Overview

overview

10

Static

static

10

XwormLoader.exe

windows10-2004-x64

10

XwormLoader.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    48s
  • max time network
    50s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2025, 04:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XwormLoader.exe

  • Size

    8.0MB

  • MD5

    2d19886d92d96cbc75d0045c88ddb83a

  • SHA1

    6ecda95b7b6da8a7c14a0394c1e9a2e76f9e5c5e

  • SHA256

    d48f1ebd2111d5b730787c3d2247c27da0b35d95a2363aa70490e0e3db6e06a0

  • SHA512

    a975de161952f092c97b7f6990da127e0aaf244ce9603508b0c377781cd4e67c84bf091e77b458f48f8354118afb45d292e0280535807ba26f0c6d28d57e7b1d

  • SSDEEP

    196608:eXin21AV7RTxZxNsh9hGb8Wo+Nu1juzy9w6W3ADORlIG:dZ3XxNsjhGbXo+NuFuzy9w9wD42G

Score
10/10
stormkittyxwormcollectioncredential_accessdiscoveryexecutionpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

217.195.153.81:50000

127.0.0.1:7000
Mutex

5UXpujbt6vWtkdEG

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

aes.plain
aes.plain

Signatures

  • Detect Xworm Payload 5 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • Stormkitty family
    stormkitty
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Uses browser remote debugging 2 TTPs 5 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 57 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5944
    • C:\Users\Admin\AppData\Local\Temp\Omnhybqtz.exe
      "C:\Users\Admin\AppData\Local\Temp\Omnhybqtz.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5000
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1qqy0tdx\1qqy0tdx.cmdline"
          4⤵
            PID:5952
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF58B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc619E09FA45D9481D93784C2DFFF7B1E7.TMP"
              5⤵
                PID:4532
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5020
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3344
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4604
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1764
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4448
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:212
        • C:\Users\Admin\AppData\Local\Temp\Tukexuutr.exe
          "C:\Users\Admin\AppData\Local\Temp\Tukexuutr.exe"
          2⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:4552
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
            3⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:2884
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5424
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:1496
            • C:\Windows\SysWOW64\findstr.exe
              findstr All
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2808
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1096
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3460
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show networks mode=bssid
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:756
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
            3⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2100
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8367bdcf8,0x7ff8367bdd04,0x7ff8367bdd10
              4⤵
                PID:1188
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2100,i,10476966665409697650,5340995063428663061,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2096 /prefetch:2
                4⤵
                  PID:4760
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1600,i,10476966665409697650,5340995063428663061,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2132 /prefetch:3
                  4⤵
                    PID:4960
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2420,i,10476966665409697650,5340995063428663061,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2484 /prefetch:8
                    4⤵
                      PID:6116
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3248,i,10476966665409697650,5340995063428663061,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3256 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:1432
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3280,i,10476966665409697650,5340995063428663061,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3284 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:1288
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4308,i,10476966665409697650,5340995063428663061,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4332 /prefetch:2
                      4⤵
                      • Uses browser remote debugging
                      PID:4212
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4744,i,10476966665409697650,5340995063428663061,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4684 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:976
              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                1⤵
                  PID:4248
                • C:\Windows\system32\wbem\WmiApSrv.exe
                  C:\Windows\system32\wbem\WmiApSrv.exe
                  1⤵
                    PID:1300
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x508 0x3fc
                    1⤵
                      PID:3712
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:264
                      • C:\Users\Admin\Downloads\XClient.exe
                        "C:\Users\Admin\Downloads\XClient.exe"
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:112
                      • C:\Users\Admin\Downloads\XClient.exe
                        "C:\Users\Admin\Downloads\XClient.exe"
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1660
                      • C:\ProgramData\svchost.exe
                        C:\ProgramData\svchost.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4740

                      Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Modify Authentication Process

                      1
                      T1556

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Modify Authentication Process

                      1
                      T1556

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Modify Authentication Process

