xworm | 986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

Resubmissions

08-02-2024 03:17

240208-ds6mzsdhcp 10

08-02-2024 03:05

240208-dlmxascc26 10

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windows.exe
Size

332KB
MD5

21b941b814ff8935b0f5b308a8c7ec9c
SHA1

568e4c957b15f002eebb0bb291537e4c36c8f390
SHA256

986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb
SHA512

dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18
SSDEEP

6144:rd4bYBotL3mIhs8DyFPd4U1mGvEMdn7Ml/wCmCJ:rd4EBCqL4RpMi9XmCJ

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

hai1723rat-60039.portmap.io:60039

Signatures

Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral4/memory/336-46-0x0000000000BD0000-0x0000000000BE8000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

resource	yara_rule
behavioral4/memory/336-46-0x0000000000BD0000-0x0000000000BE8000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

windows.exepcnetwork.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	windows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	pcnetwork.exe

Executes dropped EXE 1 IoCs

Processes:

pcnetwork.exe

pid process

336 pcnetwork.exe
Drops file in Windows directory 2 IoCs

Processes:

windows.exe

description ioc process

File opened for modification C:\Windows\pcnetwork.exe windows.exe
File created C:\Windows\pcnetwork.exe windows.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
336	pcnetwork.exe

description	ioc	process
File opened for modification	C:\Windows\pcnetwork.exe	windows.exe
File created	C:\Windows\pcnetwork.exe	windows.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1196 timeout.exe
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

taskmgr.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe

pid	process
1196	timeout.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies registry class 5 IoCs

Processes:

taskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepcnetwork.exetaskmgr.exetaskmgr.exetaskmgr.exe

pid	process
3868	powershell.exe
3868	powershell.exe
2492	powershell.exe
2492	powershell.exe
4536	powershell.exe
4536	powershell.exe
2800	powershell.exe
2800	powershell.exe
336	pcnetwork.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
2376	taskmgr.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
2376	taskmgr.exe
2376	taskmgr.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
336	pcnetwork.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe
2376	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

windows.exepowershell.exepowershell.exepcnetwork.exepowershell.exepowershell.exetaskmgr.exetaskmgr.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	4744	windows.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	336	pcnetwork.exe
Token: SeDebugPrivilege	336	pcnetwork.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	336	pcnetwork.exe
Token: SeDebugPrivilege	4108	taskmgr.exe
Token: SeSystemProfilePrivilege	4108	taskmgr.exe
Token: SeCreateGlobalPrivilege	4108	taskmgr.exe
Token: SeDebugPrivilege	4520	taskmgr.exe
Token: SeSystemProfilePrivilege	4520	taskmgr.exe
Token: SeCreateGlobalPrivilege	4520	taskmgr.exe
Token: 33	4108	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4108	taskmgr.exe
Token: SeDebugPrivilege	2376	taskmgr.exe
Token: SeSystemProfilePrivilege	2376	taskmgr.exe
Token: SeCreateGlobalPrivilege	2376	taskmgr.exe
Token: 33	4520	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4520	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exetaskmgr.exetaskmgr.exe

pid	process
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
2376	taskmgr.exe
4520	taskmgr.exe
2376	taskmgr.exe
4520	taskmgr.exe
2376	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exetaskmgr.exetaskmgr.exe

pid	process
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4108	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
4520	taskmgr.exe
2376	taskmgr.exe
4520	taskmgr.exe
2376	taskmgr.exe
4520	taskmgr.exe
2376	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

pcnetwork.exe

pid process

336 pcnetwork.exe

pid	process
336	pcnetwork.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

windows.execmd.exepcnetwork.exetaskmgr.exetaskmgr.exe

description	pid	process	target process
PID 4744 wrote to memory of 3868	4744	windows.exe	powershell.exe
PID 4744 wrote to memory of 3868	4744	windows.exe	powershell.exe
PID 4744 wrote to memory of 2492	4744	windows.exe	powershell.exe
PID 4744 wrote to memory of 2492	4744	windows.exe	powershell.exe
PID 4744 wrote to memory of 4500	4744	windows.exe	cmd.exe
PID 4744 wrote to memory of 4500	4744	windows.exe	cmd.exe
PID 4500 wrote to memory of 1196	4500	cmd.exe	timeout.exe
PID 4500 wrote to memory of 1196	4500	cmd.exe	timeout.exe
PID 336 wrote to memory of 4536	336	pcnetwork.exe	powershell.exe
PID 336 wrote to memory of 4536	336	pcnetwork.exe	powershell.exe
PID 336 wrote to memory of 2800	336	pcnetwork.exe	powershell.exe
PID 336 wrote to memory of 2800	336	pcnetwork.exe	powershell.exe
PID 4108 wrote to memory of 4520	4108	taskmgr.exe	taskmgr.exe
PID 4108 wrote to memory of 4520	4108	taskmgr.exe	taskmgr.exe
PID 4520 wrote to memory of 2376	4520	taskmgr.exe	taskmgr.exe
PID 4520 wrote to memory of 2376	4520	taskmgr.exe	taskmgr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5B3F.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4500

