Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    45s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/01/2025, 15:26

General

  • Target

    XWorm V6.0.exe

  • Size

    21.6MB

  • MD5

    ba23d65ef70b05cd3b04dfcbbd801059

  • SHA1

    5c241dc3d79f61bdf82d091bfe29bca2e641d802

  • SHA256

    0712085082841796a11be3e988c1cc131d1608809321683d4e4482363f616e0d

  • SHA512

    d32a4838ca544b9b4764bb99b716faf797aa194199151426a8848c1ed27b5f2428629324d30f15db138ff56d34d46233e3ef106ad416eff29de43eb8ade0eff9

  • SSDEEP

    393216:6JSgxj4gebngiHe2bD616QWBbdw6s8qaPNL1Zjo7YOiFSbzPQWrGMYV3j+cintc:4agiHe2n61Ub1fqY1Z8WSPFrlNHnt

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

WcpxqjjxSrB6UOUw

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/RPPi3ByL

  • telegram

    https://api.telegram.org/bot7483240807:AAHWuUBi6sW9ZOb0kfXVbzbMVyLtPj-9vZY/sendMessage?chat_id=5279018187

aes.plain
aes.plain
aes.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

51.89.44.68:8848

Mutex

etb3t1tr5n

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7204924753:AAFaqmmBR9ybp4-iE8BA2YCiFNUbOEd0Ljk/getM

https://api.telegram.org/bot7204924753:AAFaqmmBR9ybp4-iE8BA2YCiFNUbOEd0Ljk/sendMessage?chat_id=8169552647

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Detect Xworm Payload 6 IoCs
  • Gurcu family
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Async RAT payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 7 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Drops startup file 8 IoCs
  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 30 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5032
    • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1896
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2876
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1604
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2552
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3156
    • C:\Users\Admin\AppData\Local\Temp\msedge.exe
      "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1224
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2028
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3140
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3020
    • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
      2⤵
      • Executes dropped EXE
      PID:2480
    • C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe
      "C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe"
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2456
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3356
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2476
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging
        3⤵
        • Uses browser remote debugging
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8372ccc40,0x7ff8372ccc4c,0x7ff8372ccc58
          4⤵
            PID:3144
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-logging --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --disable-logging --field-trial-handle=1796,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1792 /prefetch:2
            4⤵
              PID:4404
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=1852,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2016 /prefetch:3
              4⤵
                PID:4492
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=2084,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2256 /prefetch:8
                4⤵
                  PID:3332
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2900,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2972 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:3096
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2908,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2996 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:2844
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4300,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4308 /prefetch:1
                  4⤵
                  • Uses browser remote debugging
                  PID:2368
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4588,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4640 /prefetch:8
                  4⤵
                    PID:1704
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4680,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:8
                    4⤵
                      PID:1100
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4688,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:8
                      4⤵
                        PID:4192
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4956,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4932 /prefetch:8
                        4⤵
                          PID:4668
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=4700,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:8
                          4⤵
                            PID:5036
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --disable-logging --field-trial-handle=5220,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:8
                            4⤵
                              PID:1276
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --no-appcompat-clear --disable-logging --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5176,i,18258856466642831120,5324209343770627338,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:2
                              4⤵
                              • Uses browser remote debugging
                              PID:3528
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                            3⤵
                            • System Network Configuration Discovery: Wi-Fi Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3592
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              4⤵
                                PID:4112
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profile
                                4⤵
                                • Event Triggered Execution: Netsh Helper DLL
                                • System Network Configuration Discovery: Wi-Fi Discovery
                                PID:4800
                              • C:\Windows\system32\findstr.exe
                                findstr All
                                4⤵
                                  PID:4684
                              • C:\Windows\SYSTEM32\cmd.exe
                                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                3⤵
                                  PID:4924
                                  • C:\Windows\system32\chcp.com
                                    chcp 65001
                                    4⤵
                                      PID:5092
                                    • C:\Windows\system32\netsh.exe
                                      netsh wlan show networks mode=bssid
                                      4⤵
                                      • Event Triggered Execution: Netsh Helper DLL
                                      PID:2016
                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:1196
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging
                                    3⤵
                                    • Uses browser remote debugging
                                    PID:1104
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff836fc3cb8,0x7ff836fc3cc8,0x7ff836fc3cd8
                                      4⤵
                                        PID:1748
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1436,8035204762878841070,6935877794601711817,131072 --disable-logging --headless=new --headless --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --disable-logging --mojo-platform-channel-handle=1444 /prefetch:2
                                        4⤵
                                          PID:1148
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1436,8035204762878841070,6935877794601711817,131072 --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --disable-logging --mojo-platform-channel-handle=1560 /prefetch:3
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3152
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-logging --remote-debugging-port=9222 --allow-pre-commit-input --field-trial-handle=1436,8035204762878841070,6935877794601711817,131072 --disable-gpu-compositing --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1980 /prefetch:1
                                          4⤵
                                          • Uses browser remote debugging
                                          PID:8
                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        PID:2496
                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        PID:4480
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9e7e54d2-20f4-4079-a872-0b2c40b27650.bat"
                                        3⤵
                                          PID:4900
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            4⤵
                                              PID:3080
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /PID 2456
                                              4⤵
                                              • Kills process with taskkill
                                              PID:2404
                                            • C:\Windows\system32\timeout.exe
                                              timeout /T 2 /NOBREAK
                                              4⤵
                                              • Delays execution with timeout.exe
                                              PID:1360
                                      • C:\Windows\system32\taskmgr.exe
                                        "C:\Windows\system32\taskmgr.exe" /0
                                        1⤵
                                        • Checks SCSI registry key(s)
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:4964
                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                        1⤵
                                          PID:4544
                                        • C:\Windows\system32\msiexec.exe
                                          C:\Windows\system32\msiexec.exe /V
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2512
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                          1⤵
                                            PID:4820
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:4776
                                            • C:\Users\Admin\AppData\Roaming\XClient.exe
                                              C:\Users\Admin\AppData\Roaming\XClient.exe
                                              1⤵
                                              • Drops startup file
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              PID:4232
                                              • C:\Windows\System32\schtasks.exe
                                                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
                                                2⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1212
                                            • C:\ProgramData\OneDrive.exe
                                              C:\ProgramData\OneDrive.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:1580
                                            • C:\Users\Admin\AppData\Local\msedge.exe
                                              C:\Users\Admin\AppData\Local\msedge.exe
                                              1⤵
                                              • Drops startup file
                                              • Executes dropped EXE
                                              PID:3324
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
                                                2⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:2184
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
                                                2⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:4568
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
                                                2⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:72
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
                                                2⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:1536
                                              • C:\Windows\System32\schtasks.exe
                                                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
                                                2⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:3924

