asyncrat | 80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe
Size

7.7MB
MD5

41ab78eba18f74db196c3876f49179a8
SHA1

d0b573aafe0ae84468027929ca77f3013e8edeee
SHA256

80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21
SHA512

d37d91027df02cd3cd9799f183ffb21955933b27abd7810593bc33df18ac321c166d5a378ba9f50a34c907a1f3071b5b8370c6329f3d7ec223a240e8992dc68c
SSDEEP

98304:vXYJ3MN/dOFAjqbqLSRlFNjZUlzCCgOU4dcRTzJ1dX/jC7PYxg5N0arG2sD0+9h0:AJcbvq+SrVXCJUs+TzJLLpILrXs

Score

10^/10

asyncrat xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

Attributes

Install_directory
%ProgramData%
install_file
SecurityHealthSystray.exe
telegram
https://api.telegram.org/bot5370417334:AAEZrEauqhTNZInhZ9_-SaapQJIi0hIvjJU

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 8 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231ff-63.dat	family_xworm
behavioral2/memory/2808-68-0x0000000000A00000-0x0000000000A64000-memory.dmp	family_xworm
behavioral2/files/0x00070000000231ff-60.dat	family_xworm
behavioral2/files/0x00070000000231ff-53.dat	family_xworm
behavioral2/files/0x0007000000023225-207.dat	family_xworm
behavioral2/files/0x0007000000023225-206.dat	family_xworm
behavioral2/files/0x0007000000023225-213.dat	family_xworm
behavioral2/files/0x0007000000023225-217.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 13 IoCs

rat

resource	yara_rule
behavioral2/memory/1780-97-0x0000000000610000-0x000000000085A000-memory.dmp	asyncrat
behavioral2/files/0x00090000000231fa-91.dat	asyncrat
behavioral2/files/0x00090000000231fa-83.dat	asyncrat
behavioral2/files/0x00090000000231fa-76.dat	asyncrat
behavioral2/memory/868-137-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-141-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-144-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-143-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-142-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-140-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-139-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-138-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat
behavioral2/memory/868-129-0x0000000000400000-0x0000000000692000-memory.dmp	asyncrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	tab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	WindowsSecurity.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk	WindowsSecurity.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk	WindowsSecurity.exe

Executes dropped EXE 9 IoCs

pid	Process
3544	tab.exe
2628	Conhost.exe
1364	Seting.exe
2748	SecurityHealthSystray.exe
2808	WindowsSecurity.exe
1780	splwow64.exe
1960	WindowsSecurity.exe
4928	WindowsSecurity.exe
3820	WindowsSecurity.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\ProgramData\\WindowsSecurity.exe"	WindowsSecurity.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 868	1364	Seting.exe	100

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	SecurityHealthSystray.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2724	schtasks.exe
1444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
1364	Seting.exe
1364	Seting.exe
1364	Seting.exe
1364	Seting.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
868	RegAsm.exe
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
3188	powershell.exe
3188	powershell.exe
3188	powershell.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	WindowsSecurity.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	1364	Seting.exe
Token: SeDebugPrivilege	868	RegAsm.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1780	splwow64.exe
Token: SeDebugPrivilege	1780	splwow64.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	2808	WindowsSecurity.exe
Token: SeDebugPrivilege	1960	WindowsSecurity.exe
Token: SeDebugPrivilege	4928	WindowsSecurity.exe
Token: SeDebugPrivilege	3820	WindowsSecurity.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2808	WindowsSecurity.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3544	876	80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe	91
PID 876 wrote to memory of 3544	876	80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe	91
PID 876 wrote to memory of 3544	876	80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe	91
PID 3544 wrote to memory of 4552	3544	tab.exe	103
PID 3544 wrote to memory of 4552	3544	tab.exe	103
PID 3544 wrote to memory of 4552	3544	tab.exe	103
PID 3544 wrote to memory of 2628	3544	tab.exe	112
PID 3544 wrote to memory of 2628	3544	tab.exe	112
PID 3544 wrote to memory of 1364	3544	tab.exe	94
PID 3544 wrote to memory of 1364	3544	tab.exe	94
PID 3544 wrote to memory of 1364	3544	tab.exe	94
PID 3544 wrote to memory of 2748	3544	tab.exe	95
PID 3544 wrote to memory of 2748	3544	tab.exe	95
PID 3544 wrote to memory of 2748	3544	tab.exe	95
PID 3544 wrote to memory of 2808	3544	tab.exe	102
PID 3544 wrote to memory of 2808	3544	tab.exe	102
PID 2628 wrote to memory of 1780	2628	Conhost.exe	96
PID 2628 wrote to memory of 1780	2628	Conhost.exe	96
PID 1364 wrote to memory of 4640	1364	Seting.exe	101
PID 1364 wrote to memory of 4640	1364	Seting.exe	101
PID 1364 wrote to memory of 4640	1364	Seting.exe	101
PID 1364 wrote to memory of 3708	1364	Seting.exe	98
PID 1364 wrote to memory of 3708	1364	Seting.exe	98
PID 1364 wrote to memory of 3708	1364	Seting.exe	98
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 1364 wrote to memory of 868	1364	Seting.exe	100
PID 868 wrote to memory of 4764	868	RegAsm.exe	106
PID 868 wrote to memory of 4764	868	RegAsm.exe	106
PID 868 wrote to memory of 4764	868	RegAsm.exe	106
PID 4764 wrote to memory of 2724	4764	cmd.exe	131
PID 4764 wrote to memory of 2724	4764	cmd.exe	131
PID 4764 wrote to memory of 2724	4764	cmd.exe	131
PID 2808 wrote to memory of 2864	2808	WindowsSecurity.exe	107
PID 2808 wrote to memory of 2864	2808	WindowsSecurity.exe	107
PID 2808 wrote to memory of 2348	2808	WindowsSecurity.exe	109
PID 2808 wrote to memory of 2348	2808	WindowsSecurity.exe	109
PID 2808 wrote to memory of 3188	2808	WindowsSecurity.exe	111
PID 2808 wrote to memory of 3188	2808	WindowsSecurity.exe	111
PID 2808 wrote to memory of 1444	2808	WindowsSecurity.exe	114
PID 2808 wrote to memory of 1444	2808	WindowsSecurity.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe
"C:\Users\Admin\AppData\Local\Temp\80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:876
- C:\ProgramData\tab.exe
  "C:\ProgramData\tab.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Roaming\Protected.exe
    "C:\Users\Admin\AppData\Roaming\Protected.exe"
    3⤵
    PID:2628
  - - C:\Users\Admin\AppData\Roaming\splwow64.exe
      "C:\Users\Admin\AppData\Roaming\splwow64.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\Users\Admin\AppData\Roaming\Seting.exe
    "C:\Users\Admin\AppData\Roaming\Seting.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:3708
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Seting" /tr '"C:\Users\Admin\AppData\Local\Temp\%Windows%\Seting.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4764
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4640
- - C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
    "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2748
- - C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
    "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2348
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSecurity.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3188
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\ProgramData\WindowsSecurity.exe"
      4⤵
      Creates scheduled task(s)
      PID:1444
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAcQBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAZgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAegBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AawBpACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4552

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Seting" /tr '"C:\Users\Admin\AppData\Local\Temp\%Windows%\Seting.exe"'
1⤵
- Creates scheduled task(s)
PID:2724

C:\ProgramData\WindowsSecurity.exe
C:\ProgramData\WindowsSecurity.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\ProgramData\WindowsSecurity.exe
C:\ProgramData\WindowsSecurity.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:2724

C:\ProgramData\WindowsSecurity.exe
C:\ProgramData\WindowsSecurity.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WindowsSecurity.exe

