Malware Analysis Report

2024-11-16 13:33

Sample ID 240527-pmn2jadb44
Target SchoolGcChatRoom(MadeByLogan).exe
SHA256 c67516b52e22d90c2f7eaf23c1ec7dfe69c21e6de1496fb2eda6d9b424bbfa2d
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c67516b52e22d90c2f7eaf23c1ec7dfe69c21e6de1496fb2eda6d9b424bbfa2d

Threat Level: Known bad

The file SchoolGcChatRoom(MadeByLogan).exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Drops startup file

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 12:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 12:26

Reported

2024-05-27 12:28

Platform

win7-20240508-en

Max time kernel

84s

Max time network

85s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COM Surrogate.lnk C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COM Surrogate.lnk C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Public\\COM Surrogate" C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\shutdown.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\SchoolGcChatRoom(MadeByLogan).exe
PID 2908 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\SchoolGcChatRoom(MadeByLogan).exe
PID 2908 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\SchoolGcChatRoom(MadeByLogan).exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\system32\WerFault.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\system32\WerFault.exe
PID 2908 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\system32\WerFault.exe
PID 2692 wrote to memory of 2528 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 2528 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 2528 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 2836 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 2836 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 2836 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 1256 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 1256 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 1256 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 1040 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 1040 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 1040 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2692 wrote to memory of 1968 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\schtasks.exe
PID 2692 wrote to memory of 1968 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\schtasks.exe
PID 2692 wrote to memory of 1968 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\schtasks.exe
PID 2692 wrote to memory of 1820 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\system32\shutdown.exe
PID 2692 wrote to memory of 1820 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\system32\shutdown.exe
PID 2692 wrote to memory of 1820 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\system32\shutdown.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe

"C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAcQBiACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHUAZQB3ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBOAFMAVABBAEwATAAgAC4ATgBFAFQAIAA3AC4AMAAgAE8AUgAgAEgASQBHAEgARQBSACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBoAGkAeAAjAD4A"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAegBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAeABuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAZQBlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAeQBlACMAPgA="

C:\Windows\SchoolGcChatRoom(MadeByLogan).exe

"C:\Windows\SchoolGcChatRoom(MadeByLogan).exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2908 -s 884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SchoolGcChatRoom(MadeByLogan).exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SchoolGcChatRoom(MadeByLogan).exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\COM Surrogate'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'COM Surrogate'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "COM Surrogate" /tr "C:\Users\Public\COM Surrogate"

C:\Windows\system32\taskeng.exe

taskeng.exe {B2128C1F-FC70-4702-AA7F-53BC537FD220} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]

C:\Windows\system32\shutdown.exe

shutdown.exe /f /s /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 auto-london.gl.at.ply.gg udp
US 147.185.221.19:51655 auto-london.gl.at.ply.gg tcp
US 147.185.221.19:51655 auto-london.gl.at.ply.gg tcp

Files

memory/2908-0-0x000007FEF5353000-0x000007FEF5354000-memory.dmp

memory/2908-1-0x00000000000A0000-0x000000000015A000-memory.dmp

memory/2908-2-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

C:\Windows\SchoolGcChatRoom(MadeByLogan).exe

MD5 240484856ffdf08e9eab87f1d107a01c
SHA1 726247138f4daa702a3fa0f842a864e7570e04f4
SHA256 4f3e2daa1ed438ed548b2956c0c217776ce561650c470cba3b4761b6e57ebbdb
SHA512 35a2c61072bda41ae27590c2f5961ceac4117ef6f77b0a7d13d8dd9756ded6472b972f5bf5f37428ee7a38c0769b797717286c17a611195c26459a8b26e95eee

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 a47675454ddce3051c9e855a41e14287
SHA1 f36690bd4e4a32a40d9cdc765cf735d9d02f908e
SHA256 d0a33786fcaa0a1f1950f6feb27037a0b6f402998ee4131f9a65bb514ecd6fce
SHA512 86b8a8dce5149c2de185da9ef29ae3ce315ae4c374276a2640c76a3dec84af2c451ecdaec41a54176755495d3d3f507bab6697646aa37f7a44e6ab263c2f57e4

memory/2692-17-0x0000000000A50000-0x0000000000A6C000-memory.dmp

memory/2844-19-0x0000000002810000-0x0000000002818000-memory.dmp

memory/2844-18-0x000000001B680000-0x000000001B962000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2908-46-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 12:26

Reported

2024-05-27 12:28

Platform

win10v2004-20240226-en

Max time kernel

82s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COM Surrogate.lnk C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COM Surrogate.lnk C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Users\Public\COM Surrogate N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Public\\COM Surrogate" C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\COM Surrogate N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SYSTEM32\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SYSTEM32\shutdown.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe N/A
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3672 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3672 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\SchoolGcChatRoom(MadeByLogan).exe
PID 3672 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\SchoolGcChatRoom(MadeByLogan).exe
PID 3524 wrote to memory of 3404 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 3404 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 3680 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 3680 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 4928 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 4928 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 2076 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 2076 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 2600 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\schtasks.exe
PID 3524 wrote to memory of 2600 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\System32\schtasks.exe
PID 3524 wrote to memory of 1984 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\SYSTEM32\shutdown.exe
PID 3524 wrote to memory of 1984 N/A C:\Windows\SchoolGcChatRoom(MadeByLogan).exe C:\Windows\SYSTEM32\shutdown.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe

"C:\Users\Admin\AppData\Local\Temp\SchoolGcChatRoom(MadeByLogan).exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAcQBiACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHUAZQB3ACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBOAFMAVABBAEwATAAgAC4ATgBFAFQAIAA3AC4AMAAgAE8AUgAgAEgASQBHAEgARQBSACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBoAGkAeAAjAD4A"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAegBnACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAeABuACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAZQBlACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAeQBlACMAPgA="

C:\Windows\SchoolGcChatRoom(MadeByLogan).exe

"C:\Windows\SchoolGcChatRoom(MadeByLogan).exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SchoolGcChatRoom(MadeByLogan).exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SchoolGcChatRoom(MadeByLogan).exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\COM Surrogate'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'COM Surrogate'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "COM Surrogate" /tr "C:\Users\Public\COM Surrogate"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3536 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8

C:\Users\Public\COM Surrogate

"C:\Users\Public\COM Surrogate"

C:\Windows\SYSTEM32\shutdown.exe

shutdown.exe /f /s /t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa395a855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 auto-london.gl.at.ply.gg udp
US 147.185.221.19:51655 auto-london.gl.at.ply.gg tcp
US 8.8.8.8:53 19.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 13.107.253.64:443 tcp
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.173.189.20.in-addr.arpa udp

Files

memory/3672-0-0x00007FFC3DC93000-0x00007FFC3DC95000-memory.dmp

memory/3672-1-0x0000000000B60000-0x0000000000C1A000-memory.dmp

memory/3672-2-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

C:\Windows\SchoolGcChatRoom(MadeByLogan).exe

MD5 240484856ffdf08e9eab87f1d107a01c
SHA1 726247138f4daa702a3fa0f842a864e7570e04f4
SHA256 4f3e2daa1ed438ed548b2956c0c217776ce561650c470cba3b4761b6e57ebbdb
SHA512 35a2c61072bda41ae27590c2f5961ceac4117ef6f77b0a7d13d8dd9756ded6472b972f5bf5f37428ee7a38c0769b797717286c17a611195c26459a8b26e95eee

memory/3524-14-0x0000000000460000-0x000000000047C000-memory.dmp

memory/3892-15-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

memory/3892-23-0x0000026CFE8F0000-0x0000026CFE912000-memory.dmp

memory/3524-26-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4zxllwp.ule.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3672-38-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7e6846584df05400432700b00033ef14
SHA1 0395677a43cb9bdbae245f2f9148fcb3474763e1
SHA256 d47ca002debb365052178cfa540b6aa192bad1324cbfedd577238d5bea79d746
SHA512 349678049260735d6ab59166434d3d11ed1f4910a58d156408c951a3af4a5675e9c5e15e5f6079b3fb2368dcbcd23bead3d0fad515c1c40b438a28adc69f564d

memory/3892-42-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2fb16271f5d6c4cf4be8ce0bb427a47b
SHA1 cc316eb9067e6eb45e6d3fb017b3c4cac1d81ca9
SHA256 b799c89998d733a2f74f1b6e03e0b586cfcaa2887ecc5448cc8eb1f4a4c384d6
SHA512 2a97035d0eb2480bc6c224bb2bc6036f8bff66046edba2a9a0cd23db7acae993ec274b5cf091df90d810cc2d8c1a3fee5d7c8ccd0e1d260dda3ef133881d9279

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f0a41fc9c1123bb127e55ecc66c8f052
SHA1 57152411758fa3df2623cc8a4df6d9fea73652f8
SHA256 a4fe2be2c449e841f6a12d32114672b097fc1058b6f2971a03521220a0228745
SHA512 e3e967adac361ddcf8240cf641f3e77eacfefc61dec725b8ae12e6a94f7d2ebd937fb9eb3cd068a0b3d4306e163dc87773b322bc2dd8b7df93b8103d0e99a900

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ec66606831e595ea115f35d1b61b7105
SHA1 f22d025450dc8dafd9b434b2eb31cb876bcb8109
SHA256 4f17fe98ecf3ea9ec9873ff0a3acdd6ca93eb17e280a01ff6cfeca4422019dec
SHA512 f2922870f0b34b5cd8a75ce3aa94362a43997a752b0e8e9001f63d650225bf15415a75ce8aa333e4d3554a52ca5d40eec7b15ce67e3ee20441cf2680de59ed5d

memory/3524-90-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

memory/4540-98-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-99-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-100-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-110-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-109-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-108-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-107-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-106-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-105-0x000002D217C30000-0x000002D217C31000-memory.dmp

memory/4540-104-0x000002D217C30000-0x000002D217C31000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COM Surrogate.lnk

MD5 2cf978575fcad1b9273c40143c209b96
SHA1 ef5c9425d58af1b23b8ca00b6f4991260a349a5f
SHA256 903547cdc26717378899b1187e187d172aa7501466bc6ca516d7f73e49e39846
SHA512 3094cb839dcbc1afc35078376517a6651bf581e56f6621e9836fffd37bf4491fefa6543dc59b8d9d10aaaec51f27218f466a92938b9ab5442905ca11160bc537

memory/3524-117-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp