Malware Analysis Report

2024-09-11 14:59

Sample ID 240609-n69a5sba47
Target 23456789876543456789087654.exe
SHA256 25ecbcbfbf71ced8d240cd6d9823af4dd9efc18bc0596f8a9e163d24a4d1079a
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

25ecbcbfbf71ced8d240cd6d9823af4dd9efc18bc0596f8a9e163d24a4d1079a

Threat Level: Known bad

The file 23456789876543456789087654.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Detect Xworm Payload

Xworm

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-09 12:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 12:01

Reported

2024-06-09 12:02

Platform

win10v2004-20240508-en

Max time kernel

32s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dllhost = "C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe" C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2880 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 2880 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe
PID 2880 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe
PID 2484 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe
PID 2484 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe
PID 1800 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe C:\Windows\system32\cmd.exe
PID 1800 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe C:\Windows\system32\cmd.exe
PID 5088 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5088 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5088 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5088 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5088 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5088 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5088 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5088 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe

"C:\Users\Admin\AppData\Local\Temp\23456789876543456789087654.exe"

C:\Users\Admin\AppData\Roaming\dllhost.exe

"C:\Users\Admin\AppData\Roaming\dllhost.exe"

C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe

"C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe

"C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c title Incognito v1.0.0b - public

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Dllhost.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
DE 45.157.232.173:7000 tcp
US 8.8.8.8:53 173.232.157.45.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp

Files

memory/2880-0-0x00007FFAE60C3000-0x00007FFAE60C5000-memory.dmp

memory/2880-1-0x0000000000B40000-0x0000000001240000-memory.dmp

C:\Users\Admin\AppData\Roaming\dllhost.exe

MD5 e46d807a18380e6a7f1d6977989a3f46
SHA1 7834bb664f67576b8b2d25f098ec46f5e279cc84
SHA256 6bea0dc4a9308dafb8ecffa2f3aa9404ffe8a4341c4ad93aab5790526534a8e5
SHA512 b9a4a954ab5968104241bfd8d6d50a0ff496eb238e194b244b789442b49fde3b67be967a26e1c4dac9608b12b1589421c3e9846afc8e51a7cb712e03ec48e9ad

memory/5088-13-0x0000000000910000-0x0000000000920000-memory.dmp

memory/5088-14-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp

C:\Users\Admin\AppData\Roaming\sigmahacks0.2.exe

MD5 10bbd38c21ebf84fea97c3812d57d9c6
SHA1 293cec0d7f44151ffbf88dfe408265825f8bca9b
SHA256 83c4e5947870b7b9f06044624b420ddc9fbae6898a5c9b4420c3dbeaca508bb9
SHA512 a00ec8ed84b806c4aca8564354a6687da64b999d255df7fea4c38e6026c8a4cee665414e96d5e28904d051f4c1a6956193a96c12e52286d6d7f58f39bae8ac31

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\test.exe

MD5 5244aa93f4209963f6c63e1ef9dde0b9
SHA1 642219eec726127fe7fbe9ceb5e223dcf46fbe46
SHA256 aeca166d5d3da9e76957686ca8753e95b930d8508f825f3cc6b4bac28da6e142
SHA512 e510165f98b070ad3c202734833230779fd95585d28b0a9873afbb5022f488c85e935b7f366a92b89449b42106f4ed76997cac16994386560bd45021d368e28c

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\python311.dll

MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes311.dll

MD5 90b786dc6795d8ad0870e290349b5b52
SHA1 592c54e67cf5d2d884339e7a8d7a21e003e6482f
SHA256 89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a
SHA512 c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\vcruntime140_1.dll

MD5 75e78e4bf561031d39f86143753400ff
SHA1 324c2a99e39f8992459495182677e91656a05206
SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512 ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32gui.pyd

MD5 3c81c0ceebb2b5c224a56c024021efad
SHA1 aee4ddcc136856ed2297d7dbdc781a266cf7eab9
SHA256 6085bc00a1f157c4d2cc0609e20e1e20d2572fe6498de3bec4c9c7bebcfbb629
SHA512 f2d6c06da4f56a8119a931b5895c446432152737b4a7ae95c2b91b1638e961da78833728d62e206e1d886e7c36d7bed3fa4403d0b57a017523dd831dd6b7117f

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 6a9ca97c039d9bbb7abf40b53c851198
SHA1 01bcbd134a76ccd4f3badb5f4056abedcff60734
SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
SHA512 dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\_socket.pyd

MD5 8140bdc5803a4893509f0e39b67158ce
SHA1 653cc1c82ba6240b0186623724aec3287e9bc232
SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
SHA512 d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\python3.dll

MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\psutil\_psutil_windows.pyd

MD5 3cba71b6bc59c26518dc865241add80a
SHA1 7e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
SHA512 3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\_lzma.pyd

MD5 337b0e65a856568778e25660f77bc80a
SHA1 4d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
SHA512 19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\_bz2.pyd

MD5 4101128e19134a4733028cfaafc2f3bb
SHA1 66c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
SHA512 4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\select.pyd

MD5 97ee623f1217a7b4b7de5769b7b665d6
SHA1 95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
SHA512 20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\libffi-8.dll

MD5 32d36d2b0719db2b739af803c5e1c2f5
SHA1 023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
SHA512 a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\win32process.pyd

MD5 936b26a67e6c7788c3a5268f478e01b8
SHA1 0ee92f0a97a14fcd45865667ed02b278794b2fdf
SHA256 0459439ef3efa0e0fc2b8ca3f0245826e9bbd7e8f3266276398921a4aa899fbd
SHA512 bfe37390da24cc9422cabbbbbc7733d89f61d73ecc3765fe494b5a7bd044e4ffb629f1bb4a28437fe9ad169ae65f2338c15d689f381f9e745c44f2741388860b

C:\Users\Admin\AppData\Local\Temp\onefile_2484_133624081479541542\win32api.pyd

MD5 1d6762b494dc9e60ca95f7238ae1fb14
SHA1 aa0397d96a0ed41b2f03352049dafe040d59ad5d
SHA256 fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664
SHA512 0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00

memory/5088-81-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp

memory/4892-82-0x0000023CD02F0000-0x0000023CD0312000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwag21th.j13.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 34f595487e6bfd1d11c7de88ee50356a
SHA1 4caad088c15766cc0fa1f42009260e9a02f953bb
SHA256 0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d
SHA512 10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

memory/5088-124-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp

memory/5088-125-0x00007FFAE60C0000-0x00007FFAE6B81000-memory.dmp