Malware Analysis Report

2025-03-14 22:31

Sample ID 240304-qypymsbe5x
Target XMClient_Loader.exe
SHA256 912bab2aa9ae537409ccb7e893e2d07f53fb260e05987cc8c02dba2580f16662
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

912bab2aa9ae537409ccb7e893e2d07f53fb260e05987cc8c02dba2580f16662

Threat Level: Shows suspicious behavior

The file XMClient_Loader.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Deletes itself

Drops startup file

Executes dropped EXE

Checks computer location settings

Looks up external IP address via web service

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-04 13:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-04 13:40

Reported

2024-03-04 14:10

Platform

win7-20240220-en

Max time kernel

1556s

Max time network

1557s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe
PID 2252 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe
PID 2252 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe
PID 1920 wrote to memory of 788 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\svchost.exe
PID 1920 wrote to memory of 788 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\svchost.exe
PID 1920 wrote to memory of 788 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\svchost.exe
PID 2252 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe
PID 2252 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe
PID 2252 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe
PID 2252 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\system32\cmd.exe
PID 2252 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\system32\cmd.exe
PID 2252 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\system32\cmd.exe
PID 2592 wrote to memory of 2472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2592 wrote to memory of 2472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2592 wrote to memory of 2472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe

"C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XMClient_Loader.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {C03ECE84-4B42-43C4-B34F-35B684D471B8} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]

C:\Users\Admin\svchost.exe

C:\Users\Admin\svchost.exe

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /delete /f /tn "svchost"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF0D4.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:31920 tcp
N/A 127.0.0.1:31920 tcp
N/A 127.0.0.1:31920 tcp
US 8.8.8.8:53 17.ip.gl.ply.gg udp
US 147.185.221.17:31920 17.ip.gl.ply.gg tcp

Files

memory/2252-0-0x0000000001010000-0x000000000106A000-memory.dmp

memory/2252-1-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

memory/2252-2-0x000000001AD20000-0x000000001ADA0000-memory.dmp

memory/2744-7-0x000000001B780000-0x000000001BA62000-memory.dmp

memory/2744-8-0x0000000001E80000-0x0000000001E88000-memory.dmp

memory/2744-9-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

memory/2744-10-0x0000000002980000-0x0000000002A00000-memory.dmp

memory/2744-11-0x0000000002980000-0x0000000002A00000-memory.dmp

memory/2744-12-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

memory/2744-13-0x0000000002984000-0x0000000002987000-memory.dmp

memory/2744-14-0x000000000298B000-0x00000000029F2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 ba24c56e8d8cd9594dd4e11497594ec7
SHA1 c580f44307c397d08e82b1e51e986cd2e39a3c56
SHA256 bb0d07a7ddc2e33e18bb9c1c0d2d5fc949595d81819b55ae072b481ac3eca2ac
SHA512 ffc271871021008c6e053cd42d551030b9b3dffad05729e8e4200fa7f2c6dc884c133eb2ba43012e5f9418cd0844b5b4bb94253ec3dfea6e59fa4f50da68e092

memory/2412-20-0x000000001B630000-0x000000001B912000-memory.dmp

memory/2412-22-0x0000000002870000-0x0000000002878000-memory.dmp

memory/2412-21-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

memory/2412-23-0x00000000028F0000-0x0000000002970000-memory.dmp

memory/2412-24-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

memory/2412-25-0x00000000028F0000-0x0000000002970000-memory.dmp

memory/2412-26-0x00000000028F0000-0x0000000002970000-memory.dmp

memory/2412-27-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

memory/2200-33-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

memory/2200-34-0x0000000002E60000-0x0000000002EE0000-memory.dmp

memory/2200-35-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

memory/2200-36-0x0000000002E60000-0x0000000002EE0000-memory.dmp

memory/2252-37-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

memory/2200-38-0x0000000002E60000-0x0000000002EE0000-memory.dmp

memory/2200-39-0x000007FEEF040000-0x000007FEEF9DD000-memory.dmp

memory/1860-45-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

memory/1860-46-0x00000000028F0000-0x0000000002970000-memory.dmp

memory/1860-47-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

memory/1860-48-0x00000000028F0000-0x0000000002970000-memory.dmp

memory/1860-49-0x00000000028F0000-0x0000000002970000-memory.dmp

memory/1860-50-0x00000000028F0000-0x0000000002970000-memory.dmp

memory/1860-51-0x000007FEEE6A0000-0x000007FEEF03D000-memory.dmp

memory/2252-56-0x000000001AD20000-0x000000001ADA0000-memory.dmp

C:\Users\Admin\svchost.exe

MD5 70f462c7ee70ad17a46ae90fdedcb0ee
SHA1 e4f4f5ae243dba45aac248f998bf15af1b86cd72
SHA256 912bab2aa9ae537409ccb7e893e2d07f53fb260e05987cc8c02dba2580f16662
SHA512 36c8d8d28057b3766c61990f17e3f215cdfeb1aa120d6c87361e58a1bc9a5046c3e5206e8d1ba320636228888ad9a576469504404cd9a08311107cfdcf443103

