xworm | 6e7c573f8188ce9f7ae1309aff107961c5d822d92d9bd5e6c5dc247a68c255f5

Analysis

max time kernel
134s
max time network
141s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/09/2024, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ödeme Bildirimi1.exe
Size

1.0MB
MD5

11d08d39cc44ebf70c89dba399a05567
SHA1

288a8b969866e70f15a9e5b527bc44d0a55439d6
SHA256

6e7c573f8188ce9f7ae1309aff107961c5d822d92d9bd5e6c5dc247a68c255f5
SHA512

a4a6422285fe3ecd3d5d373a3bda09713cbd703261d067268f079ff2bac3cee417c10b2fdb5c2dba0ff7a583d13fb30735e48289aa15623fae93d86a0850e260
SSDEEP

12288:rGZKzvvWBKYvI8PmVx5OdwGGZr/1e4271YW/sFUD:XWOjv5fGsTW2W/sFUD

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

taraji111.duckdns.org:31823

Mutex

RFfb2ploDgN8rSit

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/5096-29-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
356	powershell.exe
1616	powershell.exe
2984	powershell.exe
1092	powershell.exe
832	powershell.exe
1388	powershell.exe
4448	powershell.exe
752	powershell.exe
2204	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2180	Ödeme Bildirimi1.exe
2616	Ödeme Bildirimi1.exe
2120	Ödeme Bildirimi1.exe
1948	Ödeme Bildirimi1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ödeme Bildirimi1 = "C:\\Users\\Admin\\AppData\\Roaming\\Ödeme Bildirimi1.exe"	Ödeme Bildirimi1.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 5096	1768	Ödeme Bildirimi1.exe	79
PID 2180 set thread context of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2120 set thread context of 1948	2120	Ödeme Bildirimi1.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ödeme Bildirimi1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ödeme Bildirimi1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ödeme Bildirimi1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ödeme Bildirimi1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ödeme Bildirimi1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ödeme Bildirimi1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2984	schtasks.exe
516	schtasks.exe
1400	schtasks.exe
1228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
752	powershell.exe
2204	powershell.exe
2204	powershell.exe
752	powershell.exe
752	powershell.exe
2204	powershell.exe
1092	powershell.exe
1092	powershell.exe
1092	powershell.exe
1388	powershell.exe
1388	powershell.exe
1388	powershell.exe
832	powershell.exe
832	powershell.exe
832	powershell.exe
5096	Ödeme Bildirimi1.exe
4448	powershell.exe
356	powershell.exe
356	powershell.exe
4448	powershell.exe
4448	powershell.exe
356	powershell.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
5096	Ödeme Bildirimi1.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	5096	Ödeme Bildirimi1.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	5096	Ödeme Bildirimi1.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	356	powershell.exe