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                              Filesize

                                              649B

                                              MD5

                                              364004b96450b2e0e8af314c416efc2c

                                              SHA1

                                              3f69a4512acb9f69f3d8420cf92dd13e39903f7b

                                              SHA256

                                              e934fa0106d3b10512dbc0a1626b4dd5f34036b77512fa2a8eb3432b8e09012b

                                              SHA512

                                              b878b81de88f40af89d16d8c6b350e0691a1f93ed99cb41300c9b273c4d9604b949ac04fd84f6e6011073313283f84d990ae901eb6faac637ae65d11ad890955

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

                                              Filesize

                                              851B

                                              MD5

                                              07ffbe5f24ca348723ff8c6c488abfb8

                                              SHA1

                                              6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                              SHA256

                                              6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                              SHA512

                                              7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

                                              Filesize

                                              854B

                                              MD5

                                              4ec1df2da46182103d2ffc3b92d20ca5

                                              SHA1

                                              fb9d1ba3710cf31a87165317c6edc110e98994ce

                                              SHA256

                                              6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                              SHA512

                                              939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                              Filesize

                                              2B

                                              MD5

                                              d751713988987e9331980363e24189ce

                                              SHA1

                                              97d170e1550eee4afc0af065b78cda302a97674c

                                              SHA256

                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                              SHA512

                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                              Filesize

                                              2KB

                                              MD5

                                              627073ee3ca9676911bee35548eff2b8

                                              SHA1

                                              4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                              SHA256

                                              85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                              SHA512

                                              3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              8694eaa77a5b3f1984349acc496ab43e