memory/788-60-0x0000000000A50000-0x0000000000AAA000-memory.dmp

memory/788-61-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

memory/788-62-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF0D4.tmp.bat

MD5 a21f8e06b1e029cb21a74788c43566e3
SHA1 13db11e1e751b97c0ee9d31c65cc02059f99c792
SHA256 55116752dfb38693fafdf9e4ed08f2dcae54a13f87153c93e94f05e8d3e9329c
SHA512 403b3b699b158001f10d958e9090337f0e83e1227103d2a06d17d4f48583a6ee3af05dbe828b561770f749e6a03cd12a724e46c017b50301b029034b8eca996c

memory/2252-73-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-04 13:40

Reported

2024-03-04 13:41

Platform

win10v2004-20240226-en

Max time kernel

34s

Max time network

42s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4848 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4848 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe
PID 4848 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe

"C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XMClient_Loader.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XMClient_Loader.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\svchost.exe"

C:\Users\Admin\svchost.exe

C:\Users\Admin\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 151.191.110.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 17.ip.gl.ply.gg udp
US 147.185.221.17:31920 17.ip.gl.ply.gg tcp
US 8.8.8.8:53 17.221.185.147.in-addr.arpa udp
US 147.185.221.17:31920 17.ip.gl.ply.gg tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 201.135.221.88.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 13.107.253.64:443 tcp

Files

memory/4848-0-0x0000000000E10000-0x0000000000E6A000-memory.dmp

memory/4848-1-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/4848-2-0x000000001BA90000-0x000000001BAA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_la213qug.pv0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3752-9-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/3752-13-0x0000017AC46E0000-0x0000017AC4702000-memory.dmp

memory/3752-14-0x0000017AA9F80000-0x0000017AA9F90000-memory.dmp

memory/3752-15-0x0000017AA9F80000-0x0000017AA9F90000-memory.dmp

memory/3752-16-0x0000017AA9F80000-0x0000017AA9F90000-memory.dmp

memory/3752-19-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/2304-21-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/2304-22-0x0000022D0FEA0000-0x0000022D0FEB0000-memory.dmp

memory/2304-23-0x0000022D0FEA0000-0x0000022D0FEB0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

memory/2304-34-0x0000022D0FEA0000-0x0000022D0FEB0000-memory.dmp

memory/4848-35-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/2304-37-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/2152-39-0x000001E232D20000-0x000001E232D30000-memory.dmp

memory/2152-38-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/2152-40-0x000001E232D20000-0x000001E232D30000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ab24765a7393bd3cef8acbf0a617fba2
SHA1 ef2c12a457a11f6204344afed09a39f4d3e803cb
SHA256 3a03c7efabe880ae9f283b1cf373d3f09d07ab619028319b3599b643ae140d47
SHA512 e16306674a8c89f54467d7fba3857e1e0bdf3729f5de9f4451520cfbddfa535c4d653dde6efcac38efd693e9b3e4965fcd08c559e720c372feca65050b46e355

memory/2152-52-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/3056-53-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/3056-54-0x00000189F0430000-0x00000189F0440000-memory.dmp

memory/3056-55-0x00000189F0430000-0x00000189F0440000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e58749a7a1826f6ea62df1e2ef63a32b
SHA1 c0bca21658b8be4f37b71eec9578bfefa44f862d
SHA256 0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
SHA512 4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70

memory/3056-66-0x00000189F0430000-0x00000189F0440000-memory.dmp

memory/3056-68-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

C:\Users\Admin\svchost.exe

MD5 70f462c7ee70ad17a46ae90fdedcb0ee
SHA1 e4f4f5ae243dba45aac248f998bf15af1b86cd72
SHA256 912bab2aa9ae537409ccb7e893e2d07f53fb260e05987cc8c02dba2580f16662
SHA512 36c8d8d28057b3766c61990f17e3f215cdfeb1aa120d6c87361e58a1bc9a5046c3e5206e8d1ba320636228888ad9a576469504404cd9a08311107cfdcf443103

memory/4560-75-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/4560-77-0x00007FFED36E0000-0x00007FFED41A1000-memory.dmp

memory/4848-78-0x000000001D7F0000-0x000000001D7FC000-memory.dmp