umbral | bf88cf4cc27b384d615ed9cf9468534c65f5336817d9f8c0695560380feda5b9

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SolaraBootstrapper.exe
Size

617KB
MD5

ba3a75b046dca34cdc0eb91139ac3a6b
SHA1

7cb6f6cc53fbc1d34732005616360868038e51f9
SHA256

bf88cf4cc27b384d615ed9cf9468534c65f5336817d9f8c0695560380feda5b9
SHA512

6ee0c8947faa0db7a5ee523c3b8c3fd12d2bd45ba5a445ffffcf0f34606007ec3d257329473375fa30dff0e053d4e26b7aa5c574e1179a414f0dc93f1993eb98
SSDEEP

6144:45aMJNLwL73PZPkFr1jilzqqVWk6855JKSFtIooEbQ5mUHo7EB9mxXTSj3A+8dwg:4OxPkPjQeqQ1Y53KR5ZH/9mxXR+jWC7I

Score

10^/10

umbral xworm credential_access execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:33700

21.ip.gl.ply.gg:33700

Attributes

Install_directory
%Public%
install_file
solara.exe

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023446-17.dat	family_umbral
behavioral1/memory/3056-27-0x000001970DC40000-0x000001970DC80000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000023444-8.dat	family_xworm
behavioral1/memory/2812-30-0x0000000000B30000-0x0000000000B46000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2340	powershell.exe
2456	powershell.exe
3944	powershell.exe
4416	powershell.exe
2436	powershell.exe
3996	powershell.exe
5112	powershell.exe
4724	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	DllInstaller.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	SolaraBootstrapper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Inject.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\solara.lnk	Inject.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\solara.lnk	Inject.exe

