xworm | 16b9779bc79413bbfa3194a7cf406635548c03b4f7ebdce230aa88dc6bf01da0

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FULLOPTION.exe
Size

4.7MB
MD5

9907f1198b7ef415b03810f28cd1b32f
SHA1

df6773b58ddd0de1bad25ce141431b1805011ea9
SHA256

16b9779bc79413bbfa3194a7cf406635548c03b4f7ebdce230aa88dc6bf01da0
SHA512

4dd1af5964cbc6fd3c3f1b4ee3809d4286d193e9f3839599ccb718aad150d460fbeffa592e3d5b6d45c717c5328dd48853e7fdbcc4e8e7613a8799d05f20b474
SSDEEP

98304:CS183Lm2l1laOmBSHmhRMI7f/1Z6p81tznH3AHI2O9eoSSM:CS183Lm2l1laOm7zdqCtzH3YXo

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

45.141.27.222:5000

127.0.0.1:7000

Attributes

Install_directory
%AppData%
install_file
Updete.exe

Signatures

Detect Xworm Payload 8 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\svchot.exe	family_xworm
C:\Users\Admin\AppData\Roaming\Steam.exe	family_xworm
C:\Users\Admin\AppData\Roaming\microsoft.exe	family_xworm
behavioral2/memory/4496-40-0x0000000000220000-0x000000000027A000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\XClient.exe	family_xworm
behavioral2/memory/2052-58-0x0000000000D60000-0x0000000000D88000-memory.dmp	family_xworm
behavioral2/memory/1868-45-0x0000000000F60000-0x0000000000F78000-memory.dmp	family_xworm
behavioral2/memory/1164-59-0x0000000000800000-0x0000000000818000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2272	powershell.exe
4652	powershell.exe
3016	powershell.exe
4752	powershell.exe
1168	powershell.exe
3736	powershell.exe
1532	powershell.exe
4520	powershell.exe
4316	powershell.exe
860	powershell.exe
4448	powershell.exe
3960	powershell.exe
3196	powershell.exe
4832	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FULLOPTION.exesvchot.exemicrosoft.exeSteam.exeXClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	FULLOPTION.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	svchot.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	microsoft.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Steam.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	XClient.exe

Executes dropped EXE 5 IoCs

Processes:

FULLOPTION.exesvchot.exeSteam.exemicrosoft.exeXClient.exe

pid process

3620 FULLOPTION.exe
1868 svchot.exe
4496 Steam.exe
2052 microsoft.exe
1164 XClient.exe

pid	process
3620	FULLOPTION.exe
1868	svchot.exe
4496	Steam.exe
2052	microsoft.exe
1164	XClient.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

microsoft.exesvchot.exeSteam.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updete = "C:\\Users\\Admin\\AppData\\Roaming\\Updete.exe"	microsoft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updete = "C:\\Users\\Admin\\AppData\\Roaming\\Updete.exe"	svchot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updete = "C:\\Users\\Admin\\AppData\\Roaming\\Updete.exe"	Steam.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
14	ip-api.com

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeXClient.exepowershell.exepowershell.exepowershell.exepowershell.exemicrosoft.exesvchot.exeSteam.exe

pid	process
4448	powershell.exe
4448	powershell.exe
4520	powershell.exe
1532	powershell.exe
1532	powershell.exe
4520	powershell.exe
2272	powershell.exe
4316	powershell.exe
4316	powershell.exe
860	powershell.exe
860	powershell.exe
860	powershell.exe
2272	powershell.exe
2272	powershell.exe
4316	powershell.exe
4652	powershell.exe
4652	powershell.exe
4752	powershell.exe
4752	powershell.exe
3016	powershell.exe
3016	powershell.exe
4752	powershell.exe
3016	powershell.exe
4832	powershell.exe
1164	XClient.exe
4832	powershell.exe
3960	powershell.exe
3960	powershell.exe
3196	powershell.exe
3196	powershell.exe
1168	powershell.exe
1168	powershell.exe
3736	powershell.exe
3736	powershell.exe
2052	microsoft.exe
1868	svchot.exe
4496	Steam.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

Steam.exesvchot.exemicrosoft.exeXClient.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4496	Steam.exe
Token: SeDebugPrivilege	1868	svchot.exe
Token: SeDebugPrivilege	2052	microsoft.exe
Token: SeDebugPrivilege	1164	XClient.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	1164	XClient.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	2052	microsoft.exe
Token: SeDebugPrivilege	1868	svchot.exe
Token: SeDebugPrivilege	4496	Steam.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

XClient.exemicrosoft.exesvchot.exeSteam.exe

pid process

1164 XClient.exe
2052 microsoft.exe
1868 svchot.exe
4496 Steam.exe

pid	process
1164	XClient.exe
2052	microsoft.exe
1868	svchot.exe
4496	Steam.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

