salatstealer | 28a26cfeb59075825d9ed5308c048f5727251f9d8032e2cb741744f151a32730

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
113s
max time network
118s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-uk
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-uklocale:uk-uaos:windows10-ltsc_2021-x64systemwindows
submitted
30/10/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan CRACK Forever/Nursultan.exe
Size 15.8MB
Sample261030-p189mact5s
SHA256 28a26cfeb59075825d9ed5308c048f5727251f9d8032e2cb741744f151a32730
MD5 f093bfdddaebec4a4fd0512538f85eb5
SHA1 73322ec73005d374c7ec984f39576ab4e8cfc6d3
SHA512 4beaa85c7ab82cf8ce5e3434b0738efd9e75a0b24948e5f2bf2d3ca05c952201db9e4ac00d84c84a6d00ab96f0c18bd70b53b35322007022deaaa48f7cedc820
SSDEEP 393216:0KaFvN74hqFkojMIColXKchAa2N+idjK9h4Pd:0bFNkha3INolKBREed
TLSH
T1EBF6228125D5C6FCC48687F8E24615F9F0D37C8899FDD41BEF87A422FA31928C8E5626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery salatstealer persistence spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 16 IoCs

resource	yara_rule
behavioral2/memory/3792-15-0x0000000000780000-0x00000000013D7000-memory.dmp	family_salatstealer
behavioral2/memory/3792-16-0x0000000000780000-0x00000000013D7000-memory.dmp	family_salatstealer
behavioral2/memory/3792-18-0x0000000000780000-0x00000000013D7000-memory.dmp	family_salatstealer
behavioral2/memory/3792-25-0x0000000000780000-0x00000000013D7000-memory.dmp	family_salatstealer
behavioral2/memory/4492-29-0x0000000000160000-0x0000000000DB7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-30-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-31-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-32-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/1468-51-0x0000000000CE0000-0x0000000001937000-memory.dmp	family_salatstealer
behavioral2/memory/2124-61-0x0000000000CE0000-0x0000000001937000-memory.dmp	family_salatstealer
behavioral2/memory/2848-62-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-87-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-90-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-91-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-92-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer
behavioral2/memory/2848-93-0x0000000000250000-0x0000000000EA7000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
50	1820	powershell.exe
51	1820	powershell.exe
52	1820	powershell.exe
53	1820	powershell.exe
54	1820	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
5696	Nursultan.exe
3792	svchost.exe
2848	WUDFHost.exe
4492	lsass.exe
1468	WUDFHost.exe
2124	WUDFHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "C:\\Program Files (x86)\\Windows Mail\\lsass.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WUDFHost = "C:\\Program Files (x86)\\Windows Defender\\WUDFHost.exe"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5696	Nursultan.exe
5696	Nursultan.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0002000000027396-8.dat	upx
behavioral2/memory/3792-11-0x0000000000780000-0x00000000013D7000-memory.dmp	upx
behavioral2/memory/3792-15-0x0000000000780000-0x00000000013D7000-memory.dmp	upx
behavioral2/memory/3792-16-0x0000000000780000-0x00000000013D7000-memory.dmp	upx
behavioral2/memory/3792-18-0x0000000000780000-0x00000000013D7000-memory.dmp	upx
behavioral2/memory/2848-24-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/3792-25-0x0000000000780000-0x00000000013D7000-memory.dmp	upx
behavioral2/memory/4492-28-0x0000000000160000-0x0000000000DB7000-memory.dmp	upx
behavioral2/memory/4492-29-0x0000000000160000-0x0000000000DB7000-memory.dmp	upx
behavioral2/memory/2848-30-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/2848-31-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/2848-32-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/1468-37-0x0000000000CE0000-0x0000000001937000-memory.dmp	upx
behavioral2/memory/1468-51-0x0000000000CE0000-0x0000000001937000-memory.dmp	upx
behavioral2/memory/2124-57-0x0000000000CE0000-0x0000000001937000-memory.dmp	upx
behavioral2/memory/2124-61-0x0000000000CE0000-0x0000000001937000-memory.dmp	upx
behavioral2/memory/2848-62-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/2848-87-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/2848-90-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/2848-91-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/2848-92-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx
