umbral | 257f3886ec3712e93b4358a75a0bbedd236bae9d4f0ecb899664dd751de78f1b

Analysis

max time kernel
1045s
max time network
1044s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperNew.exe
Size

3.2MB
MD5

5d7608bf288d15a463991dd64a4a6833
SHA1

568225dbe01f06297daedce0f7a161bc20c3f121
SHA256

257f3886ec3712e93b4358a75a0bbedd236bae9d4f0ecb899664dd751de78f1b
SHA512

af3c3b12066eedfdf7302ad1632d475c29cc74a7627584773e556a2ad7779102ae0f431192fb6404a7d191a7a38eda9e46d3d406f569de066a4d5a426f7218fb
SSDEEP

98304:f0HJOQVG56a9CyT3hpbMhtYy/z+SSoYzYnix:wA2s6aUyT3hWr+FoUYn

Score

10^/10

umbral xworm execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:34930

minimum-ball.gl.at.ply.gg:34930

Attributes

Install_directory
%AppData%
install_file
SolaraX.exe

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023d4c-20.dat	family_umbral
behavioral2/memory/5104-27-0x000001EA9A3F0000-0x000001EA9A430000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023d51-43.dat	family_xworm
behavioral2/memory/4784-51-0x0000000000010000-0x0000000000028000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1908	powershell.exe
4480	powershell.exe
4536	powershell.exe
4716	powershell.exe
3860	powershell.exe
3468	powershell.exe
2924	powershell.exe
1736	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Solara.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	SolaraX.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	BootstrapperNew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation	BootstrapperNe.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraX.lnk	SolaraX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraX.lnk	SolaraX.exe

