Malware Analysis Report

2024-12-07 14:21

Sample ID 241121-yl6dvswkey
Target 881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a
SHA256 881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a
Tags
xloader q3c8 discovery evasion execution loader persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a

Threat Level: Known bad

The file 881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a was found to be: Known bad.

Malicious Activity Summary

xloader q3c8 discovery evasion execution loader persistence rat trojan

Xloader family

UAC bypass

Xloader

Windows security bypass

Looks for VirtualBox Guest Additions in registry

Xloader payload

Looks for VMWare Tools registry key

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Windows security modification

Checks BIOS information in registry

Maps connected drives based on registry

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

System policy modification

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-21 19:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-21 19:53

Reported

2024-11-21 19:56

Platform

win7-20241010-en

Max time kernel

147s

Max time network

128s

Command Line

C:\Windows\Explorer.EXE

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Xloader

loader xloader

Xloader family

xloader

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Xloader payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\POZXMwv = "C:\\Windows\\Microsoft.NET\\Framework\\0r6lS7c\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\POZXMwv = "C:\\Windows\\Microsoft.NET\\Framework\\0r6lS7c\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2568 set thread context of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2884 set thread context of 1200 N/A C:\Windows\SysWOW64\newdev.exe C:\Windows\Explorer.EXE
PID 1264 set thread context of 1200 N/A C:\Windows\SysWOW64\cmmon32.exe C:\Windows\Explorer.EXE

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework\0r6lS7c C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\GJB88CH.raw C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
File created C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmmon32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\newdev.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Windows\SysWOW64\newdev.exe N/A
N/A N/A C:\Windows\SysWOW64\newdev.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\newdev.exe N/A
N/A N/A C:\Windows\SysWOW64\newdev.exe N/A
N/A N/A C:\Windows\SysWOW64\newdev.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A
N/A N/A C:\Windows\SysWOW64\cmmon32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\newdev.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\cmmon32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2568 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 2568 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\newdev.exe
PID 1200 wrote to memory of 1264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cmmon32.exe
PID 1200 wrote to memory of 1264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cmmon32.exe
PID 1200 wrote to memory of 1264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cmmon32.exe
PID 1200 wrote to memory of 1264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\cmmon32.exe
PID 1264 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmd.exe
PID 1264 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmd.exe
PID 1264 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmd.exe
PID 1264 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe

"C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force

C:\Windows\SysWOW64\newdev.exe

"C:\Windows\SysWOW64\newdev.exe"

C:\Windows\SysWOW64\cmmon32.exe

"C:\Windows\SysWOW64\cmmon32.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Windows\SysWOW64\newdev.exe"

Network

N/A

Files

memory/2568-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

memory/2568-1-0x0000000000B40000-0x0000000000C0E000-memory.dmp

memory/2568-2-0x00000000749F0000-0x00000000750DE000-memory.dmp

memory/2568-3-0x0000000004260000-0x000000000431A000-memory.dmp

memory/2568-4-0x0000000002010000-0x0000000002056000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 6b600c9e1cda0d770bf7189a4c6f23db
SHA1 f0118806bd369b4ba75d8316800eac1cb23f6b19
SHA256 3da2a8a3557746a8163bf36df93dc1c78276cda4f40babb1e571240081d611d7
SHA512 686b1e962b35d24dc1f7e0bfab0a8a541f8e9a4f9e600bfc85838eae59cfd002165d31a5389a5eda57232090e79584df5cf923b1ea029e506232036240377c74

memory/2884-33-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2884-37-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2884-40-0x0000000000400000-0x000000000042A000-memory.dmp

memory/2884-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2884-35-0x0000000000400000-0x000000000042A000-memory.dmp

memory/1200-42-0x0000000000010000-0x0000000000020000-memory.dmp

memory/2568-43-0x00000000749F0000-0x00000000750DE000-memory.dmp

memory/1264-44-0x0000000000030000-0x000000000003D000-memory.dmp

memory/1264-45-0x00000000000D0000-0x00000000000F9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-21 19:53

