Analysis Overview
SHA256
4df13a3d7eb8be77ec0f83eed487dd17efc81b2a4684978f778e92f49106cec0
Threat Level: Known bad
The file 1.exe was found to be: Known bad.
Malicious Activity Summary
Xworm
Xworm family
Detect Xworm Payload
Command and Scripting Interpreter: PowerShell
Drops startup file
Checks computer location settings
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-31 14:28
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-31 14:28
Reported
2024-05-31 14:31
Platform
win7-20240220-en
Max time kernel
148s
Max time network
149s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | 7.tcp.eu.ngrok.io | N/A | N/A |
| N/A | 7.tcp.eu.ngrok.io | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Enumerates physical storage devices
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
| Token: 33 | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv"
C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 7.tcp.eu.ngrok.io | udp |
| DE | 3.68.56.232:10589 | 7.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 7.tcp.eu.ngrok.io | udp |
| DE | 3.67.15.169:10589 | 7.tcp.eu.ngrok.io | tcp |
Files
memory/3036-0-0x000007FEF5693000-0x000007FEF5694000-memory.dmp
memory/3036-1-0x00000000001E0000-0x00000000001F4000-memory.dmp
memory/3036-2-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2600-7-0x0000000002770000-0x00000000027F0000-memory.dmp
memory/2600-8-0x000000001B510000-0x000000001B7F2000-memory.dmp
memory/2600-9-0x00000000027F0000-0x00000000027F8000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DRRPT6V5T98TXLZ6SZ4D.temp
| MD5 | 0854a25055c828d97caa4f1da7284170 |
| SHA1 | 79ab30732a775353ce6196c8d05f3393a90a9507 |
| SHA256 | b75ad9cb73d7ddf11f3eb3a139e8fc20acf9777dffd1f86f0549955977d2a984 |
| SHA512 | b24979c2e41aff806837e83171191966088c242e733267b8e7489f300ff95cf846af40f1b25b38d567c2ac612f7349dacbbccb4f0c8177d11a59048e1092d91b |
memory/2548-15-0x000000001B660000-0x000000001B942000-memory.dmp
memory/2548-16-0x0000000002790000-0x0000000002798000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/3036-33-0x000007FEF5693000-0x000007FEF5694000-memory.dmp
memory/3036-34-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2936-42-0x000007FEF2770000-0x000007FEF27A4000-memory.dmp
memory/2936-41-0x000000013FB20000-0x000000013FC18000-memory.dmp
memory/2936-49-0x000007FEF6BD0000-0x000007FEF6BE8000-memory.dmp
memory/2936-43-0x000007FEEDE10000-0x000007FEEE0C4000-memory.dmp
memory/2936-51-0x000007FEF1AE0000-0x000007FEF1AF1000-memory.dmp
memory/2936-50-0x000007FEF6710000-0x000007FEF6727000-memory.dmp
memory/2948-56-0x000007FEF6710000-0x000007FEF6727000-memory.dmp
memory/2948-57-0x000007FEF1AE0000-0x000007FEF1AF1000-memory.dmp
memory/2948-61-0x000007FEEF4F0000-0x000007FEEF501000-memory.dmp
memory/2948-60-0x000007FEEF510000-0x000007FEEF52D000-memory.dmp
memory/2948-59-0x000007FEEF530000-0x000007FEEF541000-memory.dmp
memory/2948-58-0x000007FEEF550000-0x000007FEEF567000-memory.dmp
memory/2948-54-0x000007FEEDE10000-0x000007FEEE0C4000-memory.dmp
memory/2948-55-0x000007FEF6BD0000-0x000007FEF6BE8000-memory.dmp
memory/2948-53-0x000007FEF2770000-0x000007FEF27A4000-memory.dmp
memory/2948-52-0x000000013FB20000-0x000000013FC18000-memory.dmp
memory/2948-64-0x000007FEEF320000-0x000007FEEF35F000-memory.dmp
memory/2948-65-0x000007FEEC5F0000-0x000007FEEC611000-memory.dmp
memory/2948-66-0x000007FEEC5D0000-0x000007FEEC5E8000-memory.dmp
memory/2948-67-0x000007FEEC5B0000-0x000007FEEC5C1000-memory.dmp
memory/2948-68-0x000007FEEC590000-0x000007FEEC5A1000-memory.dmp
memory/2948-69-0x000007FEEC570000-0x000007FEEC581000-memory.dmp
memory/2948-86-0x000007FEEC040000-0x000007FEEC105000-memory.dmp
memory/2948-76-0x000007FEEC3E0000-0x000007FEEC3F1000-memory.dmp
memory/2948-75-0x000007FEEC400000-0x000007FEEC46F000-memory.dmp
memory/2948-74-0x000007FEEC470000-0x000007FEEC4D7000-memory.dmp
memory/2948-73-0x000007FEEC4E0000-0x000007FEEC510000-memory.dmp
memory/2948-72-0x000007FEEC510000-0x000007FEEC528000-memory.dmp
memory/2948-71-0x000007FEEC530000-0x000007FEEC541000-memory.dmp
memory/2948-70-0x000007FEEC550000-0x000007FEEC56B000-memory.dmp
memory/2948-91-0x000007FEEBD60000-0x000007FEEBD90000-memory.dmp
memory/2948-89-0x000007FEEBEE0000-0x000007FEEBF4D000-memory.dmp
memory/2948-88-0x000007FEEBF50000-0x000007FEEBFB2000-memory.dmp
memory/2948-90-0x000007FEEBD90000-0x000007FEEBE4D000-memory.dmp