                      1
                      T1556

                      Steal Web Session Cookie

                      1
                      T1539

                      Unsecured Credentials

                      2
                      T1552

                      Credentials In Files

                      2
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      4
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Wi-Fi Discovery

                      1
                      T1016.002

                      Lateral Movement

                      Collection

                      Data from Local System

                      2
                      T1005

                      Email Collection

                      1
                      T1114

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                        Filesize

                        78KB

                        MD5

                        8b20ebe34e39129f6bebd0a6d3abfc2f

                        SHA1

                        38754c71cbceb5e08fa4806cf4747723a80877d8

                        SHA256

                        ec11582bdfb55451d4da327de37e752c48632bee9f0aa88997be24be646040dd

                        SHA512

                        5d660ba3446bce33d4b9d862e394d9379e83bc5f79e9586107eaabb00afd807c246d0598de260dd86c0e5bb484613b61e9ceba53c63828a9213c7a6aba06e409

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        Filesize

                        2KB

                        MD5

                        d85ba6ff808d9e5444a4b369f5bc2730

                        SHA1

                        31aa9d96590fff6981b315e0b391b575e4c0804a

                        SHA256

                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                        SHA512

                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        944B

                        MD5

                        8a0407fd3b6a0e95729793e05880b558

                        SHA1

                        c704aff8e50b66cc5e7eaa51fe8fa41b0ef76ab6

                        SHA256

                        d641339de65c0d9ffd34a706fa9fcf408f2da61bdedf37fddad0ae9c8654e23e

                        SHA512

                        a8cf10aa0ad92bb7a6dc4da5d8445bd2482864612071f525b3d0da92357dad56c1a690f8755e2dc138c044387871cdf8a3af6493af8bfbb2e34214eb809a0f72

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        944B

                        MD5

                        22310ad6749d8cc38284aa616efcd100

                        SHA1

                        440ef4a0a53bfa7c83fe84326a1dff4326dcb515

                        SHA256

                        55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

                        SHA512

                        2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        944B

                        MD5

                        ef647504cf229a16d02de14a16241b90

                        SHA1

                        81480caca469857eb93c75d494828b81e124fda0

                        SHA256

                        47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710

                        SHA512

                        a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\181.215.176.43\Browsers\Firefox\FirefoxBookmarks.txt
                        Filesize

                        81B

                        MD5

                        ea511fc534efd031f852fcf490b76104

                        SHA1

                        573e5fa397bc953df5422abbeb1a52bf94f7cf00

                        SHA256

                        e5fe7f327ae62df007bd1117aa7f522dbbcd371ec67953f66d786424cb1d7995

                        SHA512

                        f7d8e575a2332b0fbd491b5e092b7ed6b0942a5165557fcc5d215d873b05103aa6ba01843133871c1c7ac81b10182a15895be49885c98d1a379dd55f88004fae

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\181.215.176.43\System\Process.txt
                        Filesize

                        4KB

                        MD5

                        e0096603b5c6765d2c09de7cab9170d7

                        SHA1

                        7d4fd1695de0711bc9a6cd9e2a2c01785a1e4207

                        SHA256

                        16b09f084f7eea261c3f3adfb3ddd0b9e17ffcb33aa1a60d0a71968e3c8d83a2

                        SHA512

                        b2f9973dd72b570c265bed48d66ab288a152fa8f768376c9c005f3c19a99b63d8d56d8bc713d52d8c6ead939e05df3e5e899fd553ef90d67e2fefa23c8ec2b3c

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1qqy0tdx\1qqy0tdx.0.vb
                        Filesize

                        78KB

                        MD5

                        ad33f1b06a0429bdf45fd18296deaadb

                        SHA1

                        d38fa31fee55f2c6f53e2656598c874437573608

                        SHA256

                        e1804d0e247fc36059629ac51b2fea3d71bd3221b6db14efa09f13e1be721178

                        SHA512

                        63a7c9c65e43de4a7ea0cc45ef04dd62f29a144d7d09873d662df0230fd713a0ba4881646237d3c6f279c3cf2514584bb191041c98ecf04ff05a61c1beaeea66

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1qqy0tdx\1qqy0tdx.cmdline
                        Filesize

                        292B

                        MD5

                        51e296d414ec29e90efb040a9eb6eb6a

                        SHA1

                        0138f984fa894ba3d4ca0b6ae547979c0cb46ad7

                        SHA256

                        2dfb738e232212414e6e31fbd71fbb56e8949bb0e314ae131a67e7b30f6b768d

                        SHA512

                        e86d7a62aee381618ab7da3567654c590fa2d332a123aa6cd5ac94333718b98c58408197b6ae8ca7c613ab043d51a6c681327172f886fcd095c2aeb123bd9c29

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Omnhybqtz.exe
                        Filesize

                        7.8MB

                        MD5

                        e2d96d9ee0fc390755c45034ec782c33

                        SHA1

                        f5487d3d706f7554c3075ed8a0753b8581d33749

                        SHA256

                        2b00d8e00c84a130c58a3d4ee5d4548517fa4b95eb6ceb0429a0b857755ada29

                        SHA512

                        04608fe3591b841217e4b92b1020d5ca384b796d156a6b7c6664769c7bbd7345b03c8a6857d6fd2d1779f41eefd349635d0f7b2a1c4c8467c071edab4f9bd327

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\RESF58B.tmp
                        Filesize

                        1KB

                        MD5

                        a12217af1cf9f30928dba15a7226e7b7

                        SHA1

                        ed384c236f8c62a94d711f04f0e3cae301f12930

                        SHA256

                        015aa1662ccd4fb8a24e5aeee8bc2c41d7bd5606042b30f53c28a647816563eb

                        SHA512

                        a3030aeb800b2b6b647dfdc775411714ad9750aeb6b46e28ced001047a83bfd086f8178bc2b2fe149cba4b00048816302d77df491aea050ecd84d6459248be5a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Tukexuutr.exe
                        Filesize

                        245KB

                        MD5

                        4fc027cda3ab806b71d90369f05e2e12

                        SHA1

                        57748ec8d12f215fc80559594a94e8f74e3a1ae3

                        SHA256

                        9f628e852ccd4c45b3e4ee68ada8c63ae593066cd386895c6f8beee4fbb46c6d

                        SHA512

                        e407ae686958bc5f66556317694ac372b02e150dad7c3b3623d2d6be991a0e349cba6aff61403299803b0d4b1f17fd5cedc822b06f0bff3866bc7250fbdc2715

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
                        Filesize

                        14.9MB

                        MD5

                        cac67604904dce94d230953f170d4391

                        SHA1

                        9ea639f23a5699bb66ca5da55b2458347aed6f13

                        SHA256

                        64e5b7463d340b9a8b9d911860b4d635b0cf68afbe3593ed3cc6cbb13db0b27b

                        SHA512

                        af358008abb47a345a53dab222a01ab6c0ed10185fca8d2be9af2892161f150c8cc8a7f75272d1eb1acd17b49f32d3531adbc1cfdd153cc7c3e90841cabe766a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x1ontzca.fry.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                        Filesize

                        38KB

                        MD5

                        076f2c93e34a152c270907e33143fdf4

                        SHA1

                        26278090a3e808d79e76ce8dc3ef21f55524c9b4

                        SHA256

                        59d95ba60294f08afe88b16ca08c6befd1148ec4a120a674fc5bf8287205ebc5

                        SHA512

                        54cbde7e10665bf039d69df63a05dcd6886a883d51e8354d3cc78f2f0883a80b7441a24108053b9b23bacc4a8cff366fc52fa02e2a10e8f3f9c600a1e9fbe867

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\vbc619E09FA45D9481D93784C2DFFF7B1E7.TMP
                        Filesize