Filesize
141KB

MD5
cd193387c79bf8deeb078dee3b6fb2f6

SHA1
81b2d17246b98180449e6be9903b838e124fb5c9

SHA256
d7cbdd7320d65ec1217ed6b8cc2de778feb39ad82ad5f38931d7c3c16094172f

SHA512
76db72d78e1dd7e10820250bdaa9128f886c0d195a3f34793802399c06867d7c83518dd185827cd8e420f8e3520b030c0bea5056809cf4ca897c2e37188f0d7e

Download Submit
C:\ProgramData\WindowsSecurity.exe

Filesize
85KB

MD5
cb6593071f94e78ee7c5a7ee36440391

SHA1
98ca912b5e456bb0136e0c17be95f23c9d13dc87

SHA256
50a1bd93d768a8f809230428eb5f6560874b295297ce6746408252ded76ee336

SHA512
76a35e0d0b5ed712e4ca9e18c4402ed90e501a17d878baaf13c4960fbb51a34a2f90a16e29fafefa11050d2ac99e01587c51b60a516356d4d4ad1b60833dfdd9

Download Submit
C:\ProgramData\WindowsSecurity.exe

Filesize
28KB

MD5
228d315982fc8af6695da9ad00ce7dde

SHA1
86bc93492708e5aa780ccc7f8192a581e0a6c536

SHA256
6e6944ce03db7a435f6256e47cd09da7b80e135a8dd0c185e2ac1557ec23cfb7

SHA512
a45071ce5ec9962dab40f72801a98a974635ce242df077b4851b15b9b28b68464de163783bc3bb8aeb7d3b2ca7404e335033be74b11359c46a7d62eab3b9fd6e

Download Submit
C:\ProgramData\WindowsSecurity.exe

Filesize
375KB

MD5
216ef921adac2bbb51ff6331f61b19e7

SHA1
90c3cfc3b78daa2bfa12d26dbd765fbfd4bc510d

SHA256
5d717d35b913ff6d13c408f294d899ca58bb321598426eca2bea71b9e6edd9ce

SHA512
33b817fe0b8bcca66173dd293de6a4926b5195a990ee575a378eb4c71610dc68bb3e36b70f4498bd8a2fc9d12283b05a8fd296d2108554105f0e49fdb9e89f0c

Download Submit
C:\ProgramData\tab.exe

Filesize
29KB

MD5
3f841406667490efebdadae20598dd43

SHA1
3686db18fc8123a42beeed2c5a597ccd6cb4aa6a

SHA256
af910e4908438646bce44fff74b7f69ae07780a97d20603416ffc945f010ff41

SHA512
b31acc0e11c0fe940811c116a1c9b9c93a4b42781f8f6a0450b398761967c7bd769b1f1e52e43d4bec30b7f389e1c60af744a63c012ba744a7e0f88cb716da5c

Download Submit
C:\ProgramData\tab.exe

Filesize
62KB

MD5
09a70251ab02692503ab46c25649cc1c

SHA1
5df2f41621e4424784e5323ed70ee3cdcc0d182b

SHA256
5571870e1a7803bf5ba3acef36d72a8950d7ffcb03e7022ae111d1e9acdd1927

SHA512
333bf3186e3303a871e435161b7b382541ccca82da82a62f37c8bb6952bab566d93f1ac80f0dcee20d06b5a76ce90cdaede82c785b6ed6f0bc2e7326f8ab7813

Download Submit
C:\ProgramData\tab.exe

Filesize
54KB

MD5
a94d4bf3bd969f56cb88b11a5f4901a3

SHA1
c975df920fb5e2a1b9fc6b6ae7cc2019b6c994ae

SHA256
10d8dc40eb44705fe4ad9b8391f435c7e91de8a7d8f176a2f8f109f2f393d01c

SHA512
afa218629e538eb55e87c77f53668d7c745a62d369597ee7d6f302b0da6d80ff91abb1016aba1c90e0daa23c9506e9375fc81704c8bd181337d050243a91d1a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsSecurity.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
8b4d40199663876a753aca1ad667f5da

