Malware Analysis Report

2024-09-11 10:00

Sample ID 240424-k8j79agc9w
Target b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6
SHA256 b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6
Tags
xworm persistence rat trojan limerat stormkitty spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6

Threat Level: Known bad

The file b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6 was found to be: Known bad.

Malicious Activity Summary

xworm persistence rat trojan limerat stormkitty spyware stealer

Xworm family

Detect Xworm Payload

StormKitty

LimeRAT

StormKitty payload

Xworm

Checks computer location settings

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-04-24 09:16

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-24 09:16

Reported

2024-04-24 09:18

Platform

win11-20240412-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4576 wrote to memory of 5784 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 5784 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\schtasks.exe
PID 4576 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe

"C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:7000 tcp
NL 91.92.252.220:7000 tcp

Files

memory/4576-0-0x00000000002B0000-0x00000000002C2000-memory.dmp

memory/4576-1-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/4576-2-0x000000001AEE0000-0x000000001AEF0000-memory.dmp

memory/5784-8-0x000001B3FF7D0000-0x000001B3FF7F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhked3uq.trl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5784-12-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/5784-13-0x000001B399BA0000-0x000001B399BB0000-memory.dmp

memory/5784-14-0x000001B399BA0000-0x000001B399BB0000-memory.dmp

memory/5784-15-0x000001B399BA0000-0x000001B399BB0000-memory.dmp

memory/5784-16-0x000001B399BA0000-0x000001B399BB0000-memory.dmp

memory/5784-19-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e8eb51096d6f6781456fef7df731d97
SHA1 ec2aaf851a618fb43c3d040a13a71997c25bda43
SHA256 96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864
SHA512 0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

memory/1152-30-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/1152-31-0x000001BCBC4A0000-0x000001BCBC4B0000-memory.dmp

memory/1152-32-0x000001BCBC4A0000-0x000001BCBC4B0000-memory.dmp

memory/1152-33-0x000001BCBC4A0000-0x000001BCBC4B0000-memory.dmp

memory/1152-34-0x000001BCBC4A0000-0x000001BCBC4B0000-memory.dmp

memory/1152-36-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 aa6b748cd8f3e3c0e41549529b919e21
SHA1 5a4b9721f9fb5042f6ef7afd698d5ac5216a88bb
SHA256 d7d665a42f940443efb28eb231dfe1c4062394e71fba145d6eea9ec075b0f0e8
SHA512 361c523f49428a7e430279099e669a1a8af8764653f42e83105c0da3f8e8dd3be6c1719ea8c158d8f2e8425d74457147a4683190eb4a67019b9d02be44c13534

memory/2532-47-0x00000291F65C0000-0x00000291F65D0000-memory.dmp

memory/2532-48-0x00000291F65C0000-0x00000291F65D0000-memory.dmp

memory/2532-46-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/4576-49-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/2532-51-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/4576-52-0x000000001AEE0000-0x000000001AEF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4914eb0b2ff51bfa48484b5cc8454218
SHA1 6a7c3e36ce53b42497884d4c4a3bda438dd4374b
SHA256 7e510fc9344ef239ab1ab650dc95bb25fd44e2efba8b8246a3ac17880ee8b69e
SHA512 83ab35f622f4a5040ca5cb615a30f83bb0741449225f1fd1815b6923e225c28241d0c02d34f83f743349a5e57f84ca1c6f44016797a93d5985be41d11be79500

memory/1460-63-0x00000200F00D0000-0x00000200F00E0000-memory.dmp

memory/1460-62-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/1460-64-0x00000200F00D0000-0x00000200F00E0000-memory.dmp

memory/1460-66-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

C:\Users\Admin\AppData\Roaming\explorer.exe

MD5 f8c0512008daff966ef349e7178d1239
SHA1 2a74048cf5009ab0f850e3992ffe7a453e3e18a5
SHA256 b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6
SHA512 f8c208da88e213f96531b09ea4cdffd82368373aeb9868f11e35135052cf80ffceb89c64da83969aa2df3505579fefc673a0e6346b3b6c361a7d29089f56a3fa

memory/5912-73-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/5912-75-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

memory/2424-79-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

memory/2424-80-0x00007FF8B3040000-0x00007FF8B3B02000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-24 09:16

Reported

2024-04-24 09:18

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

LimeRAT

rat limerat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\browser.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk C:\Users\Admin\AppData\Roaming\browser.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe" C:\Users\Admin\AppData\Roaming\browser.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\browser.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2124 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\schtasks.exe
PID 2124 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\System32\schtasks.exe
PID 2124 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\SYSTEM32\schtasks.exe
PID 2124 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Windows\SYSTEM32\schtasks.exe
PID 2124 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Users\Admin\AppData\Roaming\browser.exe
PID 2124 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe C:\Users\Admin\AppData\Roaming\browser.exe
PID 3328 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\schtasks.exe
PID 3328 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Roaming\browser.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe

"C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Windows\SYSTEM32\schtasks.exe

schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Roaming\browser.exe'"