                                              SHA1

                                              31b20a025ea7e019959c351d4636af1c1f54e801

                                              SHA256

                                              cccec2467e6b8f42624c2bdea449448dc4c07ccf506b0b3349c342c6f7665310

                                              SHA512

                                              08ef9e6775ddf401505cf7fcb0691b7ec87efd66aafa1c6c8c98a2d091cfb5872fb6fbef457f7c080ba3e641fd9c8bc5c306ccebf2542859ad5401ffe53c1a73

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              80707036df540b6657f9d443b449e3c3

                                              SHA1

                                              b3e7d5d97274942164bf93c8c4b8a9b68713f46f

                                              SHA256

                                              6651e5f976619cef991deef61776cf43d4c4b3d7c551dd2192b647df71586ab0

                                              SHA512

                                              65e41e9e730fed4f7a7d3f6f35875a16948b897f87c8c70b371fd0ac7f0951814f6a75e7698665194bbc65a3665a684e7be229e7e24193b50483ae7e55eebf4f

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              4093e5ab3812960039eba1a814c2ffb0

                                              SHA1

                                              b5e4a98a80be72fccd3cc910e93113d2febef298

                                              SHA256

                                              c0794e2b7036ce5612446a8b15e0c8387773bbc921f63cf8849f8a1f4ef3878c

                                              SHA512

                                              f3555b45aa1a1dd5214716dc81a05905c4ecd5a3e1276d35e08c65623ab1d14d469b3b576a5d9638264c1222d73889d2cc1ee43fb579d9ca3fcddd9f557cac7b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              c24caab1947646fcc49d6158d78a56f5

                                              SHA1

                                              aa2cd00401eb273991f2d6fdc739d473ff6e8319

                                              SHA256

                                              0696315ad3df3edd5426276c265bd13d8bd2a0d101548bcaedd82e2aebde655a

                                              SHA512

                                              35e1d214dfb4c7f078496e3e303aea152aa48f9db5b9aa188aeb82b541582ed77f60bfe8712836232b5aa31d3645edfc79b42c8f90e92e06778f21aa44971bff

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              69416944dac24129d0969e2ac46f0533

                                              SHA1

                                              d71969659956b32411e0606a9bee640a0b108ef4

                                              SHA256

                                              dffc7e01106427982d7cafd3d7e3be37e16b098fbb0958410ea8d7c68bfb97ca

                                              SHA512

                                              aabb330053579af0d9de2661bd70eaadfd2e2e617759bc9c380db1c64731c6711304e49882138e9d337815377ee012a7458f91f692cb31538d73624385867f4c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              0b59f3fa12628f63b5713c4833570d7f

                                              SHA1

                                              badcf18f1fdc94b1eadf63f27c09ad092c4a6ccb

                                              SHA256

                                              2332e52881483559d787508831c00192c4f0a4fedc232b0309e566a30247af1d

                                              SHA512

                                              01724fd9f7a20ec5ff3d2686593d5d95069135834e9b156ced36985067fb36e7b3ec2a0018e41fa125ad5d1e42c80be9e148632a9b655f2d41c1400a4320abe7

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              2700ec89fc3e1dfe572f0680c27c0140

                                              SHA1

                                              f79c58bb3dc78d63d6c8879e436e84d82ad9d066

                                              SHA256

                                              bd25b0ad5116bf30b9dca67a34ec42e5668ab2288317625c56db9c1fcaef1891

                                              SHA512

                                              1bfcc2fcba39bdaf1588a60c71cf450e07b8f70b983218028ae3ba6f31179f4c2578b806510b51d49ea354977bb8483d43889083e3c049c9093f695d541507a5

                                            • C:\Users\Admin\AppData\Local\Temp\9e7e54d2-20f4-4079-a872-0b2c40b27650.bat

                                              Filesize

                                              152B

                                              MD5

                                              f7e8333c0ce8232735b7ce62705e8459

                                              SHA1

                                              5b4aae82cecf0af1aa26f5d9a9fdcdad5b84f829

                                              SHA256

                                              55fd0e186f7ddf2417eeab4646092bdaf09b7a1a66183b0e9db61542338d1a7c

                                              SHA512

                                              b827ecd19d52b36f1b46406b30f7c6733b1e84ab2c421eb32e9961d864f32a72f7c5887f8ac2da4e44a12a5de6bd4970080a67ea9fae5eb4b107c928631aa2a0