FULLOPTION.exesvchot.exemicrosoft.exeSteam.exeXClient.exe

description	pid	process	target process
PID 4528 wrote to memory of 3620	4528	FULLOPTION.exe	FULLOPTION.exe
PID 4528 wrote to memory of 3620	4528	FULLOPTION.exe	FULLOPTION.exe
PID 4528 wrote to memory of 1868	4528	FULLOPTION.exe	svchot.exe
PID 4528 wrote to memory of 1868	4528	FULLOPTION.exe	svchot.exe
PID 4528 wrote to memory of 4496	4528	FULLOPTION.exe	Steam.exe
PID 4528 wrote to memory of 4496	4528	FULLOPTION.exe	Steam.exe
PID 4528 wrote to memory of 2052	4528	FULLOPTION.exe	microsoft.exe
PID 4528 wrote to memory of 2052	4528	FULLOPTION.exe	microsoft.exe
PID 4528 wrote to memory of 1164	4528	FULLOPTION.exe	XClient.exe
PID 4528 wrote to memory of 1164	4528	FULLOPTION.exe	XClient.exe
PID 1868 wrote to memory of 1532	1868	svchot.exe	powershell.exe
PID 1868 wrote to memory of 1532	1868	svchot.exe	powershell.exe
PID 2052 wrote to memory of 4448	2052	microsoft.exe	powershell.exe
PID 2052 wrote to memory of 4448	2052	microsoft.exe	powershell.exe
PID 4496 wrote to memory of 4520	4496	Steam.exe	powershell.exe
PID 4496 wrote to memory of 4520	4496	Steam.exe	powershell.exe
PID 1164 wrote to memory of 2272	1164	XClient.exe	powershell.exe
PID 1164 wrote to memory of 2272	1164	XClient.exe	powershell.exe
PID 1868 wrote to memory of 4316	1868	svchot.exe	powershell.exe
PID 1868 wrote to memory of 4316	1868	svchot.exe	powershell.exe
PID 2052 wrote to memory of 860	2052	microsoft.exe	powershell.exe
PID 2052 wrote to memory of 860	2052	microsoft.exe	powershell.exe
PID 4496 wrote to memory of 4652	4496	Steam.exe	powershell.exe
PID 4496 wrote to memory of 4652	4496	Steam.exe	powershell.exe
PID 2052 wrote to memory of 3016	2052	microsoft.exe	powershell.exe
PID 2052 wrote to memory of 3016	2052	microsoft.exe	powershell.exe
PID 1164 wrote to memory of 4752	1164	XClient.exe	powershell.exe
PID 1164 wrote to memory of 4752	1164	XClient.exe	powershell.exe
PID 1868 wrote to memory of 4832	1868	svchot.exe	powershell.exe
PID 1868 wrote to memory of 4832	1868	svchot.exe	powershell.exe
PID 4496 wrote to memory of 3960	4496	Steam.exe	powershell.exe
PID 4496 wrote to memory of 3960	4496	Steam.exe	powershell.exe
PID 2052 wrote to memory of 3196	2052	microsoft.exe	powershell.exe
PID 2052 wrote to memory of 3196	2052	microsoft.exe	powershell.exe
PID 1868 wrote to memory of 1168	1868	svchot.exe	powershell.exe
PID 1868 wrote to memory of 1168	1868	svchot.exe	powershell.exe
PID 4496 wrote to memory of 3736	4496	Steam.exe	powershell.exe
PID 4496 wrote to memory of 3736	4496	Steam.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\FULLOPTION.exe
"C:\Users\Admin\AppData\Local\Temp\FULLOPTION.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Roaming\FULLOPTION.exe
  "C:\Users\Admin\AppData\Roaming\FULLOPTION.exe"
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Users\Admin\AppData\Roaming\svchot.exe
  "C:\Users\Admin\AppData\Roaming\svchot.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchot.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchot.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\Users\Admin\AppData\Roaming\Steam.exe
  "C:\Users\Admin\AppData\Roaming\Steam.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\Users\Admin\AppData\Roaming\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\microsoft.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'microsoft.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Updete.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1fb15474bd9f6310d756d117c40b0e22

SHA1
3df1e642a910ef775a20ac3ba52583a99750e1c6

SHA256
e14714956a528d1f401de4025b49efedeef2dbb9b9f77580b74feaf77206dbb1

SHA512
2e486d5793dc15cd5c9c652e9aaabf4811149f1dce7cda81d54681581458a1897869ca58ad0b75aed1cd5fd0c87437742510b1df9c3cb3a5bd2c865ef3167af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
efe82baa423edc64c5b7702edfd254e6

SHA1
240c627d699df5f1fee583e9ddb1f6df4f6f018b

SHA256
e20ae69a3660ba78ff838550672f6cd00cb279134667bfd608e2c6e6157689c6

SHA512
5810cf034ee58d99915484cb0228dcccd3fd9c8f3162f631de6fd87fb515762f8f4915f87cb733913636f6729ae7ed97987a8b96a5e6c2601372670792d4d608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4bc6f0dc6a9cede40d451decb7fa43b2

SHA1
2f06132c91ede195a1c91b23024bcef0cdf3b41d

SHA256
b5e24e192d3f4f790d8004b051169c3935660252ca603bb9f4216c4b9e0db1ff

SHA512
9fae34da5939fc4df298d0d3448544d3a61862d30198a47da9cd4c099514a7460b20fe09ca3fc041f9631bd03519d804476f34590ba32e5cd65969dfad00c1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6eb4ee3f6fff9069b68a3448005c2c3a