Token: SeDebugPrivilege	2616	Ödeme Bildirimi1.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1948	Ödeme Bildirimi1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5096	Ödeme Bildirimi1.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 752	1768	Ödeme Bildirimi1.exe	73
PID 1768 wrote to memory of 752	1768	Ödeme Bildirimi1.exe	73
PID 1768 wrote to memory of 752	1768	Ödeme Bildirimi1.exe	73
PID 1768 wrote to memory of 2204	1768	Ödeme Bildirimi1.exe	75
PID 1768 wrote to memory of 2204	1768	Ödeme Bildirimi1.exe	75
PID 1768 wrote to memory of 2204	1768	Ödeme Bildirimi1.exe	75
PID 1768 wrote to memory of 1228	1768	Ödeme Bildirimi1.exe	76
PID 1768 wrote to memory of 1228	1768	Ödeme Bildirimi1.exe	76
PID 1768 wrote to memory of 1228	1768	Ödeme Bildirimi1.exe	76
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 1768 wrote to memory of 5096	1768	Ödeme Bildirimi1.exe	79
PID 5096 wrote to memory of 1092	5096	Ödeme Bildirimi1.exe	80
PID 5096 wrote to memory of 1092	5096	Ödeme Bildirimi1.exe	80
PID 5096 wrote to memory of 1092	5096	Ödeme Bildirimi1.exe	80
PID 5096 wrote to memory of 1388	5096	Ödeme Bildirimi1.exe	82
PID 5096 wrote to memory of 1388	5096	Ödeme Bildirimi1.exe	82
PID 5096 wrote to memory of 1388	5096	Ödeme Bildirimi1.exe	82
PID 5096 wrote to memory of 832	5096	Ödeme Bildirimi1.exe	84
PID 5096 wrote to memory of 832	5096	Ödeme Bildirimi1.exe	84
PID 5096 wrote to memory of 832	5096	Ödeme Bildirimi1.exe	84
PID 5096 wrote to memory of 2984	5096	Ödeme Bildirimi1.exe	86
PID 5096 wrote to memory of 2984	5096	Ödeme Bildirimi1.exe	86
PID 5096 wrote to memory of 2984	5096	Ödeme Bildirimi1.exe	86
PID 2180 wrote to memory of 4448	2180	Ödeme Bildirimi1.exe	90
PID 2180 wrote to memory of 4448	2180	Ödeme Bildirimi1.exe	90
PID 2180 wrote to memory of 4448	2180	Ödeme Bildirimi1.exe	90
PID 2180 wrote to memory of 356	2180	Ödeme Bildirimi1.exe	92
PID 2180 wrote to memory of 356	2180	Ödeme Bildirimi1.exe	92
PID 2180 wrote to memory of 356	2180	Ödeme Bildirimi1.exe	92
PID 2180 wrote to memory of 516	2180	Ödeme Bildirimi1.exe	93
PID 2180 wrote to memory of 516	2180	Ödeme Bildirimi1.exe	93
PID 2180 wrote to memory of 516	2180	Ödeme Bildirimi1.exe	93
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2180 wrote to memory of 2616	2180	Ödeme Bildirimi1.exe	96
PID 2120 wrote to memory of 1616	2120	Ödeme Bildirimi1.exe	98
PID 2120 wrote to memory of 1616	2120	Ödeme Bildirimi1.exe	98
PID 2120 wrote to memory of 1616	2120	Ödeme Bildirimi1.exe	98
PID 2120 wrote to memory of 2984	2120	Ödeme Bildirimi1.exe	100
PID 2120 wrote to memory of 2984	2120	Ödeme Bildirimi1.exe	100
PID 2120 wrote to memory of 2984	2120	Ödeme Bildirimi1.exe	100
PID 2120 wrote to memory of 1400	2120	Ödeme Bildirimi1.exe	101
PID 2120 wrote to memory of 1400	2120	Ödeme Bildirimi1.exe	101
PID 2120 wrote to memory of 1400	2120	Ödeme Bildirimi1.exe	101
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104
PID 2120 wrote to memory of 1948	2120	Ödeme Bildirimi1.exe	104