                                            • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe

                                              Filesize

                                              153KB

                                              MD5

                                              8b8585c779df2f6df99f749d3b07f146

                                              SHA1

                                              b553267f8e6f2bb6531ca2cb330e0d6b7bc41a1d

                                              SHA256

                                              4a9d13e9b68d26c6feb71856b7a61a2a1b8f2dc1c7aaa9ad5dfd5609b5a2da6c

                                              SHA512

                                              b89cae4386d0b8173b87533b5af3d863a188836185d105d6007786ba0e415537e84b759b8c22b37430ee544c554db9f50aa21466c5549c8b80c4f5a3fa6cb5c7

                                            • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe

                                              Filesize

                                              140KB

                                              MD5

                                              a1cd6f4a3a37ed83515aa4752f98eb1d

                                              SHA1

                                              7f787c8d72787d8d130b4788b006b799167d1802

                                              SHA256

                                              5cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65

                                              SHA512

                                              9489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355

                                            • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe

                                              Filesize

                                              14.9MB

                                              MD5

                                              56ccb739926a725e78a7acf9af52c4bb

                                              SHA1

                                              5b01b90137871c3c8f0d04f510c4d56b23932cbc

                                              SHA256

                                              90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

                                              SHA512

                                              2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aj2nyep3.qdp.ps1

                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Users\Admin\AppData\Local\Temp\msedge.exe

                                              Filesize

                                              166KB

                                              MD5

                                              aee20d80f94ae0885bb2cabadb78efc9

                                              SHA1

                                              1e82eba032fcb0b89e1fdf937a79133a5057d0a1

                                              SHA256

                                              498eb55b3fb4c4859ee763a721870bb60ecd57e99f66023b69d8a258efa3af7d

                                              SHA512

                                              3a05ff32b9aa79092578c09dfe67eaca23c6fe8383111dab05117f39d91f27670029f39482827d191bd6a652483202b8fc1813f8d5a0f3f73fd35ca37a4f6d42

                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir1260_900248334\312d81b7-5c16-4d61-bc75-70fa53f6ce3d.tmp

                                              Filesize

                                              150KB

                                              MD5

                                              14937b985303ecce4196154a24fc369a

                                              SHA1

                                              ecfe89e11a8d08ce0c8745ff5735d5edad683730

                                              SHA256

                                              71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

                                              SHA512

                                              1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir1260_900248334\CRX_INSTALL\_locales\en\messages.json

                                              Filesize

                                              711B

                                              MD5

                                              558659936250e03cc14b60ebf648aa09

                                              SHA1

                                              32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                              SHA256

                                              2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                              SHA512

                                              1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                            • C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe

                                              Filesize

                                              6.1MB

                                              MD5

                                              b3899dd5602b3587ee487ba34d7cfd47

                                              SHA1

                                              ace70e4fcea9b819eaf5bda4453866698252357f

                                              SHA256

                                              28c53ad86d705da7e21a1c0cbc996e15ab8f024368aa031b025d05f3dfdbeb2e

                                              SHA512

                                              104b8252db4e9a88e388370a6def71e0cbb536604d5a41ac60169a35a9662980d1359000d5ea316f29deb4c534678e86e266bba12bb0b658f2666d13b26c200a

                                            • C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Apps.txt

                                              Filesize

                                              6KB

                                              MD5

                                              b89abafc473a70a8dd78519dc600b9c5

                                              SHA1

                                              8a053aa1d7e1c19a5884c644e8361b97e35505c6

                                              SHA256

                                              dad304197953ccaaa0a61199755fcee58b205cb3ee1ac1215e07c9404e872211

                                              SHA512

                                              e6ddbedef6ba906c1fc608c51983ac728570b271a91b8f00718877e6913da4c5fb1c85a473ff7b241c1caa63052b58b7eab7f21b6ceb3a2609d624ee76c588c8