SHA1
d72aa1d451c2837d15db1cb4ddb3b6d51c175042

SHA256
50362ac2ef6272fccf45e3aed489f5f2eba41678a68a2fdd50edd53a4c958bf5

SHA512
e2b3aeb1f8637e6531774ca319da5458beb476159c75541ce8d3aa9499bf49e375607e0df4a893984b12d9933caf11f9faab4f95d5283085a0d891edabb614ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
41ac47e52d901688f4c46823eb12c6ae

SHA1
c80f6ae3584d3ebd94b753dd7ef1039ed541f078

SHA256
ab4a7be7634267aaf9c5db321924ee34f6e8c97267bf0844138bde233c409c8f

SHA512
1ccb1c694c6d61027b223cf7c79ce5fdc6046a4a32dc15f22b722d6f063c127f4b5f5f3740f2c8b2447504f54d6e0d9afa47d202a61946e29bbcbac41d83c5b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dd9ccfa032ff7bac4e38bc9f25bbc4e1

SHA1
75210a2cca407cf3d1dffeda5f5f756fee48685e

SHA256
568e5bc3255d8769d6019913ac4d0ec1db63a147d42be0c73f46280da7a1a8d3

SHA512
6ddb9a7b0645c4c46babee9697cbb35ea9733a7984582369c5d31f182bdffb33be68671b1183fbf6c5456bc4a23f441587857e09289f5a9e8b20f20f44cc028d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fn4uawpu.kzx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Protected.exe

Filesize
174KB

MD5
9a91cd652fe6da66e436af7111a8a128

SHA1
20626cf2a579e414dd6398e14ec35046d2c199b4

SHA256
141c2c776843ceef46b040b6e82d5d5302707841098288fb36841fd3dc705b57

SHA512
96a39e2bdd81753cb1c756745439a83a6d816acaeb6c9e1161f22323140ade0bbd1b1156662736f242ba81816de7b3d338a7e60b4cc37d29b5e0fe0fdb2125fd

Download Submit
C:\Users\Admin\AppData\Roaming\Protected.exe

Filesize
104KB

MD5
2393b55f8f032f44eee394514601b608

SHA1
7c68d7addb48d1068e201cbf9c0e13dcb17116c7

SHA256
892d5f498b60d2b1a46ef6494228b7759acc1855d191f462b6689ab6c09100b4

SHA512
e409b850afc3aad9c3c204fdec0ccb5babaa782187bc8fd76bf2e7af35b851997ae5d406926479346d37f92858101f35aa50c887e81017dced5a64a1e5bb89c9

Download Submit
C:\Users\Admin\AppData\Roaming\Protected.exe

Filesize
1KB

MD5
ada2bcdfb14d0b5ba5441949c1404e21

SHA1
7a503dcbbc80d71fdcb4e687f5665480d569378a

SHA256
6cab421de4ede68a8e486004cdd8b1f8cad2a55d32dd506d4712f0b88d9c2357

SHA512
3cf3a72a3232d8c00ae1e8c4e1e3bda6050be9a4b7e0cc771d02313ebfe93877ff38ece3215983aafb9176b49ee081f3567a971f370ed1789cb68215d69707d5

Download Submit
C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe

Filesize
42KB

MD5
de55572818656124fc5c2d31d37957a6

SHA1
17d5c7c264bcfd34f39f1fef9a2676ad4ee19c79

SHA256
ae3a4f51cdc9d14f7cabfb247650631493fcaab705fb1afe09a1f3d3f3d3f07d

SHA512
665253ed9aeb02b43004aff3ecf09bd17a59b6702f0f066d4c663470506cfb5ae8e53e7674be216f666487a3ec04600a5d8ca7f5e45c6eb37fbe2a2ba9f54f10

