

SHA256
10332482ed55e4b44b8e37a5d22b6649cae9dbf1fb701b9ca833d2a6e73b027f

SHA512
27022b7105f688be5c0db1626ad7248a9a46e52db55d65c4bf27b8f19669013c68825053c8088443d0137c557ca7a65c352c5f1d97f68118bc89314a779b8f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Isolation

Filesize
140KB

MD5
6b340fec1d71e862795bb9d96d018cb1

SHA1
204de0f7face77ef39f566cb56028babeb40ee1d

SHA256
f0a6bb524f3a0f3dca62cd393b41d7fb7c1c712c2391beb93943178d62c94e45

SHA512
55a257d7e3d926907ce2c6fbe1ea722b29658c745f54f7c7673d7286c07492e0b9c4af8648bd8f9637b68ade7b5fb77a73021dbcd968f0d6df9e2ed8a3e065ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Javascript

Filesize
78KB

MD5
99ea837b76cc1361ac98423e62ff5c58

SHA1
43ecd105d28d71dce31b040435f325345b815a3a

SHA256
7ce72f7349c1715ed8f850fbe3a5844219c1d4888a5f0b87793ab17b7e67f736

SHA512
ee6ac90caff2d3e1f1d8d5b9013e8b9b049f8e23b5c526b61b3ca954de6f301afd0c349ab58d54ac69d19f3eef64ebfe00c501c52c45f923288b0389aee3e74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Junior

Filesize
97KB

MD5
2cfcb1382cecb6d66a4b231536a28ef7

SHA1
db3ebeaea4fee05acfb12ceacbd7a24379d25e87

SHA256
133d44f9b2395b44eecf0ea8dac869d182c29c06a4b30dab936e39c201a3bac9

SHA512
803b63433bbfd307db8156558da95628ce85fdcaa5ec100caa63ef27fb47f4219f35e083de2e4a0ae08be2997a484e4441cefacc5b5f61cafb1081a851672fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Junior

Filesize
63KB

MD5
076b1ebfe33c8f7bbd3eb44153e46692

SHA1
b165959c327f4e38a134b750b61a8e5f084f756e

SHA256
d795e012b0349adff4ad238229e27f5a1e2d2e3558385be23777ff50c331e45b

SHA512
eb7fd820eb0f8bfa9e34f6922cf9fb15c156dee44fb82879c1f080c2fc6804a16b944d99a0ce781d2d9f6c27a49fcd5c56235086164c3119235740d4eabc6eb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Just

Filesize
128KB

MD5
c8c42e4cbd2cda70f079cf87bd2cbaf3

SHA1
18867297d36885bb065e6193b9ef1e253e10af69

SHA256
be05352eb9d45c5840c6d33e34706987146d05f11c027b4f36fc4e8beae3ee71

SHA512
cc59f5bf0e5d5435b6f9885d7aecc14ace50ff244708f88996b9fcc6650a66fb877f621bc1728df8eeba6da42dcca2f45024bfe9d9237efa5c434c93d9fde53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lined

Filesize
128KB

MD5
905ba3bbfe600c71f027efdd4953f41c

SHA1
a1f2b35b91332e0b26f0f041b5638437b8cd9f3d

SHA256
3769eb3a46cf3e08d3a79c4ae30f32e2a7bef4453efabef464f0ce62f33f550f

SHA512
4351e6af2ec7e03b7b94e9f3dc8cfcdff39f2d7d99c0ac3a6feafa28e341f9ca29430998f43bf8ee518911e7ab9cd864ff18f64ea8231be4943f3e2aff0b6785

Download Submit
C:\Users\Admin\AppData\Local\Temp\Memorabilia

Filesize
52KB

MD5
2ee47e01fe660de289e570d562393859

SHA1
772298e3844575d494cde79363fa184377b7e25a

SHA256
5f7d99fd4cd7a13fe80535d0fd4ffbf22abf0c4c758a73dd3b528739b3a663fb

SHA512
9709831bdce0307a37cd008a14dea878fbb3d5a8480e03bc07d0696c4c097e5262c7cd9993517c2eb1fb2e12ca24752a446e833430a2a3cef1e004f212057f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Minute

Filesize
57KB

MD5
5a3a9d9dcd7cd202af170e8e52b58dca

SHA1
dbd658f67516c5021fdb28148fd511709257a7af

SHA256
9334e3680b23140fd03ab549f67803aa7871cfb5c085e382d8a3409c79565ec9

SHA512
c7be33389f321026b3fb135b7fc4c2508dc78f886c47cca9efb2a54f043e16fa1ef6fdf469921000078426715de079630e2d9019aa3cf4bbd7553a9d07088c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ng

Filesize
54KB

MD5
6d8a4a18e4ebb415b52e2e4b2592bc3c

SHA1
9bcf73b0375cd03de465df3b1b5c08d54003714b

SHA256
8d5c3831d73f764fcfc3a79f3a0f267d8e9e726e1bdbde8ea58532c9acf582de

SHA512
7b112cfc31f6b3887abba9fe688fa07ef36993fad029b475d5e88be9e142ff37064f357bf8d96fce353980c572760b71709b5994ccabda9eaf38cdfed229fb5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Parker

