xworm | 8893d53708ccc4a1aa7a1004b74a0a2b2623c10db4a928d2ab4c2739c7d1bcf2

Analysis

max time kernel
50s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2025, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

66KB
MD5

f9aea3e20a5074a286c6ae5d2aa20399
SHA1

1630133dc54fdf81916aff84431e7a5803a7f7a7
SHA256

8893d53708ccc4a1aa7a1004b74a0a2b2623c10db4a928d2ab4c2739c7d1bcf2
SHA512

a67fcd777e897ec30857e9a0d1e4624cacac5c8a2e276108d7abdbe3bd1f6dfdfd205936ae865ba1e78208640d4883f7136ecf27a55657301bf436ff2e69510e
SSDEEP

1536:ha3VVYfdAQf3wRMztFXb+tJpdq6EEz9fOAxEHj2P:QAfSQ/wyLXbiRfOA6HKP

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:35705

easy-turning.gl.at.ply.gg:35705

Attributes

Install_directory
%AppData%
install_file
Runtime Broker.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2228-1-0x0000000000980000-0x0000000000996000-memory.dmp	family_xworm
behavioral1/files/0x0010000000023bd7-890.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2400	powershell.exe
4612	powershell.exe
2692	powershell.exe
316	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	XClient.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	XClient.exe

Executes dropped EXE 1 IoCs

pid	Process
5848	Runtime Broker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe"	XClient.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4612	powershell.exe
4612	powershell.exe
2692	powershell.exe
2692	powershell.exe
2692	powershell.exe
316	powershell.exe
316	powershell.exe
316	powershell.exe
2228	XClient.exe
4132	msedge.exe
4132	msedge.exe
4108	msedge.exe
4108	msedge.exe
4292	identity_helper.exe
4292	identity_helper.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe
2228	XClient.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	XClient.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	2228	XClient.exe
Token: 33	5540	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5540	AUDIODG.EXE
Token: SeDebugPrivilege	5848	Runtime Broker.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4612	2228	XClient.exe	92
PID 2228 wrote to memory of 4612	2228	XClient.exe	92
PID 2228 wrote to memory of 2692	2228	XClient.exe	97
PID 2228 wrote to memory of 2692	2228	XClient.exe	97
PID 2228 wrote to memory of 316	2228	XClient.exe	100
PID 2228 wrote to memory of 316	2228	XClient.exe	100
PID 2228 wrote to memory of 2400	2228	XClient.exe	102
PID 2228 wrote to memory of 2400	2228	XClient.exe	102
PID 2228 wrote to memory of 2080	2228	XClient.exe	104
PID 2228 wrote to memory of 2080	2228	XClient.exe	104
PID 4108 wrote to memory of 800	4108	msedge.exe	111
PID 4108 wrote to memory of 800	4108	msedge.exe	111
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4064	4108	msedge.exe	112
PID 4108 wrote to memory of 4132	4108	msedge.exe	113
PID 4108 wrote to memory of 4132	4108	msedge.exe	113
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114
PID 4108 wrote to memory of 3120	4108	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Runtime Broker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2400
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd991b46f8,0x7ffd991b4708,0x7ffd991b4718
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9959451494408722986,10610002805650412652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6004

C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93be3a1bf9c257eaf83babf49b0b5e01

SHA1
d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

SHA256
8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

SHA512
885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6738f4e2490ee5070d850bf03bf3efa5

SHA1
fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

SHA256
ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

SHA512
2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
245KB

MD5
b7d654967cd672ef3968a385a9a9c9d3

SHA1
eef9f48614a6dfb818d8551f70855f76e6a609c4

SHA256
05ff1c72d32f61e9536e398a873f1b547adbe91971d2f8514c5071507ff4ff20

SHA512
762045c0a7b92b55ae76e633bfe005cee80384e515c2c5efb2137efc336c5ccfd1eb9620a83752163414c63200c3e9917af08a0139a2620e72e0b9928e72816b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
50KB