SHA1
b439e804bbc0a8cbb709bef26030fe0e4a15d479

SHA256
df24b1fd9e4aabb1eea401331a9bb776ecb04cf7e639480ee8788f45da7245b1

SHA512
c96496b93568eb47a3e89f0281854e83523e7e8d793701b1e85f3e62ecaef7c705627ff6e64a67c818ff99832b8e50fd93766553e80c077730221b5ebe15c1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cae60f0ddddac635da71bba775a2c5b4

SHA1
386f1a036af61345a7d303d45f5230e2df817477

SHA256
b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16

SHA512
28ed8a8bc132ef56971cfd7b517b17cdb74a7f8c247ef6bff232996210075e06aa58a415825a1e038cfb547ad3dc6882bf1ca1b68c5b360ef0512a1440850253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef647504cf229a16d02de14a16241b90

SHA1
81480caca469857eb93c75d494828b81e124fda0

SHA256
47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710

SHA512
a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sivlapmg.4gb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\FULLOPTION.exe

Filesize
3.8MB

MD5
1dcdd77ba8afe481b4af754876f70ee8

SHA1
322ac691dc8b990ccb94f66f43a1b98f4d1eb299

SHA256
e5f2c31e3b741665821670118a78692cd1f44a349ad20007c0628fa3fb307734

SHA512
ee67e29bfd257329a29a07bfdb629acecec718a9afb62fe87d3a4ff08074dad6176cc65eef15dece4b11c0f1e61df11912faa0da9f88b36c59bdbfc4d50bf1e3

Download Submit
C:\Users\Admin\AppData\Roaming\Steam.exe

Filesize
334KB

MD5
ceee3ecf024a112ccf7961913269e427

SHA1
00841649617162fb1e3304a5c6bc762112c7028d

SHA256
2e255762f2d6e14d0f6ef93236162c4534ff47982ed21fe99bf6bee825916a47

SHA512
764f4c1e4b5c1a91d6256c2ef23559e8387b0d90360a902ff0a7cb31f2a4031d348f3b9648e1e50b9608be6eab7dfec5bfc928373e66682faf37ffd57db630f7

Download Submit
C:\Users\Admin\AppData\Roaming\Updete.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
69KB

MD5
28aa93aefb55bdcd6e10d47b0cf4b2ff

SHA1
81d9c21e1805ac54f193c3e4003a185c4284101c

SHA256
c5096e65190e515dfd7b967d3c06688d245302947f70be95275f35a9be11232f

SHA512
301af3bce98c32db8444cde3876a47f86dac119d814ff4b2b1a6f2bd5952c568343af5ec4bf104d9983f4992c33f57ee566d81ad4c7b3317b5f4a478e732c1f7

Download Submit
C:\Users\Admin\AppData\Roaming\microsoft.exe

Filesize
134KB

MD5
35ca2bf30d29985371c77c07021e285b

SHA1
306022fe7d67cca4d750498955ba7d2d5150c1cb

SHA256
93b744a61c81e0590a26abb9a47d3fec6b50f5f6216f20addcbed0359b875c09

SHA512
abd65455ae801ff4e6c03196142676faf1dcf58e9b20b24f2c701542aba1d13914a44009da53913234e2784cb2b912ee1fa2a952e0057b2cd3432e8b2253c927

Download Submit
C:\Users\Admin\AppData\Roaming\svchot.exe

Filesize
72KB

MD5
72e2cdeaa842da4806f61f23400fd44d

SHA1
319c3b0e92f9ef6f1b6f2067ed4779a15d9b07a9

SHA256
884fc2ad543fa83521c479d97d8c3a61c4fea9d2e856f4e7525aaad2c544c6dd

SHA512
cf81797b53aca5c56724b1c171968421e5d327e6af776c8f09f1966f8073e80e018e689bba8aa090b3a92db644d2fed5861512135962ddcadd64ce9a44e70d7d

Download Submit
memory/1164-59-0x0000000000800000-0x0000000000818000-memory.dmp

Filesize
96KB

Download
memory/1868-48-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

Filesize
10.8MB

Download
memory/1868-45-0x0000000000F60000-0x0000000000F78000-memory.dmp

Filesize
96KB

Download
memory/1868-221-0x00007FFE00F30000-0x00007FFE019F1000-memory.dmp

Filesize
10.8MB

Download
memory/2052-58-0x0000000000D60000-0x0000000000D88000-memory.dmp

Filesize
160KB

Download
memory/4448-65-0x000001747D200000-0x000001747D222000-memory.dmp

Filesize
136KB

Download
memory/4496-40-0x0000000000220000-0x000000000027A000-memory.dmp

Filesize
360KB

Download
memory/4528-1-0x0000000000210000-0x00000000006BE000-memory.dmp

Filesize
4.7MB

Download
memory/4528-0-0x00007FFE00F33000-0x00007FFE00F35000-memory.dmp

Filesize
8KB

Download