Download Submit
C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe

Filesize
67KB

MD5
bcbd10ef5b923c01945bb00b18378721

SHA1
b7413ec6c691f98b6573e29535d6e9a8db501e2c

SHA256
6aca1eb7a8a55688865179cd935fc0d2c59f6bc622761151d66cc22b5673f856

SHA512
77bf75b7b57835a050c5f47085c435f1f18e4fc801522ca83c22b5dd1fdbde266ce9a36ad079570c32464976e39eb5c6363368e7acb8505c354130fbd1a9d203

Download Submit
C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe

Filesize
35KB

MD5
0642b88c542cec91f853306c4cf88db3

SHA1
84f9c3e4c1f2a952429fb504176a240b6de50f8e

SHA256
aca06b59dca8cba7a482fd285c539176e6bf36cc142b4970b0ac535a83c70c1d

SHA512
0362a464637cc960fd0e91455f27bdde080d5e285056209b9195a574630ea7f247b5386f5c93ff0a58a35f372fca74545f1c48446e6190f8fbd6a6b5fdf796f0

Download Submit
C:\Users\Admin\AppData\Roaming\Seting.exe

Filesize
101KB

MD5
3364dc51d4d4655c7c11a8e1e8f02c40

SHA1
7430fb266e0b4a59d1d1625761b7c3e01b7171e8

SHA256
86a103e639f2fd089f19e5881624a11afaf899eff57a3fa030548a7eb2c075d8

SHA512
15e488d260565f80336936513f022248b7180ad69c0103347373c6a3d2074c773b3ba475975240f51b5d846808f16137b980c3b2e43124788335bc6b4c86d8a2

Download Submit
C:\Users\Admin\AppData\Roaming\Seting.exe

Filesize
57KB

MD5
2abdd57ed6feab13dc79fd492be4df87

SHA1
5d5239e10f9a07a60117b9607cab709caa770da5

SHA256
037d419e4d164e7e37c44dd6736ef9782dd0e722eb3129a065675e4dab9f1b2e

SHA512
57a4ce1b89bbdd3e0ddff52c3aa9f4d2c1caa6c4f95d3f7c993dd0dda4a7158563fb086ca93f27f206b494a3fe73b8119cabf9e91a9940b53ca62e1eefe0a7bf

Download Submit
C:\Users\Admin\AppData\Roaming\Seting.exe

Filesize
87KB

MD5
aa53b76a20115749d2fa81bc1c44f518

SHA1
34f80ec5a8f8a0ccd53eb6b02ebc12247ec864ef

SHA256
fa285c97bb2de40f6c88a99ae466487533f125a4aec072656d6cb91828be29dd

SHA512
3b5093b0f5f94f04f47524d399d9394ffe766b0f0c1d77914c1f4641f1d67dd9a328f2a17cdc5dfc39d9e3a57d07ef85af2b491ee9024dea26d255264fd1f6af

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

Filesize
40KB

MD5
b98204fd217d2404cf1cf4a550c7c82d

SHA1
5edb7774f1555b116155b51bf99b7bd84d6bdcfd

SHA256
07ee7148ec38323772372de405270631f44b23f000579ca224ba0fe82775f860

SHA512
b83b050bf2423a5594cdb3c64f6c93cdaa2b226d777228200bbbe6d40f9dc26917ea491240b8d8eb4d9bbdb4f3b9f896ebdc30eee4c5dfadb30adaa1b2974962

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

Filesize
16KB

MD5
be36f83c49c91b493c1992aa795b4368

SHA1
5b5f180cc4b069da04aaa4ff43f70802e8b57b0b

SHA256
a1032c56a7b74171b9715b97ff96a682db9879b6be17f301261fc7b94187bf31

SHA512
93d8fb08b1a87f981e564bb971d881ead7c0acae64567d78e2f1d6a9c401f1926e24fdf4c23ad10e30b60a0f3dc30731a4d270efa836e1fc12c07a36c673254c