Executes dropped EXE 21 IoCs

pid	Process
2188	BootstrapperNe.exe
5104	Solara.exe
1020	SolaraNew.exe
4784	SolaraX.exe
3768	SolaraX.exe
3088	SolaraX.exe
1052	SolaraX.exe
4308	SolaraX.exe
2604	SolaraX.exe
3988	SolaraX.exe
5108	SolaraX.exe
1288	SolaraX.exe
2044	SolaraX.exe
1412	SolaraX.exe
1200	SolaraX.exe
4900	SolaraX.exe
5108	SolaraX.exe
2932	SolaraX.exe
4472	SolaraX.exe
2220	SolaraX.exe
3624	SolaraX.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SolaraX = "C:\\Users\\Admin\\AppData\\Roaming\\SolaraX.exe"	SolaraX.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1092	wmic.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1908	powershell.exe
1908	powershell.exe
2924	powershell.exe
2924	powershell.exe
1736	powershell.exe
1736	powershell.exe
4480	powershell.exe
4480	powershell.exe
4324	powershell.exe
4324	powershell.exe
4536	powershell.exe
4536	powershell.exe
4716	powershell.exe
4716	powershell.exe
3860	powershell.exe
3860	powershell.exe
3468	powershell.exe
3468	powershell.exe
4784	SolaraX.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	Solara.exe
Token: SeDebugPrivilege	4784	SolaraX.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4236	wmic.exe
Token: SeSecurityPrivilege	4236	wmic.exe
Token: SeTakeOwnershipPrivilege	4236	wmic.exe
Token: SeLoadDriverPrivilege	4236	wmic.exe
Token: SeSystemProfilePrivilege	4236	wmic.exe
Token: SeSystemtimePrivilege	4236	wmic.exe
Token: SeProfSingleProcessPrivilege	4236	wmic.exe
Token: SeIncBasePriorityPrivilege	4236	wmic.exe
Token: SeCreatePagefilePrivilege	4236	wmic.exe
Token: SeBackupPrivilege	4236	wmic.exe
Token: SeRestorePrivilege	4236	wmic.exe
Token: SeShutdownPrivilege	4236	wmic.exe
Token: SeDebugPrivilege	4236	wmic.exe
Token: SeSystemEnvironmentPrivilege	4236	wmic.exe
Token: SeRemoteShutdownPrivilege	4236	wmic.exe
Token: SeUndockPrivilege	4236	wmic.exe
Token: SeManageVolumePrivilege	4236	wmic.exe
Token: 33	4236	wmic.exe
Token: 34	4236	wmic.exe
Token: 35	4236	wmic.exe
Token: 36	4236	wmic.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeIncreaseQuotaPrivilege	4236	wmic.exe
Token: SeSecurityPrivilege	4236	wmic.exe
Token: SeTakeOwnershipPrivilege	4236	wmic.exe
Token: SeLoadDriverPrivilege	4236	wmic.exe
Token: SeSystemProfilePrivilege	4236	wmic.exe
Token: SeSystemtimePrivilege	4236	wmic.exe
Token: SeProfSingleProcessPrivilege	4236	wmic.exe
Token: SeIncBasePriorityPrivilege	4236	wmic.exe
Token: SeCreatePagefilePrivilege	4236	wmic.exe
Token: SeBackupPrivilege	4236	wmic.exe
Token: SeRestorePrivilege	4236	wmic.exe
Token: SeShutdownPrivilege	4236	wmic.exe
Token: SeDebugPrivilege	4236	wmic.exe
Token: SeSystemEnvironmentPrivilege	4236	wmic.exe
Token: SeRemoteShutdownPrivilege	4236	wmic.exe
Token: SeUndockPrivilege	4236	wmic.exe
Token: SeManageVolumePrivilege	4236	wmic.exe
Token: 33	4236	wmic.exe
Token: 34	4236	wmic.exe
Token: 35	4236	wmic.exe
Token: 36	4236	wmic.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	4508	wmic.exe
Token: SeSecurityPrivilege	4508	wmic.exe
Token: SeTakeOwnershipPrivilege	4508	wmic.exe
Token: SeLoadDriverPrivilege	4508	wmic.exe
Token: SeSystemProfilePrivilege	4508	wmic.exe
Token: SeSystemtimePrivilege	4508	wmic.exe
Token: SeProfSingleProcessPrivilege	4508	wmic.exe
Token: SeIncBasePriorityPrivilege	4508	wmic.exe
Token: SeCreatePagefilePrivilege	4508	wmic.exe
Token: SeBackupPrivilege	4508	wmic.exe
Token: SeRestorePrivilege	4508	wmic.exe
Token: SeShutdownPrivilege	4508	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4784	SolaraX.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2188	1832	BootstrapperNew.exe	84
PID 1832 wrote to memory of 2188	1832	BootstrapperNew.exe	84
PID 2188 wrote to memory of 5104	2188	BootstrapperNe.exe	85
PID 2188 wrote to memory of 5104	2188	BootstrapperNe.exe	85
PID 2188 wrote to memory of 1020	2188	BootstrapperNe.exe	86
PID 2188 wrote to memory of 1020	2188	BootstrapperNe.exe	86
PID 2188 wrote to memory of 4784	2188	BootstrapperNe.exe	87
PID 2188 wrote to memory of 4784	2188	BootstrapperNe.exe	87
PID 5104 wrote to memory of 1908	5104	Solara.exe	88
PID 5104 wrote to memory of 1908	5104	Solara.exe	88
PID 5104 wrote to memory of 2924	5104	Solara.exe	91
PID 5104 wrote to memory of 2924	5104	Solara.exe	91
PID 5104 wrote to memory of 1736	5104	Solara.exe	93
PID 5104 wrote to memory of 1736	5104	Solara.exe	93
PID 4784 wrote to memory of 4480	4784	SolaraX.exe	95
PID 4784 wrote to memory of 4480	4784	SolaraX.exe	95
PID 5104 wrote to memory of 4324	5104	Solara.exe	97
PID 5104 wrote to memory of 4324	5104	Solara.exe	97
PID 4784 wrote to memory of 4536	4784	SolaraX.exe	99
PID 4784 wrote to memory of 4536	4784	SolaraX.exe	99
PID 5104 wrote to memory of 4236	5104	Solara.exe	101
PID 5104 wrote to memory of 4236	5104	Solara.exe	101
PID 4784 wrote to memory of 4716	4784	SolaraX.exe	103
PID 4784 wrote to memory of 4716	4784	SolaraX.exe	103
PID 4784 wrote to memory of 3860	4784	SolaraX.exe	106
PID 4784 wrote to memory of 3860	4784	SolaraX.exe	106
PID 5104 wrote to memory of 4508	5104	Solara.exe	108
PID 5104 wrote to memory of 4508	5104	Solara.exe	108
PID 5104 wrote to memory of 2020	5104	Solara.exe	110
PID 5104 wrote to memory of 2020	5104	Solara.exe	110
PID 5104 wrote to memory of 3468	5104	Solara.exe	112
PID 5104 wrote to memory of 3468	5104	Solara.exe	112
PID 5104 wrote to memory of 1092	5104	Solara.exe	115
PID 5104 wrote to memory of 1092	5104	Solara.exe	115
PID 4784 wrote to memory of 4760	4784	SolaraX.exe	118
PID 4784 wrote to memory of 4760	4784	SolaraX.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\BootstrapperNe.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperNe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4324
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4236
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4508
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:2020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3468
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1092
- - C:\Users\Admin\AppData\Local\Temp\SolaraNew.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraNew.exe"
    3⤵
    - Executes dropped EXE
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\SolaraX.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraX.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraX.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraX.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SolaraX.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraX.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3860
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SolaraX" /tr "C:\Users\Admin\AppData\Roaming\SolaraX.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4760

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:3768

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:1052

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:4308

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:3988

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:5108

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:1288

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:2044

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:1412

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:5108

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:2932

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:2220

C:\Users\Admin\AppData\Roaming\SolaraX.exe
C:\Users\Admin\AppData\Roaming\SolaraX.exe
1⤵
- Executes dropped EXE
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SolaraX.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
c65738617888921a153bd9b1ef516ee7

SHA1
5245e71ea3c181d76320c857b639272ac9e079b1

SHA256
4640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26

SHA512
2e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c053efee8dff843f61cc5d35ba3504fc

SHA1
2238428cb7cc1b0f19f70be81f1b66e44c0891a6

SHA256
2ce0625f77cbba5805037b4325e3e63bd46166ba2011ebc16f5b0c5b61a87920

SHA512
7095cdef657787ea6f8e7860b5b8759e9664206541c4e38977d85aada5c44e4d9c57c8b834f494ebc74d7c54caea98927c31d6e96e099f06858839d8940e4f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
005ec6a1bbd097d4e3dbf047e863eb3f

SHA1
5bfd3568f2b7a420ae9584447c1d783b91342162

SHA256
6955721dbcb62414606020f27fe04242875c0ff3c15d206d49ef022171c4dbc5

SHA512
2afea8a7f4b061f87b71ad9695234967eed7dada06b5ce59bb18de34ca4bcfae666feff2a15189367061a4809563480afb04d7ecfc69abe4e7a88087a5f276a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a2c8179aaa149c0b9791b73ce44c04d1

SHA1
703361b0d43ec7f669304e7c0ffbbfdeb1e484ff

SHA256
c1d30342a40a2b6e7553da30ceb85754d33820f6fbb3bbbed1ceb30d6390de4a

SHA512
2e201dd457d055baad86f68c15bcc7beb48d6dc2ffc10db7f304eb93f697e7b45991cbde857d25da2c9c60c23f3e13df8b5ed5809c1753737a23096e296cc9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperNe.exe

Filesize
3.2MB

MD5
d88ee0d360d34eedfbc293290a73616a

SHA1
42e76126180ad0837cf5df031e1716081b091000

SHA256
6ade19e337fb670efee7a84e1ef68501c4dfcbfd10f57f8332539fbe1447ffb0

SHA512
1b4d40c733d65e7f42935a838a4922dc89ffd9bb35d4ccce8dce9b0825742a54e12f81bf84f698c4cf02b5b51d5f4f2e78922afc7949ebce8c481ab559c479c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.exe

Filesize
227KB

MD5
58e07162ded5e3a8a3ed89e3386d6d7d

SHA1
57bd70b8bc62e1715e4d67ebf7fd67c3d795712d

SHA256
acb94b9228a393f88637b7296b08ebc7c73b9d47162de6be7a15cdfa3d59a929

SHA512
0abfda8019dc37095db7f35ff4cdeb3256a0b469e8283fb16d2238e1454030435ef5ef4f5615bfb2243765eab0e21c33fc173ff01cb49ef6ff5b503146eeb137