C:\Users\Admin\AppData\Roaming\browser.exe

"C:\Users\Admin\AppData\Roaming\browser.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\browser.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'browser.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"

C:\Users\Admin\AppData\Roaming\explorer.exe

C:\Users\Admin\AppData\Roaming\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 198.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 154.173.246.72.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 50.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 91.92.252.220:7000 tcp
US 8.8.8.8:53 48.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 220.252.92.91.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:7000 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
NL 91.92.252.220:7000 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/2124-0-0x0000000000FF0000-0x0000000001002000-memory.dmp

memory/2124-1-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2124-2-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

memory/4756-3-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/4756-4-0x00000210147A0000-0x00000210147B0000-memory.dmp

memory/4756-5-0x00000210147A0000-0x00000210147B0000-memory.dmp

memory/4756-15-0x00000210147B0000-0x00000210147D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2koqbaqq.giq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4756-18-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/4912-25-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/4912-31-0x00000201D54E0000-0x00000201D54F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

memory/4912-33-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5c8ea9d884103d067a1ba2e422a2b1ed
SHA1 3ddf0f71f84e1b595b6f8862c649445a6d188ed6
SHA256 d77147b11db5fdb60f2a0a1157944a3a59d713ff9996be33bd05d1e92fb2c28b
SHA512 8366f4756c2390a631d7083b03b40a335cd05ae5c302fe3512919200ac4980e8c6b94e2e9ce634ab75f6bfa06a851a23b29e43afef3ad58b1b70d3d6bc569aca

memory/2188-44-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2188-45-0x000001CC55E40000-0x000001CC55E50000-memory.dmp

memory/2188-46-0x000001CC55E40000-0x000001CC55E50000-memory.dmp

memory/2188-48-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2192-59-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

memory/2192-60-0x0000019D0A500000-0x0000019D0A510000-memory.dmp

memory/2192-61-0x0000019D0A500000-0x0000019D0A510000-memory.dmp

memory/2192-63-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2124-68-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2124-69-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

C:\Users\Admin\AppData\Roaming\explorer.exe

MD5 f8c0512008daff966ef349e7178d1239
SHA1 2a74048cf5009ab0f850e3992ffe7a453e3e18a5
SHA256 b019a47dc528a7197129adec69ea6813c28e60884c267cd297524296861a9ed6
SHA512 f8c208da88e213f96531b09ea4cdffd82368373aeb9868f11e35135052cf80ffceb89c64da83969aa2df3505579fefc673a0e6346b3b6c361a7d29089f56a3fa

memory/1688-72-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/1688-74-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2124-76-0x0000000001690000-0x000000000169C000-memory.dmp

memory/2124-77-0x000000001EAB0000-0x000000001EBCE000-memory.dmp

memory/2124-116-0x000000001EDD0000-0x000000001F120000-memory.dmp

memory/2124-130-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/3328-131-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/3328-132-0x000000001BB00000-0x000000001BB10000-memory.dmp

memory/1920-133-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/1920-134-0x000001EC73C70000-0x000001EC73C80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

memory/1920-146-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/3584-147-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/3584-148-0x000001C8F1F50000-0x000001C8F1F60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9c740b7699e2363ac4ecdf496520ca35
SHA1 aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9
SHA256 be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61
SHA512 8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

memory/3584-159-0x000001C8F1F50000-0x000001C8F1F60000-memory.dmp

memory/3584-161-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/3936-172-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 eb1ad317bd25b55b2bbdce8a28a74a94
SHA1 98a3978be4d10d62e7411946474579ee5bdc5ea6
SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
SHA512 d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

memory/3936-173-0x000001746DC00000-0x000001746DC10000-memory.dmp

memory/3936-175-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2604-176-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2604-182-0x0000012EAD740000-0x0000012EAD750000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c0b8748e607cdd30070e3d99f4d099fb
SHA1 88dce7272b1d4f036873da0dae0e6876bcb88aaf
SHA256 133460e080441a71ec35d7366bdecf5c6d78d9a8b987b56c46e8545c406c69f7
SHA512 a5ae9fd049b923567ee9b94be587ba495d9e7c0d9bbdbb3c0551788cae3475974d85018724308d81c0e1fd37b7ec719cd018db94e2d4bba3f3be164888dc09cc

memory/2604-188-0x0000012EAD740000-0x0000012EAD750000-memory.dmp

memory/3328-189-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/2604-191-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk

MD5 5b9a1c868d9d534bead3df34355a5ff9
SHA1 4b74472051384e81a087a468da31ecb0294d0acd
SHA256 ece200570b2e16526791ceb1a07d5e6c589b3195389e8cfb68ef57b3dc63ab90
SHA512 c14aaccc0424725b72a65d69b65c84e8cfbe81bd3fae7e03b63d3221fdb7c767bec9cf5ca76be336da5699a1f414452c49409923194da9c2e9d767f484777cd4

memory/3328-196-0x000000001BB00000-0x000000001BB10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/4912-200-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp

memory/4912-201-0x00007FFD41C20000-0x00007FFD426E1000-memory.dmp