C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi1.exe
"C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aoVOfKYFaH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aoVOfKYFaH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp97DB.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi1.exe
  "C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi1.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Ödeme Bildirimi1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Ödeme Bildirimi1" /tr "C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2984

C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe
"C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aoVOfKYFaH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:356
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aoVOfKYFaH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:516
- C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe
  "C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2616

C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe
"C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aoVOfKYFaH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aoVOfKYFaH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp481B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1400
- C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe
  "C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ödeme Bildirimi1.exe.log

Filesize
1KB

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
dfc65035dc99768759fdfcae727d9a13

SHA1
bd0d6171d1b434bb46accd37714fa4808528dfba

SHA256
408fe9fd06571fce1b66fe802a76841e7d3ec5840847d9ded17ec36f38acfffe

SHA512
508388f6565555702046776e1a89b9e325e7a5082acc1bf71c4d4aeac7077f081071a72c6b341a2104efb5a2f4b23b89ad420616f673f3120b388f6eeef4e6bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ccd46025c971e0e8d1cab782271487de

SHA1
b9da8042924aa2138fa8f9ea777761d26077bd29

SHA256
ac7e6c5dfea7faac50092b458ce33b62ae44764df3d0db1131fbb047cd869efe

SHA512
94339d107ccf81f96f6753ad6bde79b3a99548a519c8eaf25118be1e2b5da55182f0f5d390419e1f05341e7a6222b68ad87f48ce9ae7bbc58f12fe954aa31a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
cdd7998157bcf506a3102c960330d0c4

SHA1
06a21e6121af023e155a1b7532abedd41254af44

SHA256
1ccb06cee199445dea4bb7f0c3e8f2fbb0d09286982abcfd677173ac840340a1

SHA512
2425fa4df88ddb83367911f6ec006c8e0c6998b40564f9ef12a4ce93d8825aea2f1b62801b49a2d36da63b7897ab2a0c1c36e69b2de2c8847262ef0ee20fb4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
89bc3219a1e15f2c546f6049e4cc4277

SHA1
86edf37fe3e716bdb7b9d0737ff364981d3a6f48

SHA256
258e7750a9055a93dcf8781640138b4a9ff0d730777bdb4db19fd92fa50051b9

SHA512
10500d56a37c4a52cd24d619aeec7e26093d2e76fed2a981b71bc083e0376b4e6ac06822515a88cb2a8ae8a473b0acb8f2d15ac9252d9072c75d38c3ca699764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
9c5c498388c7f1c7a0d0469e4027e3bb

SHA1
bdc096c8aa4fe823030c025b74589fb291d4ff4d

SHA256
4eda33a88b6464365c8d2c233c66f087188a0f944d3557d75959f16bb036cab9

SHA512
efae05397e247e9a3d37fc264b9c23bfddf28b6989d20fdde1829df421606afbfb4cd79e2933a210a52858ee00fd6bfaccf3d456c8f816103ad52dcead29f857

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34dtlol5.zdx.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp97DB.tmp

Filesize
1KB

MD5
cd7ad5bed1d79603b845a6f46afc500d

SHA1
0616c1aeb33866092afd6561a664e128980e697e

SHA256
78e34e8a1598b7bf08f50b22d94befa050fb8f12f4fdeead13954da1cb984c6c

SHA512
734578604116a7e7324e1ae30240d5ded8f6881592093fd12ff48fd2f5449447478899ae4c6ad53f4c33e9e6db6571b22d294e5e68412d2096a7250770b5b70b

Download Submit
C:\Users\Admin\AppData\Roaming\Ödeme Bildirimi1.exe

Filesize
1.0MB

MD5
11d08d39cc44ebf70c89dba399a05567

SHA1
288a8b969866e70f15a9e5b527bc44d0a55439d6

SHA256
6e7c573f8188ce9f7ae1309aff107961c5d822d92d9bd5e6c5dc247a68c255f5

SHA512
a4a6422285fe3ecd3d5d373a3bda09713cbd703261d067268f079ff2bac3cee417c10b2fdb5c2dba0ff7a583d13fb30735e48289aa15623fae93d86a0850e260

Download Submit
memory/356-1269-0x000000006FEC0000-0x000000006FF0B000-memory.dmp

Filesize
300KB

Download
memory/752-68-0x00000000747F0000-0x000000007483B000-memory.dmp

Filesize
300KB

Download
memory/752-34-0x0000000008870000-0x00000000088E6000-memory.dmp

Filesize
472KB

Download
memory/752-18-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/752-21-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/752-67-0x00000000098E0000-0x0000000009913000-memory.dmp

Filesize
204KB

Download
memory/752-19-0x0000000007920000-0x0000000007F48000-memory.dmp

Filesize
6.2MB

Download
memory/752-506-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/752-69-0x00000000098C0000-0x00000000098DE000-memory.dmp