                                            • C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt

                                              Filesize

                                              327B

                                              MD5

                                              10651b85ce8387d1ff0f2ead7ba07ced

                                              SHA1

                                              90f3dfb6cbb78a84e64621490c54f0b4cba69f1a

                                              SHA256

                                              14170817d491e39fb55fc225eb2d0f3ab86b1741578cccb0478e2605df89d629

                                              SHA512

                                              aa7573bb5bd86bbd027f1e60030e61250cb29b95802cb4732f9986c96b2b8a2b232e9957b04a667b6524ad0469f0713c3d2c481ed49d42f06f27b0efbffebab3

                                            • C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt

                                              Filesize

                                              2KB

                                              MD5

                                              08ce1b9437c9b42839c4a954e7870f69

                                              SHA1

                                              c8d5d692c2832f7fb201057d62405f7f3c10074b

                                              SHA256

                                              b10e4b97dcff729a430b5c2db336c8586c28ce065d90552a8f081083d95edea2

                                              SHA512

                                              0fb5587f3335d606e869e795037c46767e27a64ef4b5a8357f6b5c3f123494bac94b52ad4dbd97a24e469af60e8b81fd83749085d796d3c59f41bdb31f3d036e

                                            • C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt

                                              Filesize

                                              3KB

                                              MD5

                                              d10c0d7e773c68d41b20600ca4af647f

                                              SHA1

                                              9eba7ee8b5c4176e0343cb84d569da1393a1fa86

                                              SHA256

                                              5ceb2497a6e3d7abad40171887bf40d7208626cf10d1aa7fb89bdc20918442cd

                                              SHA512

                                              53856a13e8c6db8a1b7c1a5bfe67f35adda8d8b2f19f66396200b2fd2eb8129f31a4a35b6441e7b8fbd91d50a1fe86b6766c3b0f1f73c85936a3fb3f93277878

                                            • C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt

                                              Filesize

                                              3KB

                                              MD5

                                              a7e1766e129fe3f31613d6f8c2fa034a

                                              SHA1

                                              45b6244412dacbc0e4265989dfb0d84fcf5fb9f8

                                              SHA256

                                              f13af5caa4a03a32affdb6402f22f660d0e02fb87ec6feb23e0526a389c7360b

                                              SHA512

                                              fcc8373e38a88bf3df212bc14c6ebcfbc78002518f5e2db995e60bd6ce4e4e421bb43097a35be7083de759b489ca6c9e00a59887057d7dcb913e7ef5f867f5ed

                                            • C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\Admin@DPGNQMQQ_en-US\System\Process.txt

                                              Filesize

                                              4KB

                                              MD5

                                              b6cef5fa3efed86444327046fa02479b

                                              SHA1

                                              0646cc2cdf24f45675cfe84e5115013e7b89d0be

                                              SHA256

                                              4dcb738f8c91c2f22eef7d99d2bcda880b486e41e21e4332168d217252a79207

                                              SHA512

                                              53b9a8fa831c29e810108b8d2ae65fe0074030cacadf8c33e0b9582bde416827090150fbf95f6eebfec95cf3a9720e4c036835d29c3ea487dc426fa37210ba14

                                            • C:\Users\Admin\AppData\Local\aa2986235291ef78ed283e1ee0e32271\msgid.dat

                                              Filesize

                                              3B

                                              MD5

                                              6855456e2fe46a9d49d3d3af4f57443d

                                              SHA1

                                              9c882d5c6a1aa240b2672dce0ffb03360abcaca5

                                              SHA256

                                              eaa0689a095d4394a05fb51b84b0175a47f68221261377e4829444cbfcae23ca

                                              SHA512

                                              ec2da5ac90ee2e805e74c45a60fe8b81b96c750b1f7c53e78271c33a89f789b2a9ed9708a99364c3f1027015994b6f71acdb5e1abd2029ad3cbd28d5a2e412c9

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk

                                              Filesize

                                              677B

                                              MD5

                                              b2031a911c1588c63d56540e06770d22

                                              SHA1

                                              5f1ae01dce2ec4d32ff6f239552a6652193011e3

                                              SHA256

                                              a19adb62612ede1f2805d3fbfcc9c1a5b34b495745e2ba758333e42d2deaf166

                                              SHA512

                                              886a7766305f1cca171bd702b98a282a62bacb3637e250d03f81a145eff89fcb57d58dd93244cc0ffcb8b749110b3712bc7e2d7a4ba2184f6d31e3706a154eeb