Executes dropped EXE 2 IoCs

pid	Process
2812	Inject.exe
3056	DllInstaller.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\solara = "C:\\Users\\Public\\solara.exe"	Inject.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	discord.com
25	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3140	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3580	wmic.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	SolaraBootstrapper.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3056	DllInstaller.exe
4724	powershell.exe
4724	powershell.exe
2340	powershell.exe
2340	powershell.exe
2456	powershell.exe
2456	powershell.exe
4544	powershell.exe
4544	powershell.exe
4416	powershell.exe
4416	powershell.exe
2436	powershell.exe
2436	powershell.exe
3996	powershell.exe
3996	powershell.exe
3944	powershell.exe
3944	powershell.exe
5112	powershell.exe
5112	powershell.exe
2812	Inject.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	Inject.exe
Token: SeDebugPrivilege	3056	DllInstaller.exe
Token: SeIncreaseQuotaPrivilege	1984	wmic.exe
Token: SeSecurityPrivilege	1984	wmic.exe
Token: SeTakeOwnershipPrivilege	1984	wmic.exe
Token: SeLoadDriverPrivilege	1984	wmic.exe
Token: SeSystemProfilePrivilege	1984	wmic.exe
Token: SeSystemtimePrivilege	1984	wmic.exe
Token: SeProfSingleProcessPrivilege	1984	wmic.exe
Token: SeIncBasePriorityPrivilege	1984	wmic.exe
Token: SeCreatePagefilePrivilege	1984	wmic.exe
Token: SeBackupPrivilege	1984	wmic.exe
Token: SeRestorePrivilege	1984	wmic.exe
Token: SeShutdownPrivilege	1984	wmic.exe
Token: SeDebugPrivilege	1984	wmic.exe
Token: SeSystemEnvironmentPrivilege	1984	wmic.exe
Token: SeRemoteShutdownPrivilege	1984	wmic.exe
Token: SeUndockPrivilege	1984	wmic.exe
Token: SeManageVolumePrivilege	1984	wmic.exe
Token: 33	1984	wmic.exe
Token: 34	1984	wmic.exe
Token: 35	1984	wmic.exe
Token: 36	1984	wmic.exe
Token: SeIncreaseQuotaPrivilege	1984	wmic.exe
Token: SeSecurityPrivilege	1984	wmic.exe
Token: SeTakeOwnershipPrivilege	1984	wmic.exe
Token: SeLoadDriverPrivilege	1984	wmic.exe
Token: SeSystemProfilePrivilege	1984	wmic.exe
Token: SeSystemtimePrivilege	1984	wmic.exe
Token: SeProfSingleProcessPrivilege	1984	wmic.exe
Token: SeIncBasePriorityPrivilege	1984	wmic.exe
Token: SeCreatePagefilePrivilege	1984	wmic.exe
Token: SeBackupPrivilege	1984	wmic.exe
Token: SeRestorePrivilege	1984	wmic.exe
Token: SeShutdownPrivilege	1984	wmic.exe
Token: SeDebugPrivilege	1984	wmic.exe
Token: SeSystemEnvironmentPrivilege	1984	wmic.exe
Token: SeRemoteShutdownPrivilege	1984	wmic.exe
Token: SeUndockPrivilege	1984	wmic.exe
Token: SeManageVolumePrivilege	1984	wmic.exe
Token: 33	1984	wmic.exe
Token: 34	1984	wmic.exe
Token: 35	1984	wmic.exe
Token: 36	1984	wmic.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeIncreaseQuotaPrivilege	3680	wmic.exe
Token: SeSecurityPrivilege	3680	wmic.exe
Token: SeTakeOwnershipPrivilege	3680	wmic.exe
Token: SeLoadDriverPrivilege	3680	wmic.exe
Token: SeSystemProfilePrivilege	3680	wmic.exe
Token: SeSystemtimePrivilege	3680	wmic.exe
Token: SeProfSingleProcessPrivilege	3680	wmic.exe
Token: SeIncBasePriorityPrivilege	3680	wmic.exe
Token: SeCreatePagefilePrivilege	3680	wmic.exe
Token: SeBackupPrivilege	3680	wmic.exe
Token: SeRestorePrivilege	3680	wmic.exe
Token: SeShutdownPrivilege	3680	wmic.exe
Token: SeDebugPrivilege	3680	wmic.exe
Token: SeSystemEnvironmentPrivilege	3680	wmic.exe
Token: SeRemoteShutdownPrivilege	3680	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2812	Inject.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2812	2372	SolaraBootstrapper.exe	84
PID 2372 wrote to memory of 2812	2372	SolaraBootstrapper.exe	84
PID 2372 wrote to memory of 3056	2372	SolaraBootstrapper.exe	86
PID 2372 wrote to memory of 3056	2372	SolaraBootstrapper.exe	86
PID 2372 wrote to memory of 2448	2372	SolaraBootstrapper.exe	87
PID 2372 wrote to memory of 2448	2372	SolaraBootstrapper.exe	87
PID 3056 wrote to memory of 1984	3056	DllInstaller.exe	90
PID 3056 wrote to memory of 1984	3056	DllInstaller.exe	90
PID 3056 wrote to memory of 4724	3056	DllInstaller.exe	94
PID 3056 wrote to memory of 4724	3056	DllInstaller.exe	94
PID 3056 wrote to memory of 2340	3056	DllInstaller.exe	96
PID 3056 wrote to memory of 2340	3056	DllInstaller.exe	96
PID 3056 wrote to memory of 2456	3056	DllInstaller.exe	98
PID 3056 wrote to memory of 2456	3056	DllInstaller.exe	98
PID 3056 wrote to memory of 4544	3056	DllInstaller.exe	100
PID 3056 wrote to memory of 4544	3056	DllInstaller.exe	100
PID 2812 wrote to memory of 4416	2812	Inject.exe	102
PID 2812 wrote to memory of 4416	2812	Inject.exe	102
PID 3056 wrote to memory of 3680	3056	DllInstaller.exe	104
PID 3056 wrote to memory of 3680	3056	DllInstaller.exe	104
PID 2812 wrote to memory of 2436	2812	Inject.exe	106
PID 2812 wrote to memory of 2436	2812	Inject.exe	106
PID 3056 wrote to memory of 4688	3056	DllInstaller.exe	108
PID 3056 wrote to memory of 4688	3056	DllInstaller.exe	108
PID 2812 wrote to memory of 3996	2812	Inject.exe	110
PID 2812 wrote to memory of 3996	2812	Inject.exe	110
PID 3056 wrote to memory of 3000	3056	DllInstaller.exe	112
PID 3056 wrote to memory of 3000	3056	DllInstaller.exe	112
PID 3056 wrote to memory of 3944	3056	DllInstaller.exe	114
PID 3056 wrote to memory of 3944	3056	DllInstaller.exe	114
PID 2812 wrote to memory of 5112	2812	Inject.exe	116
PID 2812 wrote to memory of 5112	2812	Inject.exe	116
PID 3056 wrote to memory of 3580	3056	DllInstaller.exe	118
PID 3056 wrote to memory of 3580	3056	DllInstaller.exe	118
PID 2812 wrote to memory of 1068	2812	Inject.exe	120
PID 2812 wrote to memory of 1068	2812	Inject.exe	120
PID 1068 wrote to memory of 3140	1068	cmd.exe	122
PID 1068 wrote to memory of 3140	1068	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372
- C:\ProgramData\Solara\Inject.exe
  "C:\ProgramData\Solara\Inject.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Solara\Inject.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Inject.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'solara.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE1F4.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:3140
- C:\ProgramData\Solara\DllInstaller.exe
  "C:\ProgramData\Solara\DllInstaller.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Solara\DllInstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" computersystem get totalphysicalmemory
    3⤵
    PID:4688
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3944
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3580
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Solara\Crash.vbs"
  2⤵
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Solara\Crash.vbs

Filesize
94B

MD5
2036c45500cda0b7adfeb278cafe60dc

SHA1
652734e0023f7bab23f3cba7bac013b63adb0932

SHA256
f9b11a844bcf51a7012c64a9b5d2ed8a71d2ebfaa1ed79bcdc06666cd422c438

SHA512
dafa4b2ef88e7b167316f106c9889aead2552efe270ad0b1cc0d5bab0d33d6c73dcf7f386f23ea9709163c5f6e9e822255352bbb25137e2cb48d2eca5f484a1c