memory/2948-87-0x000007FEEBFC0000-0x000007FEEC035000-memory.dmp
memory/2948-62-0x000007FEEC820000-0x000007FEED8CB000-memory.dmp
memory/2948-85-0x000007FEEC110000-0x000007FEEC126000-memory.dmp
memory/2948-84-0x000007FEEC130000-0x000007FEEC141000-memory.dmp
memory/2948-83-0x000007FEEC150000-0x000007FEEC17F000-memory.dmp
memory/2948-82-0x000007FEFB290000-0x000007FEFB2A0000-memory.dmp
memory/2948-81-0x000007FEEC180000-0x000007FEEC197000-memory.dmp
memory/2948-80-0x000007FEEC1A0000-0x000007FEEC318000-memory.dmp
memory/2948-63-0x000007FEEC620000-0x000007FEEC820000-memory.dmp
memory/2948-79-0x000007FEEC320000-0x000007FEEC344000-memory.dmp
memory/2948-78-0x000007FEEC350000-0x000007FEEC378000-memory.dmp
memory/2948-77-0x000007FEEC380000-0x000007FEEC3D6000-memory.dmp
memory/2948-93-0x000007FEEA440000-0x000007FEEA5B0000-memory.dmp
memory/2948-97-0x000007FEE99B0000-0x000007FEE99C1000-memory.dmp
memory/2948-96-0x000007FEE9D20000-0x000007FEE9D35000-memory.dmp
memory/2948-95-0x000007FEEA3D0000-0x000007FEEA412000-memory.dmp
memory/2948-94-0x000007FEEA420000-0x000007FEEA432000-memory.dmp
memory/2948-98-0x000007FEE9950000-0x000007FEE99AD000-memory.dmp
memory/2948-99-0x000007FEE9900000-0x000007FEE9947000-memory.dmp
memory/2948-101-0x000007FEE9700000-0x000007FEE9711000-memory.dmp
memory/2948-102-0x000007FEE9400000-0x000007FEE944E000-memory.dmp
memory/2948-100-0x000007FEE9870000-0x000007FEE98F1000-memory.dmp
memory/2948-103-0x000007FEE93B0000-0x000007FEE93F3000-memory.dmp
memory/2948-104-0x000007FEE9390000-0x000007FEE93A5000-memory.dmp
memory/2948-105-0x000007FEE9370000-0x000007FEE9381000-memory.dmp
memory/2948-106-0x000007FEE9350000-0x000007FEE9362000-memory.dmp
memory/2948-108-0x000007FEE9190000-0x000007FEE91C4000-memory.dmp
memory/2948-107-0x000007FEE91D0000-0x000007FEE934A000-memory.dmp
memory/2948-92-0x000007FEEA5B0000-0x000007FEEBD60000-memory.dmp
memory/3036-223-0x0000000001FD0000-0x0000000001FDC000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-31 14:28
Reported
2024-05-31 14:31
Platform
win10v2004-20240508-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | 7.tcp.eu.ngrok.io | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\1.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| NL | 23.62.61.171:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 171.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 235.4.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 7.tcp.eu.ngrok.io | udp |
| DE | 3.68.56.232:10589 | 7.tcp.eu.ngrok.io | tcp |
| US | 8.8.8.8:53 | 232.56.68.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.16.208.104.in-addr.arpa | udp |
Files
memory/4868-0-0x00000000002D0000-0x00000000002E4000-memory.dmp
memory/4868-1-0x00007FFFBA453000-0x00007FFFBA455000-memory.dmp
memory/4868-2-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp
memory/4928-3-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp
memory/4928-4-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp
memory/4928-5-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp
memory/4928-11-0x000002E071150000-0x000002E071172000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xo2mkplm.yaj.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4928-16-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp
memory/4928-19-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 77d622bb1a5b250869a3238b9bc1402b |
| SHA1 | d47f4003c2554b9dfc4c16f22460b331886b191b |
| SHA256 | f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb |
| SHA512 | d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 82cea548460260b6dc4d446dbfb01ab4 |
| SHA1 | 0dd102070146bcb149f8fdb03ac00f5f802e9950 |
| SHA256 | 257f3d4fd20a8bb855a36bd76b1bd0ece44e97b3930326e74d765644673ee3e5 |
| SHA512 | 700e928624be3d4b68d2265b8ae6522cd15fb334c5f0dd03e4c111775dbc23eb371bcd3de2a0f582550d0cd829ae37a4acec9fd8001238f8210f9aaa44bf0bec |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b9ace02bfe8d5d5fa289cf5c6e7ae89d |
| SHA1 | bf4b471d0ab05fabbaec1ef2c52f36d9d2396adb |
| SHA256 | 3ca941c9577cdd7a20a56c8a38df634de23abd2f1c14270fedb1b0191833d847 |
| SHA512 | 154162c43570cc3205357b4673e0124eeefc4861cd8f159b6f520be77cdda5f8177b4faf6969d018aec4c7e3af8ec34263844660f612a30741a6a8c868e8d97a |
memory/4868-58-0x00007FFFBA453000-0x00007FFFBA455000-memory.dmp
memory/4868-59-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp