stealerium | 0712085082841796a11be3e988c1cc131d1608809321683d4e4482363f616e0d

Resubmissions

07-02-2025 03:53

250207-efrtqsxpd1 10

07-02-2025 03:51

250207-eerscayrhk 10

07-02-2025 01:20

250207-bqhr2avpck 10

Analysis

max time kernel
31s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm V6.0.exe
Size

21.6MB
MD5

ba23d65ef70b05cd3b04dfcbbd801059
SHA1

5c241dc3d79f61bdf82d091bfe29bca2e641d802
SHA256

0712085082841796a11be3e988c1cc131d1608809321683d4e4482363f616e0d
SHA512

d32a4838ca544b9b4764bb99b716faf797aa194199151426a8848c1ed27b5f2428629324d30f15db138ff56d34d46233e3ef106ad416eff29de43eb8ade0eff9
SSDEEP

393216:6JSgxj4gebngiHe2bD616QWBbdw6s8qaPNL1Zjo7YOiFSbzPQWrGMYV3j+cintc:4agiHe2n61Ub1fqY1Z8WSPFrlNHnt

Score

10^/10

stealerium xworm execution persistence rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

OnCH8EVI1tYADuXo

Attributes

Install_directory
%LocalAppData%
install_file
msedge.exe
pastebin_url
https://pastebin.com/raw/RPPi3ByL
telegram
https://api.telegram.org/bot7483240807:AAEYFrBoMgquxWoikOe9bVlqmoMC2b2AOO4/sendMessage?chat_id=5279018187

aes.plain

Extracted

Family

stealerium

https://api.telegram.org/bot7204924753:AAFaqmmBR9ybp4-iE8BA2YCiFNUbOEd0Ljk/sendMessage?chat_id=

Attributes

email
[email protected]
url
https://szurubooru.zulipchat.com/api/v1/messages

Signatures

Detect Xworm Payload 6 IoCs

resource	yara_rule
behavioral1/files/0x000c000000023b78-6.dat	family_xworm
behavioral1/files/0x000a000000023b81-17.dat	family_xworm
behavioral1/files/0x000a000000023b82-34.dat	family_xworm
behavioral1/memory/4808-36-0x00000000008C0000-0x00000000008E8000-memory.dmp	family_xworm
behavioral1/memory/1932-33-0x00000000008A0000-0x00000000008CC000-memory.dmp	family_xworm
behavioral1/memory/436-38-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_xworm