MD5
b6b4f10318485b5f3239a4901b72a8ce

SHA1
083e1313f72085cdd678ee5c0aebc2f4f7db166c

SHA256
70e5058973900e00f4a1e1e810703f528ce667bb8084b660218d70e4f791d8c3

SHA512
17836e07bd6ce47dbe0e1f20104acf51b1279a793cdd974b9d8a815902e5122e5dfb3673908b382634e9fdbbbaec9ab246080452e3abcc2b8b72c8591e3ffa64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
644KB

MD5
184b5aedacb7d996828da8b62d5edb97

SHA1
56103f172aec3fac3add449c8b072040fe2da795

SHA256
3e7bdea0cf4a1df2ca48127255dd5ff590972370a1aa5d8ccd763cba0b84ee17

SHA512
39a9e8f4a346c3788d24269156b220900eeb9d6b9168c70f736a1c3aee4c1cb4ad8f7e1e367de4b501a03930c6a87c45c366493e9e6f2a4e9f68b899f6b9ea16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
34KB

MD5
55f3ed1cf8cdc90f3473db2943c69a16

SHA1
c90ed816e9cac5899469d1e91a73388751bab205

SHA256
b1cd402531af27e9df61f25ab7557d9f32c4ba800c8cf941ae01ffd053f4e090

SHA512
b604ce12c77bab0232bae06aecbab138617462c10c3d01a2bb39a947ca3ba39e2b9b7581ae4ca980a7f7bcca14e4a1c74141beed08d16ad9a8f8b87ee35b1f3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
34KB

MD5
529cde777731881b18c42494aa30b722

SHA1
2e2fc882487d542c3716e00afff919e651eb113b

SHA256
22a02b6b744a59d92eb71960424cf54d1db789512293c002204ed164b0f0d0ec

SHA512
41b790c30a1a89d605b0ba2d0762798b46ee5ac3ea607aa25e56e71db98070b354bf583a73175ef70a6fff14c96b60dcdbbb417e49d95a354abd6552e7f63355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
584ab93df149cbec55e26b6934c62091

SHA1
7092907763043b1c046c6b97ed15ba5bb32280d1

SHA256
16db69aa398e50ceeeef32776fc93fdd4b08d159813e023d827815d3aab3aa97

SHA512
fa1aa250486c0d5107ff7ea13c68a1519dcaac595bc239291041444845bd3ef56e95d01ef2cb3ece0e3c324b4356a69243b6077a4b8e51da22992655ba60fa73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6cb2fe5bcd1b951fcb8c284478641742

SHA1
bd1a01ead04da9c2f21648419e28650e46fd0aeb

SHA256
117aa10a06d253b1cab80c9b28c49eb20869e561d30d8f29d8643912226eed17

SHA512
fd8d4b030056431b7021e8573a309979cc11ef5d20803bf78de1ae048c01bba6269d1b958896d6ff733602b2057831fb13207e2f7669e05b7c08b78e00d94c73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa65e27d63009c7bb89e65df30a12823

SHA1
3e366646fc4dd413ca9415a8cee387f2b64d8148

SHA256
a56760e0d96832b45a2a8823051a276ba32b5870a72bbe3bf54e63b1489f588c

SHA512
9c2d88e1d83389f7a8b78e1271a2ae76206875974bacf2ba89c53f08c4eee813d9b396d0436de07beb15c984bcc6bb19857d20343d74f0e467c605a25c948c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a1ada4870c4fea5611d217a53c36f86e

SHA1
004d6c364d4dd8bd1842a298576595218d11c00d

SHA256
0c93334e312e8bb0967996e83d21a412b5b9295abb12c94ec4691c5ba3649f55

SHA512
385c1b7fdce4fe33bfee959b1fb4f7b62ab0d7663121988c2afe5448419b1be25d2b84e215ca4adcf29872143a48ca4d292cb8f3b3bf2aded9b1a695759a226b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0324000e-9b1e-4bb7-9b79-3e54785e3859\index-dir\the-real-index