Reported

2024-11-21 19:56

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Xloader

loader xloader

Xloader family

xloader

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Xloader payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\POZXMwv = "C:\\Windows\\Microsoft.NET\\Framework\\0r6lS7c\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\POZXMwv = "C:\\Windows\\Microsoft.NET\\Framework\\0r6lS7c\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4432 set thread context of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 2468 set thread context of 3556 N/A C:\Windows\SysWOW64\rdrleakdiag.exe C:\Windows\Explorer.EXE
PID 2508 set thread context of 3556 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\Explorer.EXE

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\0r6lS7c C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\GJB88CH.raw C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rdrleakdiag.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
N/A N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
N/A N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
N/A N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
N/A N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
N/A N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rdrleakdiag.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4432 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4432 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 4432 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 4432 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 4432 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 4432 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 4432 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 4432 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe C:\Windows\SysWOW64\rdrleakdiag.exe
PID 3556 wrote to memory of 2508 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3556 wrote to memory of 2508 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 3556 wrote to memory of 2508 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\explorer.exe
PID 2508 wrote to memory of 4760 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 4760 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 4760 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe

"C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force

C:\Windows\SysWOW64\rdrleakdiag.exe

"C:\Windows\SysWOW64\rdrleakdiag.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Windows\SysWOW64\rdrleakdiag.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 www.libtardssuck.com udp
US 8.8.8.8:53 www.healthystart.today udp
US 8.8.8.8:53 www.mascotaexotica.xyz udp
US 8.8.8.8:53 www.mrd68.com udp
US 38.165.15.238:80 www.mrd68.com tcp
US 8.8.8.8:53 238.15.165.38.in-addr.arpa udp
US 8.8.8.8:53 www.kayskonjure.com udp
US 8.8.8.8:53 www.mumidom.art udp
US 8.8.8.8:53 www.applemorning.com udp
US 3.33.130.190:80 www.applemorning.com tcp
US 8.8.8.8:53 190.130.33.3.in-addr.arpa udp
US 8.8.8.8:53 www.bascountry.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.workshopabc.com udp
US 8.8.8.8:53 www.equinoxcoven.com udp
US 8.8.8.8:53 www.calculation.pro udp
DE 185.53.178.52:80 www.calculation.pro tcp
US 8.8.8.8:53 52.178.53.185.in-addr.arpa udp
US 8.8.8.8:53 www.apachejunctionhouses.com udp
US 8.8.8.8:53 www.globalpowershop.com udp
DE 202.61.232.37:80 www.globalpowershop.com tcp
US 8.8.8.8:53 37.232.61.202.in-addr.arpa udp
US 8.8.8.8:53 www.golduce.store udp
US 8.8.8.8:53 www.mundohightech.com udp
US 104.21.87.145:80 www.mundohightech.com tcp
US 8.8.8.8:53 145.87.21.104.in-addr.arpa udp
US 8.8.8.8:53 www.cchaplain.com udp
US 8.8.8.8:53 www.stintohytkyv.quest udp
US 8.8.8.8:53 www.politelyoffensive.com udp

Files

memory/4432-0-0x000000007452E000-0x000000007452F000-memory.dmp

memory/4432-1-0x0000000000E40000-0x0000000000F0E000-memory.dmp

memory/4432-2-0x0000000005920000-0x00000000059BC000-memory.dmp

memory/4432-3-0x0000000005F70000-0x0000000006514000-memory.dmp

memory/4432-4-0x00000000059C0000-0x0000000005A52000-memory.dmp

memory/4432-5-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4432-6-0x0000000005C10000-0x0000000005CCA000-memory.dmp

memory/4432-7-0x0000000005BA0000-0x0000000005BE6000-memory.dmp

memory/4432-8-0x0000000007590000-0x00000000075F6000-memory.dmp

memory/348-10-0x0000000002C90000-0x0000000002CC6000-memory.dmp

memory/3380-11-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/3380-12-0x0000000005AA0000-0x00000000060C8000-memory.dmp

memory/348-13-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/348-14-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/4432-15-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

memory/3380-16-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/1716-17-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/1716-21-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/3380-20-0x0000000006260000-0x00000000062C6000-memory.dmp

memory/3380-19-0x00000000061C0000-0x00000000061E2000-memory.dmp

memory/3380-18-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/3380-22-0x00000000063B0000-0x0000000006704000-memory.dmp

