lumma | a2f306363494e264feb5af0420a352a368a5ce62425272aad92417a49d09c383

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lnjector.exe
Size

343KB
MD5

6a28e5842aaca1c5753c1cb1cc5e92e1
SHA1

8f1172554a664380ade11d42c46d064de69659f9
SHA256

a2f306363494e264feb5af0420a352a368a5ce62425272aad92417a49d09c383
SHA512

18be44ea2c83ce82542cfd8e6aa6fd7931b6fb5003e0273baa757e34c2725dae02726d55fcb8227260cb87fc5877238e7f6a5e2a42592de7d7219bc498d30d8a
SSDEEP

3072:aT8Yu0lqBiqoCbpIaIumKbo8PT/mUdm+H+u1h3JOcXsAWmsoBJ3voV54fhFBlgpO:wqXbmaHaASUdm+H+u19JMAWlqoQZFKO

Score

10^/10

lumma execution stealer

Malware Config

Extracted

Family

lumma

https://applyzxcksdia.shop/api

https://replacedoxcjzp.shop/api

https://declaredczxi.shop/api

https://catchddkxozvp.shop/api

https://arriveoxpzxo.shop/api

https://contemplateodszsv.shop/api

https://bindceasdiwozx.shop/api

https://conformfucdioz.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1164	powershell.exe
3516	powershell.exe
1688	powershell.exe
3476	powershell.exe
4192	powershell.exe
4188	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	lnjector.exe

Executes dropped EXE 6 IoCs

pid	Process
4976	file1.exe
2120	file1.exe
1724	file1.exe
5084	file1.exe
2340	file1.exe
2500	file1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
33	bitbucket.org
51	bitbucket.org
84	bitbucket.org
100	bitbucket.org
112	bitbucket.org
124	bitbucket.org
137	bitbucket.org
32	bitbucket.org

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 980	4976	file1.exe	95
PID 2120 set thread context of 4540	2120	file1.exe	99
PID 1724 set thread context of 4964	1724	file1.exe	103
PID 5084 set thread context of 1468	5084	file1.exe	108
PID 2340 set thread context of 2692	2340	file1.exe	112
PID 2500 set thread context of 3908	2500	file1.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	powershell.exe
3516	powershell.exe
1688	powershell.exe
1688	powershell.exe
3476	powershell.exe
3476	powershell.exe
4192	powershell.exe
4192	powershell.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
4188	powershell.exe
4188	powershell.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1164	powershell.exe
1164	powershell.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	1064	taskmgr.exe
Token: SeSystemProfilePrivilege	1064	taskmgr.exe
Token: SeCreateGlobalPrivilege	1064	taskmgr.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe
1064	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3516	2656	lnjector.exe	90
PID 2656 wrote to memory of 3516	2656	lnjector.exe	90
PID 2656 wrote to memory of 4976	2656	lnjector.exe	92
PID 2656 wrote to memory of 4976	2656	lnjector.exe	92
PID 2656 wrote to memory of 4976	2656	lnjector.exe	92
PID 2656 wrote to memory of 1688	2656	lnjector.exe	93
PID 2656 wrote to memory of 1688	2656	lnjector.exe	93
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 4976 wrote to memory of 980	4976	file1.exe	95
PID 2656 wrote to memory of 2120	2656	lnjector.exe	96
PID 2656 wrote to memory of 2120	2656	lnjector.exe	96
PID 2656 wrote to memory of 2120	2656	lnjector.exe	96
PID 2656 wrote to memory of 3476	2656	lnjector.exe	97
PID 2656 wrote to memory of 3476	2656	lnjector.exe	97
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2120 wrote to memory of 4540	2120	file1.exe	99
PID 2656 wrote to memory of 1724	2656	lnjector.exe	100
PID 2656 wrote to memory of 1724	2656	lnjector.exe	100
PID 2656 wrote to memory of 1724	2656	lnjector.exe	100
PID 2656 wrote to memory of 4192	2656	lnjector.exe	101
PID 2656 wrote to memory of 4192	2656	lnjector.exe	101
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 1724 wrote to memory of 4964	1724	file1.exe	103
PID 2656 wrote to memory of 5084	2656	lnjector.exe	105
PID 2656 wrote to memory of 5084	2656	lnjector.exe	105
PID 2656 wrote to memory of 5084	2656	lnjector.exe	105
PID 2656 wrote to memory of 4188	2656	lnjector.exe	106
PID 2656 wrote to memory of 4188	2656	lnjector.exe	106
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 5084 wrote to memory of 1468	5084	file1.exe	108
PID 2656 wrote to memory of 2340	2656	lnjector.exe	109
PID 2656 wrote to memory of 2340	2656	lnjector.exe	109
PID 2656 wrote to memory of 2340	2656	lnjector.exe	109
PID 2656 wrote to memory of 1164	2656	lnjector.exe	110
PID 2656 wrote to memory of 1164	2656	lnjector.exe	110
PID 2340 wrote to memory of 2692	2340	file1.exe	112

