Malware Analysis Report

2024-09-23 02:55

Sample ID 240709-njw3as1hlm
Target Solara roblox.exe
SHA256 d9ca4eaa59a18b4b30518a5c85c757a8b04240e579a1460f0472c608aa2b7bc2
Tags
xworm stormkitty umbral execution persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d9ca4eaa59a18b4b30518a5c85c757a8b04240e579a1460f0472c608aa2b7bc2

Threat Level: Known bad

The file Solara roblox.exe was found to be: Known bad.

Malicious Activity Summary

xworm stormkitty umbral execution persistence rat spyware stealer trojan

Xworm family

Xworm

StormKitty payload

Umbral

Detect Umbral payload

Detect Xworm Payload

StormKitty

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Detects videocard installed

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Runs ping.exe

Uses Task Scheduler COM API

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-09 11:26

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-09 11:26

Reported

2024-07-09 11:29

Platform

win11-20240704-en

Max time kernel

133s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe"

Signatures

Detect Umbral payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Umbral

stealer umbral

Xworm

trojan rat xworm

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\nzelay.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3590242114-4229536887-1276274119-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\wmic.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3832 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3832 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\schtasks.exe
PID 3832 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Windows\System32\schtasks.exe
PID 3832 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Users\Admin\AppData\Local\Temp\nzelay.exe
PID 3832 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe C:\Users\Admin\AppData\Local\Temp\nzelay.exe
PID 3092 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\SYSTEM32\attrib.exe
PID 3092 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\SYSTEM32\attrib.exe
PID 3092 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 4180 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3092 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\System32\Wbem\wmic.exe
PID 3092 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\SYSTEM32\cmd.exe
PID 3092 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\nzelay.exe C:\Windows\SYSTEM32\cmd.exe
PID 4152 wrote to memory of 4784 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE
PID 4152 wrote to memory of 4784 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\PING.EXE

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe

"C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara roblox.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Solara roblox.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Local\Temp\nzelay.exe

"C:\Users\Admin\AppData\Local\Temp\nzelay.exe"

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\SYSTEM32\attrib.exe

"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\nzelay.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nzelay.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" os get Caption

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" computersystem get totalphysicalmemory

C:\Windows\System32\Wbem\wmic.exe

"wmic.exe" csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\System32\Wbem\wmic.exe

"wmic" path win32_VideoController get name

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\nzelay.exe" && pause

C:\Windows\system32\PING.EXE

ping localhost

C:\Users\Admin\AppData\Roaming\svchost.exe

C:\Users\Admin\AppData\Roaming\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
N/A 127.0.0.1:62559 tcp
US 147.185.221.19:62559 19.ip.gl.ply.gg tcp
GB 142.250.200.3:443 gstatic.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 162.159.136.232:443 discord.com tcp
US 147.185.221.19:62559 19.ip.gl.ply.gg tcp

Files

memory/3832-0-0x00007FF811983000-0x00007FF811985000-memory.dmp

memory/3832-1-0x0000000000620000-0x0000000000640000-memory.dmp

memory/3832-2-0x00007FF811980000-0x00007FF812442000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t10kuwlq.jpa.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/900-8-0x000002ACEEDA0000-0x000002ACEEDC2000-memory.dmp

memory/900-12-0x00007FF811980000-0x00007FF812442000-memory.dmp

memory/900-13-0x00007FF811980000-0x00007FF812442000-memory.dmp

memory/900-14-0x00007FF811980000-0x00007FF812442000-memory.dmp

memory/900-15-0x00007FF811980000-0x00007FF812442000-memory.dmp

memory/900-16-0x00007FF811980000-0x00007FF812442000-memory.dmp

memory/900-19-0x00007FF811980000-0x00007FF812442000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e3840d9bcedfe7017e49ee5d05bd1c46
SHA1 272620fb2605bd196df471d62db4b2d280a363c6
SHA256 3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f
SHA512 76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9d17e8585400bc639a8b261083920ec3
SHA1 aef71cce477bd67115a4e2a0a86e6b8f0f62e30a
SHA256 81fa386fa9b3d185839bec826c3f8cc422e1f329792b901d61be826d42a57fc1
SHA512 235c6644c1349c77f2805c400fd1091a8775b7e63a2ba2e360418faaeb8b696da13ea7bb33a2d92b35f3fafd30fa6945c2398fba7bba39cf5f037a7d900878d5