memory/2468-28-0x0000000000400000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gn4bxm41.idx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3380-52-0x0000000006960000-0x000000000697E000-memory.dmp

memory/3380-53-0x0000000006EF0000-0x0000000006F3C000-memory.dmp

memory/4432-82-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/2508-85-0x0000000000950000-0x0000000000D83000-memory.dmp

memory/2508-96-0x0000000000950000-0x0000000000D83000-memory.dmp

memory/3380-84-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/3380-83-0x0000000007960000-0x0000000007992000-memory.dmp

memory/3380-97-0x0000000007BA0000-0x0000000007C43000-memory.dmp

memory/3380-95-0x0000000006F40000-0x0000000006F5E000-memory.dmp

memory/3380-98-0x00000000082D0000-0x000000000894A000-memory.dmp

memory/3380-99-0x0000000007C80000-0x0000000007C9A000-memory.dmp

memory/348-100-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/1716-110-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/3380-120-0x0000000007CF0000-0x0000000007CFA000-memory.dmp

memory/3380-121-0x0000000007F00000-0x0000000007F96000-memory.dmp

memory/1188-123-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/3200-124-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/3380-122-0x0000000007E80000-0x0000000007E91000-memory.dmp

memory/1100-143-0x000000006F880000-0x000000006F8CC000-memory.dmp

memory/3380-153-0x0000000007EB0000-0x0000000007EBE000-memory.dmp

memory/3380-154-0x0000000007EC0000-0x0000000007ED4000-memory.dmp

memory/348-155-0x0000000007CB0000-0x0000000007CCA000-memory.dmp

memory/348-156-0x0000000007CA0000-0x0000000007CA8000-memory.dmp

memory/3380-157-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/1716-158-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/2508-164-0x0000000000910000-0x0000000000939000-memory.dmp

memory/3380-166-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/348-165-0x0000000074520000-0x0000000074CD0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 06712a73a342fa69f39f8e8001e22f76
SHA1 1bc9f686a1d3bb58be4cd7130410a4b6f881df25
SHA256 2164229f4d58cf79995cde057d842a8c028cb25f629a56e2847e8fd3961d9ee4
SHA512 83939dcf92624bf000438aef8e1e2d53786a3d3416f761d3811692c7b468f8526c5731ab5dc5d0c4a1ac5f1c836d6c1724994a66b6f3e1ca4af5264b4944ae45

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3f43001fe7348c73d754b507d59056ed
SHA1 3c3245d43a2824fd7780839e14e2fce2463cc09d
SHA256 e53afe85c34a193c55825a6809a5c1b5e206cf3d029ef86cd5d56875f417e2b5
SHA512 981a6f44cb2783f90df9cb6b31cc44d7d918f74faa3932d5faa0399c9c8d337567b745999c8ded8a9f4c6d5e718b49c0394e4bf5a63e20ceafeb0828800c4dd2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4b1c930765bad751727b636f36290189
SHA1 14005ff14ad0e590c77befdba6e2fc47132ab758
SHA256 6b13538cf69b683b9cd7b0fefa830fa9d6a1adad4e7ab9bce3fda2db8cfd30d4
SHA512 a5c2f04b60b85ae4bb5d05d4319160fd6309b4b12e1a023e1582f9e469e542d07addde97cff2a8045b10aefbb135eb7e7da718bbc7b03c307fa4cc1e772cd054

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c64a007edd61099d2319006a063941ab
SHA1 2a7bce936e1c8261f2d572e0e8fcbe2f20b90ca2
SHA256 1a6085b109aade075864b92e2ed9d4304d7517f552b3cfe6e2288f825128193f
SHA512 ca4f085d15432c2ab0d2a5fe0d0fb5e08a8b3ec3797c4601d077e8bcc579e69beb5e36666ce6a3e0bc3ddb82e88cc1c7429cccb464ea72f5f71cc5f5598cbdd7

memory/1716-171-0x0000000074520000-0x0000000074CD0000-memory.dmp

memory/3556-180-0x0000000008B00000-0x0000000008C19000-memory.dmp