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

Filesize
13KB

MD5
91445a36cff3857c09de696e0ea08b5b

SHA1
0b181186e5e73f7dd84ea6ce1d74759541d8d0f6

SHA256
03caba84f836f9897fa1f5f9597fc844789f9ee233f2e3bd8f9853a7a5327e04

SHA512
93ca62fe2ed1ddf566cfe67e20ebd6a83b6fdbda3aea5da0ccd8724125df1e50187cc108444063573b5d560232ef4efe50a8938b79d6dbd765b798be5d45ee1f

Download Submit
C:\Users\Admin\AppData\Roaming\splwow64.exe

Filesize
55KB

MD5
f038f6510e5a60b98ffe79aacef83e55

SHA1
b52407f42a8a73bc332d03cb0c3af7c357788c2f

SHA256
f8ab8a461900f885ffdcfa4b1300467e8e355687b52f53f2f5f27f1d9e6d0fcb

SHA512
06d768600b4873cb48728a0c382da58205760630d616d0fd025741271445220523676c4674583d2c15c2aae481354dce42079e6e24f24f23f33e3c36b65f4123

Download Submit
C:\Users\Admin\AppData\Roaming\splwow64.exe

Filesize
27KB

MD5
bb0606893c03dddc3aacffb7d208bfbe

SHA1
cd124865170421287578a295cdd652d024686afd

SHA256
3d254f3e701742d7d48b6e47a59b730252b8e438a248dbe83e4d186298a65bb7

SHA512
f70f2d43157d9dc6cef23627379eafb8b12ca839ee4fa0aca997b8a8b8a9d15e99c8c0f4c3f58b7145ceaa1855ace0f50000211b6238a229e759180816fe6324

Download Submit
C:\Users\Admin\AppData\Roaming\splwow64.exe

Filesize
21KB

MD5
b49f4dd052dc7623f0cd19d61e80e537

SHA1
779d270f71af930a58d9505ef8e03f2b2d207f30

SHA256
91896586af122f87331bbb37a3fee4a7c269f6a2ef0419ddd55911613ed02d53

SHA512
7a624a159c5643ed2d28f60b891c834e8c53bc00a34200986d3e89bab337d029521c3b89d8172dd5c95bc27f7345ab63e4c19b15610f57c902da911c38523c00

Download Submit
memory/868-204-0x00000000731A0000-0x0000000073950000-memory.dmp

Filesize
7.7MB

Download
memory/868-144-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-137-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-141-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-143-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-142-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-140-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-139-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-138-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-129-0x0000000000400000-0x0000000000692000-memory.dmp

Filesize
2.6MB

Download
memory/868-136-0x00000000731A0000-0x0000000073950000-memory.dmp

Filesize
7.7MB

Download
memory/876-14-0x00007FF931760000-0x00007FF932221000-memory.dmp

Filesize
10.8MB

Download
memory/876-0-0x0000000000E40000-0x00000000015FA000-memory.dmp

Filesize
7.7MB

Download
memory/876-1-0x00007FF931760000-0x00007FF932221000-memory.dmp

Filesize
10.8MB

Download
memory/1364-84-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1364-127-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/1364-65-0x0000000000580000-0x00000000006DE000-memory.dmp

Filesize
1.4MB

Download
memory/1364-135-0x00000000731A0000-0x0000000073950000-memory.dmp

Filesize
7.7MB

Download
memory/1364-128-0x0000000005130000-0x00000000051CC000-memory.dmp

Filesize
624KB

Download
memory/1364-71-0x00000000731A0000-0x0000000073950000-memory.dmp

Filesize
7.7MB

Download
memory/1780-99-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/1780-97-0x0000000000610000-0x000000000085A000-memory.dmp

Filesize
2.3MB

Download
memory/1780-168-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/1780-208-0x0000000001070000-0x0000000001080000-memory.dmp

Filesize
64KB

Download
memory/1960-209-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2348-165-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2348-167-0x0000026758F50000-0x0000026758F60000-memory.dmp

Filesize
64KB

Download
memory/2348-166-0x0000026758F50000-0x0000026758F60000-memory.dmp

Filesize
64KB

Download
memory/2348-180-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2628-47-0x0000000000CD0000-0x0000000001244000-memory.dmp