Filesize
2KB

MD5
5aca815986b9753b35d80cf7a19c6dbe

SHA1
85d28ccd7340bc125f52c6fa2c188a7a35be634f

SHA256
e238455d6f05824d30ebffe2ad6b2e15056ec9ff16c998d205169374ce8e3239

SHA512
8da5889f7904e96382897c926ee3e9e61216b116b235aed5c5df06b2be8203d1119dafde8406fdfc271fd0cf3a8c0cfb6becc32d6ffd6a8565b74f1733d27885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0324000e-9b1e-4bb7-9b79-3e54785e3859\index-dir\the-real-index~RFe5841d6.TMP

Filesize
48B

MD5
b56df487aadb6f6919cabdc91b1a876a

SHA1
b7f51e66f622ee0b752f49c6ca3f2357f3b6dc9c

SHA256
687fc8089e772b9ccf594db5962bdaf68c21052add2ad37a6979c33296540c38

SHA512
cde178b655596688bcf1a8050f638adf45440fa428e673b135188be9182bce9963321a0272f67f6a2edaea4f98e7ac779cde84da0512caba63c6356e725d3a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\491a2f8e-425b-47f2-b063-3a31884741df\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
3d33fc9fdb83f6a1d47b08b16b4e12a2

SHA1
463f0677923c09773585be61b6efdcc8f09f1147

SHA256
5d2ea25c665ee34618ee45990cf437a8401c919b45a386b3b563c199fb0bf90d

SHA512
03041ba80723bad151f50b065c25c871b7e4683f4bc88f74f0df9023a6d98764bed19abc0ea9119140913dbcccadab40b0ca2a7af180cf0ebc8e59c9abf8f5a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
09d0fcc99860866f937babb8012dc21d

SHA1
57331ca8d85d6d9dcc5124101b54caf71c26229d

SHA256
6cf3aacedee1758786b9c427a813c0d93cff075b6078eee8f23860c9b62d2ba1

SHA512
10f92d025ee67dcabb577474f4a2017b0cd14ecce55d6d681e6c5323404b52d4de6f1cb146c753edc10ad30da09ad852ae7bed416e69d66103191bcf81262781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
b0eecedf014b97af8007ee69abf12e0c

SHA1
e03f18661dedbb8510c4f416a856a7f59cc106da

SHA256
8615e3736e0e8489c443a8c3b4ad86a709da0dea33f348a226561b22c532ca77

SHA512
6eb92cd952778965e26eb0aae38df9ac4306240aa5b61bf54552f04a15b537175d5ee3cf69e38a6f389dbda64ee50e6d8f2a2d1e30e6525853218267b8a96713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
ad919ed4c14b35425359983b942bc324

SHA1
999ce8007936194dd169a8ca75c1d00e9a4eb3a4

SHA256
0799619ad1b7d7e8f941e7088428258fee80c9f24c0516fbada3be23c615c9d9

SHA512
0bc5e07d748f18eb88e36d77f564a3309c0f85d886e3d0ebde6e29f50d9a237735932ba53c0c726fd887f8f2d564ce341d24d40158422e241cc65733e528ed42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
407f0d7b930567938e6f90e981fc8d0c

SHA1
17abf52d0c27452a3f6edf04cb92a80211ba7486

SHA256
683380377ce8e582ac0aaa5ca8d8b1f5b95eb4be98dc593e9207daa8e318a248

SHA512
710135c03071674bec9c7cf0f6a1434426085a11ca2c72f83823d84fc618e416890e80b4b9ca463df1b869d9b63fff84a02510ac85d2a6daa089cea424b57b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
ae15366a83030f37e3275cd85ad1447a

SHA1
5c26911cc6fabac792885f8645f30fd6f7b69c56

SHA256
b47a5e6490a81279506aeb15c8e7ec5c9becb5b0a113b4f46645a34c904abc4d

SHA512
48641d372d9330cf16e57ab3293e303ea60de744f3982734f35ca5f0f9904fcc11d34739586c977512a15023d8ca6c669f0568fe5fc14197c4f5731c2c6a518c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
3973479547c720667b43cd23fc9563c6