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8cb7f4b4ab204cacd1af6b29c2a2042c
SHA1 244540c38e33eac05826d54282a0bfa60340d6a1
SHA256 4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6
SHA512 7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

memory/3832-55-0x00007FF811980000-0x00007FF812442000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 ce28d82fa8e4dbbd72cae1bf8d4930e1
SHA1 0cba2f93bc5c9d9e4f950c66e7ac3acee3ce418f
SHA256 d9ca4eaa59a18b4b30518a5c85c757a8b04240e579a1460f0472c608aa2b7bc2
SHA512 ba5506f4dfa1c46e9ac38ca1c6ffabd1870eb4c99d98dae963dda8c387cc1c423a1cbef09f93befba889a65f8f51f34663f64dbb14743c82d8ec40fc036fe57e

C:\Users\Admin\AppData\Local\Temp\nzelay.exe

MD5 9f3f506175ad4d9550bf1aea609694a7
SHA1 6cc35e30d5b40eb1b5d115feec12ec247a84193f
SHA256 7103785c72f15bc66849b927bb9b0030c2a8383a8f71cd4308b0b42055d8d467
SHA512 b4a691e3b679dac187f1219cff013d3e27a87d55bf10c4744b8aba969a0caac39922dbbf9bce454b87e3e685f5bfa9043ecabacca090650278ab2d081bc2d5cb

memory/3092-70-0x000001EE4F670000-0x000001EE4F6B6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9deb31d63c251368f1dcf297650b2997
SHA1 02a6835b82971ae7dba9d97e528412fac5247714
SHA256 9c598fb1420e5646126e8f7a42a3ea94b1050017e9cb67bbe6429f08c1bc2893
SHA512 0d6c8958a051b75f0d0a53e336954e102e642ad79a96f39fb1ed6643d77f9b54725b27eef460e33c89ff1d6136155cb6d873c25f9ae3dfc4a9d3a9346816477a

memory/3092-93-0x000001EE69E60000-0x000001EE69ED6000-memory.dmp

memory/3092-94-0x000001EE69EE0000-0x000001EE69F30000-memory.dmp

memory/3092-95-0x000001EE69E40000-0x000001EE69E5E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6490e5c0581c173062323b1c20cfd9ff
SHA1 1652893659f99b780fd9733243637eb7795f5212
SHA256 a552b6d7bebb1714f01a5f3d8b5493e1b369c93ee68c62256dfddcc7f3f4fe79
SHA512 fdb077b40b4371a74cb70ae74d28a4433399e5c4a69fe9a5652409a62c2435d3197da42808d5cb65e9b7ff35bc2e593ad70fa83581c7fd672d631b25f53d3c65

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0ac871344dc49ae49f13f0f88acb4868
SHA1 5a073862375c7e79255bb0eab32c635b57a77f98
SHA256 688f15b59a784f6f4c62554f00b5d0840d1489cef989c18126c70dfee0806d37
SHA512 ace5c50303bd27998607cf34ac4322bcf5edfbd19bbb24309acf4d037b6f3f7636c7c14b6ac0b924114e036252d3a1b998951c7068f41548728fa5d92f5f9006

memory/3092-130-0x000001EE69F50000-0x000001EE69F62000-memory.dmp

memory/3092-129-0x000001EE69E30000-0x000001EE69E3A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2bb0538fcc1cbfca1c374b8c092adfcd
SHA1 11d04e1bb8c5bf2bcf295ce3f4fea2ba41e45ba0
SHA256 c4b7f436c24728ef7f02b2f071aa880287a8f102a5047fbecfd024f87ef5c67d
SHA512 38cc6d129be4429c3b5d173cde524306a981fd4ec75896725e02367fc2777edba711dce1e4331b4d27ee9fa6f80c58530f175e9246a7608230ba8940aa010841

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

memory/3832-150-0x000000001CB60000-0x000000001CC80000-memory.dmp