behavioral2/memory/2848-93-0x0000000000250000-0x0000000000EA7000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\01892569-e419-fc68-3024-4f31fed469e4	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\lsass.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\01892569-e419-fc68-3024-4f31fed469e4	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\WUDFHost.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\WUDFHost.exe	WUDFHost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe	WUDFHost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 7 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WUDFHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WUDFHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WUDFHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WUDFHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	lsass.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3792	svchost.exe
3792	svchost.exe
3792	svchost.exe
3792	svchost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
1820	powershell.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
1820	powershell.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe
2848	WUDFHost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeIncreaseQuotaPrivilege	1820	powershell.exe
Token: SeSecurityPrivilege	1820	powershell.exe
Token: SeTakeOwnershipPrivilege	1820	powershell.exe
Token: SeLoadDriverPrivilege	1820	powershell.exe
Token: SeSystemProfilePrivilege	1820	powershell.exe
Token: SeSystemtimePrivilege	1820	powershell.exe
Token: SeProfSingleProcessPrivilege	1820	powershell.exe
Token: SeIncBasePriorityPrivilege	1820	powershell.exe
Token: SeCreatePagefilePrivilege	1820	powershell.exe
Token: SeBackupPrivilege	1820	powershell.exe
Token: SeRestorePrivilege	1820	powershell.exe
Token: SeShutdownPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeSystemEnvironmentPrivilege	1820	powershell.exe
Token: SeRemoteShutdownPrivilege	1820	powershell.exe
Token: SeUndockPrivilege	1820	powershell.exe
Token: SeManageVolumePrivilege	1820	powershell.exe
Token: 33	1820	powershell.exe
Token: 34	1820	powershell.exe
Token: 35	1820	powershell.exe
Token: 36	1820	powershell.exe
Token: SeIncreaseQuotaPrivilege	1820	powershell.exe
Token: SeSecurityPrivilege	1820	powershell.exe
Token: SeTakeOwnershipPrivilege	1820	powershell.exe
Token: SeLoadDriverPrivilege	1820	powershell.exe
Token: SeSystemProfilePrivilege	1820	powershell.exe
Token: SeSystemtimePrivilege	1820	powershell.exe
Token: SeProfSingleProcessPrivilege	1820	powershell.exe
Token: SeIncBasePriorityPrivilege	1820	powershell.exe
Token: SeCreatePagefilePrivilege	1820	powershell.exe
Token: SeBackupPrivilege	1820	powershell.exe
Token: SeRestorePrivilege	1820	powershell.exe
Token: SeShutdownPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeSystemEnvironmentPrivilege	1820	powershell.exe
Token: SeRemoteShutdownPrivilege	1820	powershell.exe
Token: SeUndockPrivilege	1820	powershell.exe
Token: SeManageVolumePrivilege	1820	powershell.exe
Token: 33	1820	powershell.exe
Token: 34	1820	powershell.exe
Token: 35	1820	powershell.exe
Token: 36	1820	powershell.exe
Token: SeIncreaseQuotaPrivilege	1820	powershell.exe
Token: SeSecurityPrivilege	1820	powershell.exe
Token: SeTakeOwnershipPrivilege	1820	powershell.exe
Token: SeLoadDriverPrivilege	1820	powershell.exe
Token: SeSystemProfilePrivilege	1820	powershell.exe
Token: SeSystemtimePrivilege	1820	powershell.exe
Token: SeProfSingleProcessPrivilege	1820	powershell.exe
Token: SeIncBasePriorityPrivilege	1820	powershell.exe
Token: SeCreatePagefilePrivilege	1820	powershell.exe
Token: SeBackupPrivilege	1820	powershell.exe
Token: SeRestorePrivilege	1820	powershell.exe
Token: SeShutdownPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeSystemEnvironmentPrivilege	1820	powershell.exe
Token: SeRemoteShutdownPrivilege	1820	powershell.exe
Token: SeUndockPrivilege	1820	powershell.exe
Token: SeManageVolumePrivilege	1820	powershell.exe
Token: 33	1820	powershell.exe
Token: 34	1820	powershell.exe
Token: 35	1820	powershell.exe
Token: 36	1820	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 5696	1008	Nursultan.exe	83
PID 1008 wrote to memory of 3792	1008	Nursultan.exe	84
PID 3792 wrote to memory of 2848	3792	svchost.exe	92
PID 2848 wrote to memory of 1820	2848	WUDFHost.exe	96
PID 2848 wrote to memory of 1468	2848	WUDFHost.exe	98
PID 2848 wrote to memory of 2124	2848	WUDFHost.exe	101
PID 1820 wrote to memory of 2820	1820	powershell.exe	104

C:\Users\Admin\AppData\Local\Temp\Nursultan CRACK Forever\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan CRACK Forever\Nursultan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\ProgramData\Microsoft\Windows\WER\Temp\b54b200ca01d\Nursultan.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\b54b200ca01d\Nursultan.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5696
- C:\ProgramData\Microsoft\Windows\WER\Temp\b54b200ca01d\svchost.exe
  "C:\ProgramData\Microsoft\Windows\WER\Temp\b54b200ca01d\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Program Files (x86)\Windows Defender\WUDFHost.exe
    "C:\Program Files (x86)\Windows Defender\WUDFHost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      UAC bypass
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        "C:\Windows\system32\ReAgentc.exe" /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2820
  - - C:\Program Files\Google\Chrome\Application\WUDFHost.exe
      "C:\Program Files\Google\Chrome\Application\WUDFHost.exe" -
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe" -
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:2124

C:\Program Files (x86)\Windows Mail\lsass.exe
"C:\Program Files (x86)\Windows Mail\lsass.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Debugger Evasion

T1622

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Debugger Evasion

T1622

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nursultan.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\b54b200ca01d\Nursultan.exe
Size 12.3MB
SHA256 bea9831956dbce3124b718783509470ea6d0f67e1cfe2c326128a384ad830827
MD5 52e511c63a294c231d11bb9bdd71b461
SHA1 e5e192bd3100fb58be51659e5b1b25618959cf6b
SHA512 0e2689d38d804a7c9cca6584e9ff32a0a23e5b4d229a11520efd68b3d88f81d8f0b0d178f82dda3faa61f44e0681ce9003c402c0c6de899fff26e0e8b3751d52
SSDEEP 196608:KupQ2aLpvuiI5UX49jSnF/8oLHlvqEjCgdcArX3gXw8chAagCb1wBNDLcnLgrBM:KKaFvN74hqFkojMIColXKchAa2N+iM
TLSH
T15FD6128525D0D6FCC48187F8E24615FAF0D77C8899FDD41BEF87A422FA31928C8E5626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\ProgramData\Microsoft\Windows\WER\Temp\b54b200ca01d\svchost.exe
Size 3.4MB
SHA256 e5e1ea80048f5a71abc31b77e463885dd80d9dd5bd17de1568a937d2895e3f2f
MD5 7d2b9ce9c6e28d67cba986bc1ec52038
SHA1 9592b9edc4f4a66acd0195bf5b307a3bd0ef9d9c
SHA512 e400c98d944a4415d8ed427fa3ab47f93e39514f21ab5bfefe3d64881051cd81a4ceab22e107edd64a66b183a277fbebb5a8e4b2154ebb4e811f77addc4cb00e
SSDEEP 49152:oLLzhDK613wGxvfKSYqZSyKP3bXfGGjNjymzvuB+TKqxu569uYKN0Z81:oThuM3lx3K9qZSBvbuwzvE+H4Gu881
TLSH
T10DF53311980F0EECF91B5CF3E5E67F2150A6CA4B5BD3B43F000A5A01B6CA42D96E758E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jy2blpt1.3er.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jy2blpt1.3er.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1008-0-0x0000000000620000-0x0000000000642000-memory.dmp

Download

memory/1468-37-0x0000000000CE0000-0x0000000001937000-memory.dmp

Download

memory/1468-51-0x0000000000CE0000-0x0000000001937000-memory.dmp

Download

memory/1820-75-0x0000000007A70000-0x0000000007B13000-memory.dmp

Download

memory/1820-76-0x0000000008200000-0x000000000887A000-memory.dmp

Download

memory/1820-81-0x0000000008E30000-0x00000000093D6000-memory.dmp

Download

memory/1820-80-0x0000000007F40000-0x0000000007F62000-memory.dmp

Download

memory/1820-79-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Download

memory/1820-78-0x0000000007C10000-0x0000000007C1A000-memory.dmp

Download

memory/1820-77-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Download

memory/1820-74-0x0000000007A50000-0x0000000007A6E000-memory.dmp

Download

memory/1820-64-0x0000000007A10000-0x0000000007A42000-memory.dmp

Download

memory/1820-65-0x0000000070DF0000-0x0000000070E3C000-memory.dmp

Download

memory/1820-66-0x00000000710B0000-0x0000000071407000-memory.dmp

Download

memory/1820-63-0x0000000006C80000-0x0000000006CC4000-memory.dmp

Download

memory/1820-38-0x0000000002B90000-0x0000000002BC6000-memory.dmp

Download

memory/1820-39-0x0000000005760000-0x0000000005E2A000-memory.dmp

Download

memory/1820-43-0x0000000005E30000-0x0000000005E96000-memory.dmp

Download

memory/1820-42-0x00000000056E0000-0x0000000005746000-memory.dmp

Download

memory/1820-41-0x0000000005640000-0x0000000005662000-memory.dmp

Download

memory/1820-59-0x00000000065C0000-0x000000000660C000-memory.dmp

Download

memory/1820-52-0x0000000006020000-0x0000000006377000-memory.dmp

Download

memory/1820-58-0x0000000006580000-0x000000000659E000-memory.dmp

Download

memory/2124-61-0x0000000000CE0000-0x0000000001937000-memory.dmp

Download

memory/2124-57-0x0000000000CE0000-0x0000000001937000-memory.dmp

Download

memory/2848-24-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-93-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-92-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-62-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-91-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-32-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-31-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-30-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-90-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/2848-87-0x0000000000250000-0x0000000000EA7000-memory.dmp

Download

memory/3792-11-0x0000000000780000-0x00000000013D7000-memory.dmp

Download

memory/3792-25-0x0000000000780000-0x00000000013D7000-memory.dmp

Download

memory/3792-18-0x0000000000780000-0x00000000013D7000-memory.dmp

Download

memory/3792-16-0x0000000000780000-0x00000000013D7000-memory.dmp

Download

memory/3792-15-0x0000000000780000-0x00000000013D7000-memory.dmp

Download

memory/4492-28-0x0000000000160000-0x0000000000DB7000-memory.dmp

Download

memory/4492-29-0x0000000000160000-0x0000000000DB7000-memory.dmp

Download

memory/5696-17-0x0000000140000000-0x00000001416C5000-memory.dmp

Download

memory/5696-14-0x0000000140000000-0x00000001416C5000-memory.dmp

Download

memory/5696-13-0x0000000140213000-0x0000000140A85000-memory.dmp

Download