Filesize
1KB

MD5
d980d64fc5f52b97519a8ce53f6c54f9

SHA1
ecbee164f486ea81f47c53bed8b39a4ca00f7e6b

SHA256
d6d9ee986cde98ee50c50191a075be722e167238f174252b9815eefb34bc1644

SHA512
af872b11c83d5757837fdadca9df9d9838379a951b415b782031ba0cbc2972e79db5ba876c9e1701f23fd6139ea6729447d5c645cc0f18a350a9a1f574061d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Restaurants

Filesize
77KB

MD5
4d97881927e91cc1eeeebcd8d7b104e1

SHA1
a4ec4c8d6b64bf25b0611c2ffcf005ae72cffc09

SHA256
739e9cc3745e7185401ea4e9fb35884d3ce84ad695a774374f7953fc30b7e6ad

SHA512
70dc03087de0aa8aa43bc2502e8e6129c9227222110f53af9f6e4b338a8194b7e865463703301609c107e8a8dd59acb69364473fb8b9ebd01fb12790a79b5ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sherman.cmd

Filesize
7KB

MD5
97c077ea716cc45ff64b68216c02e8fb

SHA1
4a1778a49b03e0f3d45e7d7293d2fb3c108bf2d5

SHA256
6a13f44b6f192ab95e2e4fa627657324957fe2c08c6b27c3581834d9c08777f8

SHA512
52f123c834ce22aa14550833000dfb4b8704ca004b89eb48be69fd6058880296d21db2b9ba0ed00a96a06fbf60ab12d9e623b280771afe97bc0f213b93eb778b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Till

Filesize
74KB

MD5
f823040a3b2660852675a063ee899f4f

SHA1
35df1dd2cd0747da889dea0a769edcb15bcb6885

SHA256
386ed12c899287c3ecc80cf73114cff9ec7241e1c53798d7d70a5604add8a7bb

SHA512
6a1544bc29fe48f2c5a11c524edf2baba2a5688d1b9e2f0695770e8b677581d8a2c9ab5cbf8a6606804dfa7505ca762c50966f1fea44f7ffec90964da69ecdf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Troubleshooting

Filesize
96KB

MD5
58f30bcd78c6fc5fc497628918c6d31c

SHA1
ba424ad8ef20ac53bcad0b23945d86d1a86c037f

SHA256
ecf0b6b07b45980e73f2e83bac8c123c994e1838f85750b866b21d2ecc4742d2

SHA512
5d58cc4c3c6ef34f32e377ddd1099c17f1bfa1825b4c1c15eed5f66f5430461774285c63cbeba60623261d8fc5006a516eea0580e119ce04dcb565334e957ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wells

Filesize
478KB

MD5
d39e97cc0e0be786d253646af368ef73

SHA1
ab915406f71fc7bfd6b409d1301131225335c381

SHA256
9c1f28beb5f9c45089e965fc4bee65f13a64a9e201cb079d5a1d5bcd9847dfe8

SHA512
7ede66f72deeafc0a0500392461c3b2ce37d7eb2b760ad0f5f141e00c2d1de5bb54b222360bab92e62a2d83853f8a1aa4322b695ba9746baba9ffd649f7f6a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wells

Filesize
412KB

MD5
a91a4d4f20864b79cce6a3ce1d4665f5

SHA1
3eda84c7215d37b782883f7fcc7488e2d83dba77

SHA256
21c2726ec5004a6eb49f9a8178c76e7a4fdaae43d45b03365fc353d18973b8ab

SHA512
aec3519a4b33483b162554ffb9a1bd4e5232b094797e91c1eaea677dc6ee072646cb716baba214a54e87d31baabf6fd9ea51848d676a98760ec8e58dbd897431

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wells

Filesize
126KB

MD5
a7285d7e0b266141c037773ea0886218

SHA1
4aef8a588833135c5210ae09bbc67d1162810dec

SHA256
8a01a7b1dad51891769463ad62ae7bda129eb0027c3eb43324668d266e1472e2

SHA512
32470f6e0b3508220d0481bd16f454ac39d2f96a3788372e10cd70497021be425ad3057102cfa730be17d46e600c69d4efbc152ed53c662752e11be589a66e61

Download Submit
C:\Users\Admin\Desktop\New folder (6)\BoostrappersSv.exe

Filesize
1.1MB

MD5
363a51e95adbad71753bcb5674316536

SHA1
0e45bc776c0447c348ecd6764c04ecf14a3c6602

SHA256
50053689dc55232b8df6601c03021b8fd62696bdcae3fcc4ab412ff730f24eb2

SHA512
a2c7b3bcc8abf08ed96b5295a17f04c947f01a1b665f016d2a1ff053bce0a366871b687fd9f541f58095ad749f4854db412f4f8fe7c7e5e40e51390a270a38f4

Download Submit
\Users\Admin\AppData\Local\Temp\775095\A.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
memory/2760-906-0x0000000003720000-0x000000000377B000-memory.dmp

Filesize
364KB

Download
memory/2760-907-0x0000000003720000-0x000000000377B000-memory.dmp

Filesize
364KB

Download
memory/2760-908-0x0000000003720000-0x000000000377B000-memory.dmp

Filesize
364KB

Download
memory/2760-909-0x0000000003720000-0x000000000377B000-memory.dmp

Filesize
364KB

Download
memory/2760-910-0x0000000003720000-0x000000000377B000-memory.dmp

Filesize
364KB

Download