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1196

C:\Windows\pcnetwork.exe
C:\Windows\pcnetwork.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'pcnetwork.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /1
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /1
3⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3bdf0f0bc4de32a6f32ecb8a32ba5df1

SHA1
900c6a905984e5e16f3efe01ce2b2cc725fc64f1

SHA256
c893092af552e973c44e0596d1509605a393896a0c1eae64f11456dc956ba40e

SHA512
680d8f42fd4cb1fffa52e1f7cc483e8afc79c8f3e25ebfe5324c7c277d88499cc58324313599e307e47ba3ee4004de7554192203413cb061a29170cd9bc889c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
15dde0683cd1ca19785d7262f554ba93

SHA1
d039c577e438546d10ac64837b05da480d06bf69

SHA256
d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

SHA512
57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wjdstlwl.d3s.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5B3F.tmp.bat
Filesize
159B

MD5
43a22bc56a21cae2bbbde4d542fa67ce

SHA1
6c17cd29fe9de6f4f9497e7034a371c9d8ad44a7

SHA256
b53d74b99801732b9d432fa0c137e9b39b91b21705bf606d5fdbd2e00c58d4e4

SHA512
10bd7b5e1c1a4c6f70e0154a6fe84eff809ca533c6b3a82907e158f7bd7ecfffa55c77b148b88673d40f631471e6e633686d980f7b4470fe4e4f643aba7da98d

Download Submit
C:\Windows\pcnetwork.exe
Filesize
332KB

MD5
21b941b814ff8935b0f5b308a8c7ec9c

SHA1
568e4c957b15f002eebb0bb291537e4c36c8f390

SHA256
986f5d92d64819c88ae6b48f2151cc780eb0aabe7d88bd488061f5efc48588fb

SHA512
dc486028a9d29f8e37454b38928222a932134ab2534b8bdf191ddd7e85da4edf39802e21de1af6de061b20a162ac14440d43320f8837f927e8e9ea354567ed18

Download Submit
memory/336-79-0x000000001B0C0000-0x000000001B0D0000-memory.dmp

Filesize
64KB

Download
memory/336-78-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/336-46-0x0000000000BD0000-0x0000000000BE8000-memory.dmp

Filesize
96KB

Download
memory/336-45-0x000000001B0C0000-0x000000001B0D0000-memory.dmp

Filesize
64KB

Download
memory/336-44-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/336-129-0x000000001B0C0000-0x000000001B0D0000-memory.dmp

Filesize
64KB

Download
memory/2492-34-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/2492-32-0x0000018BCDA20000-0x0000018BCDA30000-memory.dmp

Filesize
64KB

Download
memory/2492-20-0x0000018BCDA20000-0x0000018BCDA30000-memory.dmp

Filesize
64KB

Download
memory/2492-21-0x0000018BCDA20000-0x0000018BCDA30000-memory.dmp

Filesize
64KB

Download
memory/2492-19-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/2800-77-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/2800-63-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/2800-64-0x000002FD365E0000-0x000002FD365F0000-memory.dmp

Filesize
64KB

Download
memory/2800-65-0x000002FD365E0000-0x000002FD365F0000-memory.dmp

Filesize
64KB

Download
memory/3868-13-0x00000213AE820000-0x00000213AE830000-memory.dmp

Filesize
64KB

Download
memory/3868-14-0x00000213AE820000-0x00000213AE830000-memory.dmp

Filesize
64KB

Download
memory/3868-12-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/3868-7-0x00000213B01B0000-0x00000213B01D2000-memory.dmp

Filesize
136KB

Download
memory/3868-17-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/4108-82-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-91-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-87-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-88-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-80-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-81-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-89-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-86-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-92-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4108-90-0x000001C642A20000-0x000001C642A21000-memory.dmp

Filesize
4KB

Download
memory/4536-62-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/4536-49-0x0000021DE0910000-0x0000021DE0920000-memory.dmp

Filesize
64KB

Download
memory/4536-50-0x0000021DE0910000-0x0000021DE0920000-memory.dmp

Filesize
64KB

Download
memory/4536-48-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/4744-0-0x0000000000BC0000-0x0000000000C18000-memory.dmp

Filesize
352KB

Download
memory/4744-43-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download
memory/4744-37-0x0000000001510000-0x0000000001520000-memory.dmp

Filesize
64KB

Download
memory/4744-1-0x00007FF85FA90000-0x00007FF860551000-memory.dmp

Filesize
10.8MB

Download