Filesize
5.5MB

Download
memory/2628-96-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2628-64-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2748-66-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2808-145-0x00000000029E0000-0x00000000029F0000-memory.dmp

Filesize
64KB

Download
memory/2808-68-0x0000000000A00000-0x0000000000A64000-memory.dmp

Filesize
400KB

Download
memory/2808-81-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2808-160-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2808-205-0x00000000029E0000-0x00000000029F0000-memory.dmp

Filesize
64KB

Download
memory/2864-159-0x000001737F7F0000-0x000001737F800000-memory.dmp

Filesize
64KB

Download
memory/2864-163-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2864-151-0x000001737F780000-0x000001737F7A2000-memory.dmp

Filesize
136KB

Download
memory/2864-157-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/2864-158-0x000001737F7F0000-0x000001737F800000-memory.dmp

Filesize
64KB

Download
memory/3188-191-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/3188-195-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

Filesize
10.8MB

Download
memory/3188-192-0x0000019467780000-0x0000019467790000-memory.dmp

Filesize
64KB

Download
memory/3188-193-0x0000019467780000-0x0000019467790000-memory.dmp

Filesize
64KB

Download
memory/4552-101-0x0000000005F10000-0x0000000005F2E000-memory.dmp

Filesize
120KB

Download
memory/4552-46-0x00000000731A0000-0x0000000073950000-memory.dmp

Filesize
7.7MB

Download
memory/4552-133-0x00000000731A0000-0x0000000073950000-memory.dmp

Filesize
7.7MB

Download
memory/4552-126-0x0000000007560000-0x0000000007568000-memory.dmp

Filesize
32KB

Download
memory/4552-125-0x0000000007580000-0x000000000759A000-memory.dmp

Filesize
104KB

Download
memory/4552-123-0x0000000007480000-0x000000000748E000-memory.dmp

Filesize
56KB

Download
memory/4552-124-0x0000000007490000-0x00000000074A4000-memory.dmp

Filesize
80KB

Download
memory/4552-45-0x0000000002930000-0x0000000002966000-memory.dmp

Filesize
216KB

Download
memory/4552-122-0x0000000007440000-0x0000000007451000-memory.dmp

Filesize
68KB

Download
memory/4552-103-0x000000007F550000-0x000000007F560000-memory.dmp

Filesize
64KB

Download
memory/4552-121-0x00000000074C0000-0x0000000007556000-memory.dmp

Filesize
600KB

Download
memory/4552-104-0x0000000006EF0000-0x0000000006F22000-memory.dmp

Filesize
200KB

Download
memory/4552-115-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/4552-120-0x00000000072C0000-0x00000000072CA000-memory.dmp

Filesize
40KB

Download
memory/4552-119-0x0000000007240000-0x000000000725A000-memory.dmp

Filesize
104KB

Download
memory/4552-118-0x0000000007880000-0x0000000007EFA000-memory.dmp

Filesize
6.5MB

Download
memory/4552-116-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4552-117-0x0000000006F30000-0x0000000006FD3000-memory.dmp

Filesize
652KB

Download
memory/4552-105-0x0000000070200000-0x000000007024C000-memory.dmp

Filesize
304KB

Download
memory/4552-62-0x0000000005200000-0x0000000005828000-memory.dmp

Filesize
6.2MB

Download
memory/4552-67-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/4552-90-0x0000000005830000-0x0000000005896000-memory.dmp

Filesize
408KB

Download
memory/4552-102-0x0000000005F30000-0x0000000005F7C000-memory.dmp

Filesize
304KB

Download
memory/4552-98-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/4552-100-0x0000000005A80000-0x0000000005DD4000-memory.dmp

Filesize
3.3MB

Download
memory/4552-73-0x0000000004F90000-0x0000000004FB2000-memory.dmp

Filesize
136KB

Download
memory/4552-69-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download