Download Submit
C:\ProgramData\Solara\DllInstaller.exe

Filesize
229KB

MD5
dc24b6e92e759790fde782b104326979

SHA1
7561be98eb5e517d2fe7997948c5537222cbe8b1

SHA256
97beb74fbbb969354d75a2711cd504373398cabfa234f4ba9c7b55ee150a9a68

SHA512
cfe670744bd36acb27c5cccdf1fce3838cdcc3d0f772e80b972add5288b88cb9750fcf7fb42cd82fe3d75c67cb66d755c10b8b9dce179f072dbb29ebbed01358

Download Submit
C:\ProgramData\Solara\Inject.exe

Filesize
63KB

MD5
b506d2df9eb086ae9b8cd777fb3369ee

SHA1
78a48a14ee257fcc6c4d3f03c5382278ccbae75d

SHA256
6fd8b19f0e1443dfd9827db8e221d0d7221d9343b68a0713e34949f632f65f3b

SHA512
506a811d06a1d63801071dffc0080144df256dfd054753d62aafaa7d95b97d17882a489083c63a4b61ca03b235080c5dd56d40252ebbdf5de22d0d575b186507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ec79fae4e7c09310ebf4f2d85a33a638

SHA1
f2bdd995b12e65e7ed437d228f22223b59e76efb

SHA256
e9c4723a5fe34e081c3d2f548a1d472394cc7aa58056fcf44ca542061381243a

SHA512
af9dda12f6bb388d826fe03a4a8beed9bda23a978aa55a2af6a43271660ee896a7ee3bcf2c4d2f1e6180902791d8c23560f1c2ec097a501d8c6f4f6c49075625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
04458928e3f9e73cc25a1ecffbe6a3a7

SHA1
0d88fd95ecd00d5692b4d0573d7eff27cbc68b65

SHA256
15e7df5cc2cddbcf8796ebefa5eb7abc5f30f2f287b1f7cf31ee3420170d6170

SHA512
ede340d701eebf6e2ca95e40ce0d6cd0ab16df6d1f1146b9aa458d9e2c92054a7a33cdf6d8c4010acf4575dd4c44b1e4f30006e672b2afbffbeb3df38c28f2a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3072fa0040b347c3941144486bf30c6f

SHA1
e6dc84a5bd882198583653592f17af1bf8cbfc68

SHA256
da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e

SHA512
62df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef647504cf229a16d02de14a16241b90

SHA1
81480caca469857eb93c75d494828b81e124fda0

SHA256
47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710

SHA512
a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
ad131c8b53093f1b673385910693d7a3

SHA1
d1948974be7bdbf63f85c132ce81f7e4a71ede2f

SHA256
63b31d22e538288f6adcd34311b222a9e77c668093f12146d0c2d078698c4376

SHA512
9e0682979b727dacc054df93a1eb7c26210d9cf6ab79b85cc2e4bf91d92ada282499ef2a3df82ef3408f1ed1e0ad71a70f0086e4d6cfb4b2c50d015085ad1813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xju1vvge.ksp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE1F4.tmp.bat

Filesize
146B

MD5
db5df5f06f9614940a31849f3d5d0e3a

SHA1
bbf3dd080e0d8e3075db3cfd3787b9866c1eb15f

SHA256
1b9fdbb7b8e08f957b60515f30c099851c253ae7612137459c752d5907ff1544

SHA512
99a53a0f2d05665906fbad8a0b239c1f3154e03ca684904249ceec6506df6c8c9c664df76e4f848ae736fd0e319789422290f44610f7264c15998131b6db0391

Download Submit
memory/2812-24-0x00007FF9D4703000-0x00007FF9D4705000-memory.dmp

Filesize
8KB

Download
memory/2812-30-0x0000000000B30000-0x0000000000B46000-memory.dmp

Filesize
88KB

Download
memory/2812-165-0x00007FF9D4703000-0x00007FF9D4705000-memory.dmp

Filesize
8KB

Download
memory/3056-61-0x00000197282A0000-0x00000197282BE000-memory.dmp

Filesize
120KB

Download
memory/3056-97-0x000001970F9F0000-0x000001970F9FA000-memory.dmp

Filesize
40KB

Download
memory/3056-98-0x0000019728240000-0x0000019728252000-memory.dmp

Filesize
72KB

Download
memory/3056-31-0x00007FF9D4700000-0x00007FF9D51C1000-memory.dmp

Filesize
10.8MB

Download
memory/3056-27-0x000001970DC40000-0x000001970DC80000-memory.dmp

Filesize
256KB

Download
memory/3056-60-0x0000019728470000-0x00000197284C0000-memory.dmp

Filesize
320KB

Download
memory/3056-164-0x00007FF9D4700000-0x00007FF9D51C1000-memory.dmp

Filesize
10.8MB

Download
memory/3056-59-0x00000197283F0000-0x0000019728466000-memory.dmp

Filesize
472KB

Download
memory/4724-42-0x0000021B9F9D0000-0x0000021B9F9F2000-memory.dmp

Filesize
136KB

Download