stealerium | 0712085082841796a11be3e988c1cc131d1608809321683d4e4482363f616e0d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29-01-2025 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm V6.0.exe
Size

21.6MB
MD5

ba23d65ef70b05cd3b04dfcbbd801059
SHA1

5c241dc3d79f61bdf82d091bfe29bca2e641d802
SHA256

0712085082841796a11be3e988c1cc131d1608809321683d4e4482363f616e0d
SHA512

d32a4838ca544b9b4764bb99b716faf797aa194199151426a8848c1ed27b5f2428629324d30f15db138ff56d34d46233e3ef106ad416eff29de43eb8ade0eff9
SSDEEP

393216:6JSgxj4gebngiHe2bD616QWBbdw6s8qaPNL1Zjo7YOiFSbzPQWrGMYV3j+cintc:4agiHe2n61Ub1fqY1Z8WSPFrlNHnt

Score

10^/10

stealerium xworm execution persistence rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

jrutcxTxqD08SKSB

Attributes

Install_directory
%ProgramData%
install_file
OneDrive.exe
pastebin_url
https://pastebin.com/raw/RPPi3ByL

aes.plain

Extracted

Family

stealerium

https://api.telegram.org/bot7204924753:AAFaqmmBR9ybp4-iE8BA2YCiFNUbOEd0Ljk/sendMessage?chat_id=

Attributes

email
[email protected]
url
https://szurubooru.zulipchat.com/api/v1/messages

Signatures

Detect Xworm Payload 6 IoCs

resource	yara_rule
behavioral1/files/0x001c00000002aae5-6.dat	family_xworm
behavioral1/files/0x001a00000002ab4c-25.dat	family_xworm
behavioral1/files/0x001900000002ab4f-28.dat	family_xworm
behavioral1/memory/2892-33-0x0000000000380000-0x00000000003AC000-memory.dmp	family_xworm
behavioral1/memory/3352-35-0x00000000003A0000-0x00000000003C8000-memory.dmp	family_xworm
behavioral1/memory/1504-37-0x0000000000340000-0x000000000036E000-memory.dmp	family_xworm

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3888	powershell.exe
236	powershell.exe
5032	powershell.exe
1596	powershell.exe
4984	powershell.exe
3164	powershell.exe
4656	powershell.exe
1756	powershell.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Chrome Update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Chrome Update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe

Executes dropped EXE 11 IoCs

pid	Process
2892	Chrome Update.exe
3352	OneDrive.exe
1504	msedge.exe
1616	Xworm V5.6.exe
3564	update.dotnet.exe
2396	XClient.exe
4032	msedge.exe
4848	OneDrive.exe
552	XClient.exe
2248	msedge.exe
4928	OneDrive.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	Chrome Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\ProgramData\\OneDrive.exe"	OneDrive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
20	pastebin.com
36	pastebin.com
69	pastebin.com
95	pastebin.com
74	pastebin.com
109	pastebin.com
112	pastebin.com
139	pastebin.com
44	pastebin.com
100	pastebin.com
47	pastebin.com
72	pastebin.com
78	pastebin.com
88	pastebin.com
18	pastebin.com
31	pastebin.com
103	pastebin.com
138	pastebin.com
6	pastebin.com
32	pastebin.com
71	pastebin.com
39	pastebin.com
48	pastebin.com
63	pastebin.com
118	pastebin.com
14	pastebin.com
116	pastebin.com
127	pastebin.com
132	pastebin.com
12	pastebin.com
26	pastebin.com
29	pastebin.com
60	pastebin.com
76	pastebin.com
83	pastebin.com
105	pastebin.com
99	pastebin.com
17	pastebin.com
21	pastebin.com
30	pastebin.com
33	pastebin.com
46	pastebin.com
73	pastebin.com
98	pastebin.com
108	pastebin.com
124	pastebin.com
125	pastebin.com
133	pastebin.com
2	raw.githubusercontent.com
34	pastebin.com
80	pastebin.com
38	pastebin.com
121	pastebin.com
129	pastebin.com
10	pastebin.com
35	pastebin.com
94	pastebin.com
113	pastebin.com
9	pastebin.com
37	pastebin.com
77	pastebin.com
84	pastebin.com
91	pastebin.com
93	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
656	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4896	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2600	schtasks.exe
332	schtasks.exe
3144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3888	powershell.exe
236	powershell.exe
3888	powershell.exe
236	powershell.exe
5032	powershell.exe
1596	powershell.exe
5032	powershell.exe
1596	powershell.exe
4984	powershell.exe
3164	powershell.exe
4984	powershell.exe
3164	powershell.exe
4656	powershell.exe
1756	powershell.exe
4656	powershell.exe
1756	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	Chrome Update.exe
Token: SeDebugPrivilege	3352	OneDrive.exe
Token: SeDebugPrivilege	1504	msedge.exe
Token: SeDebugPrivilege	3564	update.dotnet.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	4896	taskkill.exe
Token: SeDebugPrivilege	2396	XClient.exe
Token: SeDebugPrivilege	4032	msedge.exe
Token: SeDebugPrivilege	4848	OneDrive.exe
Token: SeDebugPrivilege	552	XClient.exe
Token: SeDebugPrivilege	2248	msedge.exe
Token: SeDebugPrivilege	4928	OneDrive.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 2892	3876	XWorm V6.0.exe	78
PID 3876 wrote to memory of 2892	3876	XWorm V6.0.exe	78
PID 3876 wrote to memory of 3352	3876	XWorm V6.0.exe	79
PID 3876 wrote to memory of 3352	3876	XWorm V6.0.exe	79
PID 3876 wrote to memory of 1504	3876	XWorm V6.0.exe	80
PID 3876 wrote to memory of 1504	3876	XWorm V6.0.exe	80
PID 3876 wrote to memory of 1616	3876	XWorm V6.0.exe	81
PID 3876 wrote to memory of 1616	3876	XWorm V6.0.exe	81
PID 3876 wrote to memory of 3564	3876	XWorm V6.0.exe	82
PID 3876 wrote to memory of 3564	3876	XWorm V6.0.exe	82
PID 3352 wrote to memory of 3888	3352	OneDrive.exe	84
PID 3352 wrote to memory of 3888	3352	OneDrive.exe	84
PID 1504 wrote to memory of 236	1504	msedge.exe	86
PID 1504 wrote to memory of 236	1504	msedge.exe	86
PID 3352 wrote to memory of 5032	3352	OneDrive.exe	88
PID 3352 wrote to memory of 5032	3352	OneDrive.exe	88
PID 1504 wrote to memory of 1596	1504	msedge.exe	89
PID 1504 wrote to memory of 1596	1504	msedge.exe	89
PID 1504 wrote to memory of 4984	1504	msedge.exe	92
PID 1504 wrote to memory of 4984	1504	msedge.exe	92
PID 3352 wrote to memory of 3164	3352	OneDrive.exe	93
PID 3352 wrote to memory of 3164	3352	OneDrive.exe	93
PID 2892 wrote to memory of 2600	2892	Chrome Update.exe	96
PID 2892 wrote to memory of 2600	2892	Chrome Update.exe	96
PID 1504 wrote to memory of 4656	1504	msedge.exe	98
PID 1504 wrote to memory of 4656	1504	msedge.exe	98
PID 3352 wrote to memory of 1756	3352	OneDrive.exe	100
PID 3352 wrote to memory of 1756	3352	OneDrive.exe	100
PID 1504 wrote to memory of 332	1504	msedge.exe	102
PID 1504 wrote to memory of 332	1504	msedge.exe	102
PID 3352 wrote to memory of 3144	3352	OneDrive.exe	104
PID 3352 wrote to memory of 3144	3352	OneDrive.exe	104
PID 3564 wrote to memory of 1488	3564	update.dotnet.exe	109
PID 3564 wrote to memory of 1488	3564	update.dotnet.exe	109
PID 1488 wrote to memory of 408	1488	cmd.exe	111
PID 1488 wrote to memory of 408	1488	cmd.exe	111
PID 1488 wrote to memory of 4896	1488	cmd.exe	112
PID 1488 wrote to memory of 4896	1488	cmd.exe	112
PID 1488 wrote to memory of 656	1488	cmd.exe	113
PID 1488 wrote to memory of 656	1488	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3144
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:332
- C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe
  "C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\91a94f6c-a7f4-4750-8b53-94f3f8d464c8.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:408
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3564
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4896
  - - C:\Windows\system32\timeout.exe
      timeout /T 2 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:656

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Users\Admin\AppData\Local\msedge.exe
C:\Users\Admin\AppData\Local\msedge.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\ProgramData\OneDrive.exe
C:\ProgramData\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Users\Admin\AppData\Local\msedge.exe
C:\Users\Admin\AppData\Local\msedge.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\ProgramData\OneDrive.exe
C:\ProgramData\OneDrive.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
51e109000a944a6ba1e7cd2e6c20520f

SHA1
139cd9abfc3337f90ad901062e8708722477ed82

SHA256
761050c186becf6ea7a2cf2373325f4c9844918b2dbe13de6b4d49106bd6fd3e

SHA512
643d7bef8e860690807b69b7d6b71e80d1fcd7de500364b92a0104d47f3052a56bc2fe00533266df487ef8b32126316fb950990291041938c1b46817dc5d6ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
91901fb6ac91a5ef3ab341c6be3eaeb7