Download Submit
C:\Users\Admin\AppData\Local\Temp\SolaraNew.exe

Filesize
2.9MB

MD5
f227cdfd423b3cc03bb69c49babf4da3

SHA1
3db5a97d9b0f2545e7ba97026af6c28512200441

SHA256
cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8

SHA512
b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SolaraX.exe

Filesize
74KB

MD5
aef41983064b12d1e648100e8141bf19

SHA1
b258d4a810e818e9c9dcaba62f75f34036b60fcd

SHA256
834bcea2665dc99b4c16fe87095f3e2b44e2e013ec1017407a061a1203c2f3cf

SHA512
2e4e3fdf7cd1892b73cf1989dfd82d91c677653a4501f44bb2d74b153b72982e069998b5bef097a7645970838c13ac86ec546173f6baf3afb7cbc26e6c9d5524

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_spgrjfre.2an.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1020-73-0x000001E133350000-0x000001E13335A000-memory.dmp

Filesize
40KB

Download
memory/1020-54-0x000001E1153E0000-0x000001E1153F0000-memory.dmp

Filesize
64KB

Download
memory/1020-66-0x000001E133370000-0x000001E1333A8000-memory.dmp

Filesize
224KB

Download
memory/1020-68-0x000001E134630000-0x000001E134730000-memory.dmp

Filesize
1024KB

Download
memory/1020-67-0x000001E12F7D0000-0x000001E12F7DE000-memory.dmp

Filesize
56KB

Download
memory/1020-71-0x000001E133360000-0x000001E133368000-memory.dmp

Filesize
32KB

Download
memory/1020-52-0x000001E114D30000-0x000001E115012000-memory.dmp

Filesize
2.9MB

Download
memory/1020-72-0x000001E1333E0000-0x000001E1333F6000-memory.dmp

Filesize
88KB

Download
memory/1020-70-0x000001E1333B0000-0x000001E1333D6000-memory.dmp

Filesize
152KB

Download
memory/1020-74-0x000001E133340000-0x000001E13334A000-memory.dmp

Filesize
40KB

Download
memory/1020-69-0x000001E133330000-0x000001E13333A000-memory.dmp

Filesize
40KB

Download
memory/1020-75-0x000001E133410000-0x000001E133418000-memory.dmp

Filesize
32KB

Download
memory/1020-65-0x000001E12F780000-0x000001E12F788000-memory.dmp

Filesize
32KB

Download
memory/1832-1-0x00000000004E0000-0x0000000000818000-memory.dmp

Filesize
3.2MB

Download
memory/1832-0-0x00007FFE31A73000-0x00007FFE31A75000-memory.dmp

Filesize
8KB

Download
memory/1908-60-0x00000252FFA70000-0x00000252FFA92000-memory.dmp

Filesize
136KB

Download
memory/2188-15-0x00000000001E0000-0x0000000000514000-memory.dmp

Filesize
3.2MB

Download
memory/2188-53-0x00007FFE31A70000-0x00007FFE32531000-memory.dmp

Filesize
10.8MB

Download
memory/2188-14-0x00007FFE31A70000-0x00007FFE32531000-memory.dmp

Filesize
10.8MB

Download
memory/4784-210-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/4784-51-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download
memory/5104-95-0x000001EA9C080000-0x000001EA9C09E000-memory.dmp

Filesize
120KB

Download
memory/5104-27-0x000001EA9A3F0000-0x000001EA9A430000-memory.dmp

Filesize
256KB

Download
memory/5104-153-0x000001EAB4CB0000-0x000001EAB4CBA000-memory.dmp

Filesize
40KB

Download
memory/5104-154-0x000001EAB4CF0000-0x000001EAB4D02000-memory.dmp

Filesize
72KB

Download
memory/5104-198-0x000001EAB48E0000-0x000001EAB49E2000-memory.dmp

Filesize
1.0MB

Download
memory/5104-94-0x000001EA9C0A0000-0x000001EA9C0F0000-memory.dmp

Filesize
320KB

Download
memory/5104-93-0x000001EAB4C30000-0x000001EAB4CA6000-memory.dmp

Filesize
472KB

Download