C:\Users\Admin\AppData\Local\Temp\lnjector.exe
"C:\Users\Admin\AppData\Local\Temp\lnjector.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Users\Admin\AppData\Local\file1.exe
  "C:\Users\Admin\AppData\Local\file1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\winhlp32.exe
    "C:\Windows\winhlp32.exe"
    3⤵
    PID:980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Users\Admin\AppData\Local\file1.exe
  "C:\Users\Admin\AppData\Local\file1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\winhlp32.exe
    "C:\Windows\winhlp32.exe"
    3⤵
    PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Users\Admin\AppData\Local\file1.exe
  "C:\Users\Admin\AppData\Local\file1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\winhlp32.exe
    "C:\Windows\winhlp32.exe"
    3⤵
    PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Users\Admin\AppData\Local\file1.exe
  "C:\Users\Admin\AppData\Local\file1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\winhlp32.exe
    "C:\Windows\winhlp32.exe"
    3⤵
    PID:1468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Users\Admin\AppData\Local\file1.exe
  "C:\Users\Admin\AppData\Local\file1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\winhlp32.exe
    "C:\Windows\winhlp32.exe"
    3⤵
    PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Users\Admin\AppData\Local\file1.exe
  "C:\Users\Admin\AppData\Local\file1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2500
- - C:\Windows\winhlp32.exe
    "C:\Windows\winhlp32.exe"
    3⤵
    PID:3908

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
3a0138bae64e9d60c25031699bdf3538

SHA1
064b6da66e705629e7a96d3446b6b75d340abd3c

SHA256
9e79c64d8ec3fa6f1851203b8e12803ba6149966b697c15eff73b1ff95c573fa

SHA512
b63091a1869cf7816e8c77fd71b4d98e2d06c5a167483d2a1ecaf0dd0a0bb086ed6ca8daa9dac3783f4d19c5cee65dd7681f8a7bf0bc8d157433f84f959cc2e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
90ce0c56e10a354f7e71746d4d20df88

SHA1
bcb15cc662f9a6f02fad4d6f79009270ed7d3f17

SHA256
954c18911f60f9c428e8ed674548b1ea3fd5d515419f11bdc2af0d3b5448c04a

SHA512
0102535560d7a3b810378d515a79fbfbdcd3526f21451e468e4870667091e1f248d3851aed2fa2320a2eed64ebced3b7f728cf31a2082564166b165f7cbde3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9451a6b9669d49bd90704dff21beb85

SHA1
5f93d2dec01a31e04fc90c28eb1c5ca62c6fff80

SHA256
b2ff191507379930b97a212f869c3774c20b274e8fc9fcc96da5c154fb0e3056

SHA512
06634cb578f6ce8d721e6306004082073fc224b91ceea37ef870df87b12b2d5f59e7d08b20b520787a1d13f3edbbb004197bf70f180f86dd7f401a5ad289ccb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_enw0t0k3.1md.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\file1.exe

Filesize
260KB

MD5
3a6216790c466ae5a522869bd56899f7

SHA1
a32dd8aaae9c34258b2261c712d4ef623c9d5412

SHA256
b037359b3e7539fb9510f703c8d697339750701262665ad1610d23ecb8095685

SHA512
aaf6632bc4c463758ac76882d63ec73bb3d4dbb2220a7d09697120aef615995189059caaeebea09f0c42dff2b07d897eb3b267f4deba8018992de50fbdeb4dc1

Download Submit
memory/980-57-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/980-58-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1064-112-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-108-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-107-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-109-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-110-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-101-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-103-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-102-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-113-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/1064-111-0x0000017A0DDF0000-0x0000017A0DDF1000-memory.dmp

Filesize
4KB

Download
memory/2656-16-0x00007FF878893000-0x00007FF878894000-memory.dmp

Filesize
4KB

Download
memory/2656-59-0x00007FF878893000-0x00007FF878894000-memory.dmp

Filesize
4KB

Download
memory/2656-138-0x00007FF878893000-0x00007FF878894000-memory.dmp

Filesize
4KB

Download
memory/3516-0-0x00007FF868333000-0x00007FF868335000-memory.dmp

Filesize
8KB

Download
memory/3516-12-0x00007FF868330000-0x00007FF868DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3516-15-0x00007FF868330000-0x00007FF868DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3516-11-0x00007FF868330000-0x00007FF868DF1000-memory.dmp

Filesize
10.8MB

Download
memory/3516-3-0x00000204534A0000-0x00000204534C2000-memory.dmp

Filesize
136KB

Download