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2012	powershell.exe
5096	powershell.exe
448	powershell.exe
1124	powershell.exe
2620	powershell.exe
4344	powershell.exe
2924	powershell.exe
2716	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	XWorm V6.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	OneDrive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	Chrome Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	update.dotnet.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	OneDrive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Chrome Update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	Chrome Update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
1932	Chrome Update.exe
4808	OneDrive.exe
436	msedge.exe
4088	Xworm V5.6.exe
2896	update.dotnet.exe
5016	XClient.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	Chrome Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\ProgramData\\OneDrive.exe"	OneDrive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
24	raw.githubusercontent.com
25	pastebin.com
26	pastebin.com
44	pastebin.com
45	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
512	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2984	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2972	schtasks.exe
4012	schtasks.exe
4480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2012	powershell.exe
2012	powershell.exe
2716	powershell.exe
2716	powershell.exe
2012	powershell.exe
2716	powershell.exe
5096	powershell.exe
5096	powershell.exe
448	powershell.exe
448	powershell.exe
448	powershell.exe
5096	powershell.exe
1932	Chrome Update.exe
1932	Chrome Update.exe
1124	powershell.exe
1124	powershell.exe
2620	powershell.exe
2620	powershell.exe
1124	powershell.exe
2620	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
2924	powershell.exe
2924	powershell.exe
2924	powershell.exe
436	msedge.exe
436	msedge.exe
4808	OneDrive.exe
4808	OneDrive.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	Chrome Update.exe
Token: SeDebugPrivilege	4808	OneDrive.exe
Token: SeDebugPrivilege	436	msedge.exe
Token: SeDebugPrivilege	2896	update.dotnet.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	1932	Chrome Update.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	436	msedge.exe
Token: SeDebugPrivilege	4808	OneDrive.exe
Token: SeDebugPrivilege	5016	XClient.exe
Token: SeDebugPrivilege	2984	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1932	Chrome Update.exe
436	msedge.exe
4808	OneDrive.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1932	2648	XWorm V6.0.exe	87
PID 2648 wrote to memory of 1932	2648	XWorm V6.0.exe	87
PID 2648 wrote to memory of 4808	2648	XWorm V6.0.exe	88
PID 2648 wrote to memory of 4808	2648	XWorm V6.0.exe	88
PID 2648 wrote to memory of 436	2648	XWorm V6.0.exe	89
PID 2648 wrote to memory of 436	2648	XWorm V6.0.exe	89
PID 2648 wrote to memory of 4088	2648	XWorm V6.0.exe	90
PID 2648 wrote to memory of 4088	2648	XWorm V6.0.exe	90
PID 2648 wrote to memory of 2896	2648	XWorm V6.0.exe	91
PID 2648 wrote to memory of 2896	2648	XWorm V6.0.exe	91
PID 4808 wrote to memory of 2716	4808	OneDrive.exe	93
PID 4808 wrote to memory of 2716	4808	OneDrive.exe	93
PID 436 wrote to memory of 2012	436	msedge.exe	94
PID 436 wrote to memory of 2012	436	msedge.exe	94
PID 1932 wrote to memory of 4012	1932	Chrome Update.exe	97
PID 1932 wrote to memory of 4012	1932	Chrome Update.exe	97
PID 436 wrote to memory of 448	436	msedge.exe	100
PID 436 wrote to memory of 448	436	msedge.exe	100
PID 4808 wrote to memory of 5096	4808	OneDrive.exe	101
PID 4808 wrote to memory of 5096	4808	OneDrive.exe	101
PID 436 wrote to memory of 1124	436	msedge.exe	104
PID 436 wrote to memory of 1124	436	msedge.exe	104
PID 4808 wrote to memory of 2620	4808	OneDrive.exe	106
PID 4808 wrote to memory of 2620	4808	OneDrive.exe	106
PID 436 wrote to memory of 4344	436	msedge.exe	108
PID 436 wrote to memory of 4344	436	msedge.exe	108
PID 4808 wrote to memory of 2924	4808	OneDrive.exe	110
PID 4808 wrote to memory of 2924	4808	OneDrive.exe	110
PID 436 wrote to memory of 4480	436	msedge.exe	116
PID 436 wrote to memory of 4480	436	msedge.exe	116
PID 4808 wrote to memory of 2972	4808	OneDrive.exe	118
PID 4808 wrote to memory of 2972	4808	OneDrive.exe	118
PID 2896 wrote to memory of 8	2896	update.dotnet.exe	127
PID 2896 wrote to memory of 8	2896	update.dotnet.exe	127
PID 8 wrote to memory of 5060	8	cmd.exe	130
PID 8 wrote to memory of 5060	8	cmd.exe	130
PID 8 wrote to memory of 2984	8	cmd.exe	131
PID 8 wrote to memory of 2984	8	cmd.exe	131
PID 8 wrote to memory of 512	8	cmd.exe	132
PID 8 wrote to memory of 512	8	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V6.0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4012
- C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4480
- C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe
  "C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\81f3bb0e-b800-4fda-9f53-06ae54674b9c.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5060
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2896
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2984
  - - C:\Windows\system32\timeout.exe
      timeout /T 2 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:512

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d079b2f414515e7536eab8def3f59752

SHA1
90cb03125d60dd194a44fe960df655d4a6268d10

SHA256
f21e430cda6fdfc4fa1d51eadaea666e9e6aa92898fda11c9f3d54de02dee94a

SHA512
022c5772b8203082037c7b4c433183f7593f126bc9138f512b5890211953fcd5d995bf05af905d0d597f5f84426dc072fa4964b5b76237856a18dc22bdec9eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\81f3bb0e-b800-4fda-9f53-06ae54674b9c.bat