SHA1
3475dea42c55d35868802e659c1cb188c0cb716b

SHA256
b94845593bcc764f3b8424846834057fe5a3bcad812dd81d9ec753fa4bd1f9ed

SHA512
95b99a7b51c7f8f2484d08bf8995df061499fb460961f4d46223bea051bf14b7ef05887c588ef4dbecc90698de2cd6e5d550aa91233e96d7c222f4d8a65d5159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f2dc17af9cef1086a52ff8a4b81b469d

SHA1
71a23bc1069fff8cb35e42f99eb75ebd78095bf6

SHA256
9428ef9d30e781845ecfbc07be72a0221f021d088e816170f1ed0fd06220f1e0

SHA512
5f5797c57702a7ea6a78cca559798da5e44f1a7f0a2a82067c6e3d5de75733732ad9903c5806327d37d5a70331b8fdaa11a178b4ece64dd922b21ca790163bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587877.TMP

Filesize
1KB

MD5
5410217df4a07719c1cba8be8d3c88ec

SHA1
7df1719b5668cff26f2e4b1c84d4b486758b1f78

SHA256
b6f0843c9354a6b33927f8898a13f5b92d60fa6d40f599df69f88caa9c70879d

SHA512
de6ae0e7b09bd19b90bd929231c5418cb92323a0c4d8160261078ef98c632ef1be56476f83635ef901ef113bf0df9df8cce363a205667d2fcc3bb8200ab9737b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
32d470a305fd58e3209215173e46e8e3

SHA1
f4ceab0e9b6cdc358466dad8c533c337cd9ac770

SHA256
a8b1215188fb9a3f2b05b98d1ed6e61849a99fb1ca11e808c1da5e8d61a3a44f

SHA512
b023a5fcff09eed6af32ed99f843790adb62603338b27983d4f84aa48665fa0f4f9ee289624c1a7f175dbf78d607f7ae4e0636e81a608634dee0e37c2e363201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d65ebc84c6b0b52901fb46f5e2b83ab5

SHA1
d036a0c3eb9e1616d0f7f5ca41171060c13a3095

SHA256
d45581b0807a0d04a70ec75e3e4575e73f148e5b4e0d3d325dfbd6400a4bfbd1

SHA512
88ac232e7702ebd53788cf8429d266ae367111bfccf4bc9d40ead25b552347521458ca60d320e2775b5d2edcaf8501251cb2db68b38dc000ac50463fb80865be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mrmleed3.5p4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe

Filesize
66KB

MD5
f9aea3e20a5074a286c6ae5d2aa20399

SHA1
1630133dc54fdf81916aff84431e7a5803a7f7a7

SHA256
8893d53708ccc4a1aa7a1004b74a0a2b2623c10db4a928d2ab4c2739c7d1bcf2

SHA512
a67fcd777e897ec30857e9a0d1e4624cacac5c8a2e276108d7abdbe3bd1f6dfdfd205936ae865ba1e78208640d4883f7136ecf27a55657301bf436ff2e69510e

Download Submit
memory/2228-1-0x0000000000980000-0x0000000000996000-memory.dmp

Filesize
88KB

Download
memory/2228-0-0x00007FFD9E2E3000-0x00007FFD9E2E5000-memory.dmp

Filesize
8KB

Download
memory/2228-45-0x00007FFD9E2E0000-0x00007FFD9EDA1000-memory.dmp

Filesize
10.8MB

Download
memory/2228-83-0x00007FFD9E2E0000-0x00007FFD9EDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-14-0x00007FFD9E2E0000-0x00007FFD9EDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-13-0x00007FFD9E2E0000-0x00007FFD9EDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-12-0x00007FFD9E2E0000-0x00007FFD9EDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4612-11-0x0000022871BC0000-0x0000022871BE2000-memory.dmp

Filesize
136KB

Download
memory/4612-17-0x00007FFD9E2E0000-0x00007FFD9EDA1000-memory.dmp

Filesize
10.8MB

Download