SHA1
f07a06bd9d24fbdfdec074d837bd4b1e48d25ca0

SHA256
ab13c9ccbe0cac61dba0c72aed9c4e8662b1dc87bedc6b5766d6f409b12b3670

SHA512
b219c1c3d3109a29c2ebeee90a5d8318aa409330815b81353ff30548cc56451aa66323a8026eb079e3c0d7005ac742ba4699a17da64bedcbf96c2207c5885129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6a6577b77e02f4b8333d8530dc424c19

SHA1
bbf9460172e16d4d31871f343d77fa38b037a8b3

SHA256
0c14ec1a0dbb1d1c0865896cf1f0358633dfe37216078cc3a58921783d08383d

SHA512
c59a2ed01f2aa61b77354139ffd631c75903aafa906636fe0d2ba7fd9aee5fcc9296b93ae6b33f02a6c01ca767fbed11f76a9cca3003bd7d674f6f8b51e8b31e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Temp\91a94f6c-a7f4-4750-8b53-94f3f8d464c8.bat

Filesize
152B

MD5
a948a242e05206afebfd81b3f626b8f0

SHA1
196d4bca66b67954043824e8e1c8d54f4710f962

SHA256
b90204adb65cde11766b37ce7a4037e981e2546a28230117138f80a443078938

SHA512
eeeb8a80e9dabd371a08d817c838b9f8064079bb75370426a4a512402f0e9399b281e482b23bdf6e67a2aaff8ce13319b060083448605356deb59c468a0308e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe

Filesize
153KB

MD5
8b8585c779df2f6df99f749d3b07f146

SHA1
b553267f8e6f2bb6531ca2cb330e0d6b7bc41a1d

SHA256
4a9d13e9b68d26c6feb71856b7a61a2a1b8f2dc1c7aaa9ad5dfd5609b5a2da6c

SHA512
b89cae4386d0b8173b87533b5af3d863a188836185d105d6007786ba0e415537e84b759b8c22b37430ee544c554db9f50aa21466c5549c8b80c4f5a3fa6cb5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneDrive.exe

Filesize
140KB

MD5
a1cd6f4a3a37ed83515aa4752f98eb1d

SHA1
7f787c8d72787d8d130b4788b006b799167d1802

SHA256
5cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65

SHA512
9489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_du3hshd2.h20.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge.exe

Filesize
166KB

MD5
aee20d80f94ae0885bb2cabadb78efc9

SHA1
1e82eba032fcb0b89e1fdf937a79133a5057d0a1

SHA256
498eb55b3fb4c4859ee763a721870bb60ecd57e99f66023b69d8a258efa3af7d

SHA512
3a05ff32b9aa79092578c09dfe67eaca23c6fe8383111dab05117f39d91f27670029f39482827d191bd6a652483202b8fc1813f8d5a0f3f73fd35ca37a4f6d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe

Filesize
6.1MB

MD5
b3899dd5602b3587ee487ba34d7cfd47

SHA1
ace70e4fcea9b819eaf5bda4453866698252357f

SHA256
28c53ad86d705da7e21a1c0cbc996e15ab8f024368aa031b025d05f3dfdbeb2e

SHA512
104b8252db4e9a88e388370a6def71e0cbb536604d5a41ac60169a35a9662980d1359000d5ea316f29deb4c534678e86e266bba12bb0b658f2666d13b26c200a

Download Submit
memory/1504-37-0x0000000000340000-0x000000000036E000-memory.dmp

Filesize
184KB

Download
memory/1616-51-0x00000216A6E60000-0x00000216A7D48000-memory.dmp

Filesize
14.9MB

Download
memory/2892-38-0x00007FFD24530000-0x00007FFD24FF2000-memory.dmp

Filesize
10.8MB

Download
memory/2892-159-0x00007FFD24530000-0x00007FFD24FF2000-memory.dmp

Filesize
10.8MB

Download
memory/2892-33-0x0000000000380000-0x00000000003AC000-memory.dmp

Filesize
176KB

Download
memory/3352-39-0x00007FFD24530000-0x00007FFD24FF2000-memory.dmp

Filesize
10.8MB

Download
memory/3352-35-0x00000000003A0000-0x00000000003C8000-memory.dmp

Filesize
160KB

Download
memory/3352-160-0x00007FFD24530000-0x00007FFD24FF2000-memory.dmp

Filesize
10.8MB

Download
memory/3564-64-0x00000288ED160000-0x00000288ED776000-memory.dmp

Filesize
6.1MB

Download
memory/3876-0-0x00007FFD24533000-0x00007FFD24535000-memory.dmp

Filesize
8KB

Download
memory/3876-1-0x00000000003B0000-0x0000000001944000-memory.dmp

Filesize
21.6MB

Download
memory/3888-73-0x0000024476700000-0x0000024476722000-memory.dmp

Filesize
136KB

Download