Filesize
152B

MD5
6cb66a8343164b8ccaf018cf1790d114

SHA1
6350106ecc42bf159ff50fddeaa0671ec6b914c0

SHA256
cc6dbc5a31c5ccba286290364b34413eb96ef1a544a92ba64948172f49c0bd70

SHA512
bf739112016ae4dddc9d38e2f634f66e6f08a204bb87c2a3ddaafcb11048d9920b11e2f1111fd469582a962c5a2555c3ad1617da08d36f3bb99f2923709e1490

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe

Filesize
153KB

MD5
8b8585c779df2f6df99f749d3b07f146

SHA1
b553267f8e6f2bb6531ca2cb330e0d6b7bc41a1d

SHA256
4a9d13e9b68d26c6feb71856b7a61a2a1b8f2dc1c7aaa9ad5dfd5609b5a2da6c

SHA512
b89cae4386d0b8173b87533b5af3d863a188836185d105d6007786ba0e415537e84b759b8c22b37430ee544c554db9f50aa21466c5549c8b80c4f5a3fa6cb5c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneDrive.exe

Filesize
140KB

MD5
a1cd6f4a3a37ed83515aa4752f98eb1d

SHA1
7f787c8d72787d8d130b4788b006b799167d1802

SHA256
5cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65

SHA512
9489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ungoawh.5vl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge.exe

Filesize
166KB

MD5
aee20d80f94ae0885bb2cabadb78efc9

SHA1
1e82eba032fcb0b89e1fdf937a79133a5057d0a1

SHA256
498eb55b3fb4c4859ee763a721870bb60ecd57e99f66023b69d8a258efa3af7d

SHA512
3a05ff32b9aa79092578c09dfe67eaca23c6fe8383111dab05117f39d91f27670029f39482827d191bd6a652483202b8fc1813f8d5a0f3f73fd35ca37a4f6d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\update.dotnet.exe

Filesize
6.1MB

MD5
b3899dd5602b3587ee487ba34d7cfd47

SHA1
ace70e4fcea9b819eaf5bda4453866698252357f

SHA256
28c53ad86d705da7e21a1c0cbc996e15ab8f024368aa031b025d05f3dfdbeb2e

SHA512
104b8252db4e9a88e388370a6def71e0cbb536604d5a41ac60169a35a9662980d1359000d5ea316f29deb4c534678e86e266bba12bb0b658f2666d13b26c200a

Download Submit
memory/436-38-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/1932-37-0x00007FFBBD860000-0x00007FFBBE321000-memory.dmp

Filesize
10.8MB

Download
memory/1932-33-0x00000000008A0000-0x00000000008CC000-memory.dmp

Filesize
176KB

Download
memory/1932-169-0x00007FFBBD860000-0x00007FFBBE321000-memory.dmp

Filesize
10.8MB

Download
memory/2012-75-0x0000016A6D8B0000-0x0000016A6D8D2000-memory.dmp

Filesize
136KB

Download
memory/2648-0-0x00007FFBBD863000-0x00007FFBBD865000-memory.dmp

Filesize
8KB

Download
memory/2648-1-0x0000000000420000-0x00000000019B4000-memory.dmp

Filesize
21.6MB

Download
memory/2896-64-0x0000015834AD0000-0x00000158350E6000-memory.dmp

Filesize
6.1MB

Download
memory/4088-59-0x00000214B1680000-0x00000214B2568000-memory.dmp

Filesize
14.9MB

Download
memory/4808-39-0x00007FFBBD860000-0x00007FFBBE321000-memory.dmp

Filesize
10.8MB

Download
memory/4808-36-0x00000000008C0000-0x00000000008E8000-memory.dmp

Filesize
160KB

Download
memory/4808-173-0x00007FFBBD860000-0x00007FFBBE321000-memory.dmp

Filesize
10.8MB

Download