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

                                              Filesize

                                              771B

                                              MD5

                                              4d6d8f1dd4a3a1c9e732180711830b2b

                                              SHA1

                                              344d0594968ae499218261c0a2cd45a55c4455fa

                                              SHA256

                                              6001af312f1f128b14bca6c2a984805807925f7046c8ce56d24d5dc637fa4f57

                                              SHA512

                                              e8d8984677ae26b15bdf52b81f4d45ef7c830598662b1b942c40d15894134cdb81ad6e7a8a4ed18173fe4cca6d009ec25ce486806c13dcae15697be85862031a

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk

                                              Filesize

                                              961B

                                              MD5

                                              d1cd2da3ca6b7c99082962d91c751016

                                              SHA1

                                              841107f8ecc75e4d51014c6fcc2e06737ba68574

                                              SHA256

                                              4daba78d59f2b0bd4f5c21dbfdcc2d87c1b8b5565d2fba2f46ccc7102f1a89c6

                                              SHA512

                                              5598bd61579ce53052a29ae72a55b6cdccbff8b175840f9dc3051fbc26dd63af703ebfaed7ab4219129692a0f2c8a4fb6d037cd6b32e7cf2ac65926747fef709

                                            • C:\Users\Admin\AppData\Roaming\svchost.exe

                                              Filesize

                                              63KB

                                              MD5

                                              67ca41c73d556cc4cfc67fc5b425bbbd

                                              SHA1

                                              ada7f812cd581c493630eca83bf38c0f8b32b186

                                              SHA256

                                              23d2e491a8c7f2f7f344764e6879d9566c9a3e55a3788038e48b346c068dde5b

                                              SHA512

                                              0dceb6468147cd2497adf31843389a78460ed5abe2c5a13488fc55a2d202ee6ce0271821d3cf12bc1f09a4d6b79a737ea3bccfc2bb87f89b3fff6410fa85ec02

                                            • memory/1896-73-0x00000201E45C0000-0x00000201E45E2000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/2456-199-0x000001B8266A0000-0x000001B826752000-memory.dmp

                                              Filesize

                                              712KB

                                            • memory/2456-957-0x000001B827680000-0x000001B827720000-memory.dmp

                                              Filesize

                                              640KB

                                            • memory/2456-64-0x000001B80B510000-0x000001B80BB26000-memory.dmp

                                              Filesize

                                              6.1MB

                                            • memory/2456-836-0x000001B826750000-0x000001B826794000-memory.dmp

                                              Filesize

                                              272KB

                                            • memory/2456-837-0x000001B827560000-0x000001B82757A000-memory.dmp

                                              Filesize

                                              104KB

                                            • memory/2480-54-0x000001D81F230000-0x000001D820118000-memory.dmp

                                              Filesize

                                              14.9MB

                                            • memory/2604-0-0x00007FF839FF3000-0x00007FF839FF5000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/2604-1-0x0000000000360000-0x00000000018F4000-memory.dmp

                                              Filesize

                                              21.6MB

                                            • memory/3356-162-0x00000000004A0000-0x00000000004B6000-memory.dmp

                                              Filesize

                                              88KB

                                            • memory/4352-37-0x00000000001D0000-0x00000000001FE000-memory.dmp

                                              Filesize

                                              184KB

                                            • memory/4456-39-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4456-36-0x00000000006A0000-0x00000000006C8000-memory.dmp

                                              Filesize

                                              160KB

                                            • memory/4456-172-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4964-316-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-323-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-325-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-326-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-327-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-318-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-322-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-328-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-324-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4964-317-0x000001C4241E0000-0x000001C4241E1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4996-32-0x0000000000510000-0x000000000053C000-memory.dmp

                                              Filesize

                                              176KB

                                            • memory/4996-38-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4996-171-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

                                              Filesize

                                              10.8MB

                                            • memory/4996-222-0x00007FF839FF0000-0x00007FF83AAB2000-memory.dmp

                                              Filesize

                                              10.8MB