Filesize
120KB

Download
memory/752-17-0x0000000004CD0000-0x0000000004D06000-memory.dmp

Filesize
216KB

Download
memory/752-74-0x0000000009A20000-0x0000000009AC5000-memory.dmp

Filesize
660KB

Download
memory/752-20-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/832-997-0x00000000712E0000-0x000000007132B000-memory.dmp

Filesize
300KB

Download
memory/1092-509-0x0000000007590000-0x00000000078E0000-memory.dmp

Filesize
3.3MB

Download
memory/1092-511-0x0000000007A80000-0x0000000007ACB000-memory.dmp

Filesize
300KB

Download
memory/1092-528-0x00000000712E0000-0x000000007132B000-memory.dmp

Filesize
300KB

Download
memory/1092-533-0x0000000008EC0000-0x0000000008F65000-memory.dmp

Filesize
660KB

Download
memory/1388-763-0x00000000712E0000-0x000000007132B000-memory.dmp

Filesize
300KB

Download
memory/1616-1704-0x0000000007490000-0x00000000077E0000-memory.dmp

Filesize
3.3MB

Download
memory/1616-1722-0x000000006FEC0000-0x000000006FF0B000-memory.dmp

Filesize
300KB

Download
memory/1768-2-0x0000000005790000-0x0000000005C8E000-memory.dmp

Filesize
5.0MB

Download
memory/1768-6-0x0000000007B60000-0x0000000007B78000-memory.dmp

Filesize
96KB

Download
memory/1768-5-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/1768-7-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/1768-10-0x000000000A490000-0x000000000A52C000-memory.dmp

Filesize
624KB

Download
memory/1768-9-0x0000000007CA0000-0x0000000007CF2000-memory.dmp

Filesize
328KB

Download
memory/1768-0-0x000000007402E000-0x000000007402F000-memory.dmp

Filesize
4KB

Download
memory/1768-4-0x00000000050D0000-0x00000000050DA000-memory.dmp

Filesize
40KB

Download
memory/1768-31-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/1768-3-0x0000000005130000-0x00000000051C2000-memory.dmp

Filesize
584KB

Download
memory/1768-1-0x0000000000810000-0x0000000000898000-memory.dmp

Filesize
544KB

Download
memory/1768-8-0x0000000074020000-0x000000007470E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-33-0x00000000079F0000-0x0000000007A3B000-memory.dmp

Filesize
300KB

Download
memory/2204-32-0x0000000007470000-0x000000000748C000-memory.dmp

Filesize
112KB

Download
memory/2204-455-0x0000000008FF0000-0x000000000900A000-memory.dmp

Filesize
104KB

Download
memory/2204-26-0x0000000006B50000-0x0000000006BB6000-memory.dmp

Filesize
408KB

Download
memory/2204-80-0x0000000009040000-0x00000000090D4000-memory.dmp

Filesize
592KB

Download
memory/2204-75-0x00000000747F0000-0x000000007483B000-memory.dmp

Filesize
300KB

Download
memory/2204-24-0x0000000006AB0000-0x0000000006AD2000-memory.dmp

Filesize
136KB

Download
memory/2204-474-0x0000000008FE0000-0x0000000008FE8000-memory.dmp

Filesize
32KB

Download
memory/2204-28-0x0000000007630000-0x0000000007980000-memory.dmp

Filesize
3.3MB

Download
memory/2204-27-0x0000000007340000-0x00000000073A6000-memory.dmp

Filesize
408KB

Download
memory/2984-1213-0x0000000000720000-0x00000000007CE000-memory.dmp

Filesize
696KB

Download
memory/4448-1268-0x00000000093E0000-0x0000000009485000-memory.dmp

Filesize
660KB

Download
memory/4448-1261-0x000000006FEC0000-0x000000006FF0B000-memory.dmp

Filesize
300KB

Download
memory/4448-1230-0x0000000008390000-0x00000000083DB000-memory.dmp

Filesize
300KB

Download
memory/4448-1226-0x0000000007980000-0x0000000007CD0000-memory.dmp

Filesize
3.3MB

Download
memory/5096-29-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download