                        1KB

                        MD5

                        d40c58bd46211e4ffcbfbdfac7c2bb69

                        SHA1

                        c5cf88224acc284a4e81bd612369f0e39f3ac604

                        SHA256

                        01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

                        SHA512

                        48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

                        Download Submit

                      • C:\Users\Admin\Downloads\XClient.exe
                        Filesize

                        32KB

                        MD5

                        059366b4a3a6d8e235d89c8b3a231bf8

                        SHA1

                        b01c796cb937a41bfc2a5fc788d1d7ac8ad4a02c

                        SHA256

                        5097cbbde73d8a43adb95874b7df88589fbc47bd19786eab7e4291ad88ea16ce

                        SHA512

                        3a5faba566a57e6d9858901be82047bca687937efd263d5e4f7612cdeb90d1dc13719ff055a28408c4d37d94aabebeb56ecb6d2d26b50789450d7b08ef5cbcf4

                        Download Submit

                      • memory/112-340-0x0000000000170000-0x000000000017E000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/1728-30-0x00007FF826FF5000-0x00007FF826FF6000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1728-33-0x000000001BE10000-0x000000001BEB6000-memory.dmp

                        Filesize

                        664KB

                        Download

                      • memory/1728-25-0x00007FF826FF5000-0x00007FF826FF6000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1728-141-0x00007FF826D40000-0x00007FF8276E1000-memory.dmp

                        Filesize

                        9.6MB

                        Download

                      • memory/1728-28-0x00007FF826D40000-0x00007FF8276E1000-memory.dmp

                        Filesize

                        9.6MB

                        Download

                      • memory/1764-226-0x0000018B549E0000-0x0000018B54B2E000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/3344-172-0x000001FB7FB80000-0x000001FB7FBA2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3344-188-0x000001FB7FCE0000-0x000001FB7FE2E000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/4448-245-0x000001C81BFE0000-0x000001C81C12E000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/4552-29-0x000000007472E000-0x000000007472F000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4552-272-0x000000007472E000-0x000000007472F000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4552-31-0x0000000005640000-0x0000000005802000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4552-36-0x0000000006E70000-0x0000000006ED6000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/4552-35-0x00000000062D0000-0x00000000062E2000-memory.dmp

                        Filesize

                        72KB

                        Download

                      • memory/4552-27-0x0000000000D90000-0x0000000000DD4000-memory.dmp

                        Filesize

                        272KB

                        Download

                      • memory/4552-34-0x00000000066D0000-0x0000000006BFC000-memory.dmp

                        Filesize

                        5.2MB

                        Download

                      • memory/4604-208-0x000002C8365D0000-0x000002C83671E000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/5000-344-0x000001DF50D40000-0x000001DF50DC2000-memory.dmp

                        Filesize

                        520KB

                        Download

                      • memory/5000-346-0x000001DF58270000-0x000001DF58552000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/5000-139-0x000001DF335A0000-0x000001DF34488000-memory.dmp

                        Filesize

                        14.9MB

                        Download

                      • memory/5000-347-0x000001DF57880000-0x000001DF57932000-memory.dmp

                        Filesize

                        712KB

                        Download

                      • memory/5000-271-0x000001DF4FFD0000-0x000001DF501C4000-memory.dmp

                        Filesize

                        2.0MB

                        Download

                      • memory/5000-323-0x000001DF57C50000-0x000001DF57DB8000-memory.dmp

                        Filesize

                        1.4MB

                        Download

                      • memory/5000-345-0x000001DF50CB0000-0x000001DF50CDC000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/5020-137-0x0000000000630000-0x0000000000640000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/5944-0-0x000000007472E000-0x000000007472F000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/5944-2-0x00000000051D0000-0x0000000005774000-memory.dmp

                        Filesize

                        5.6MB

                        Download

                      • memory/5944-1-0x0000000000400000-0x0000000000C06000-memory.dmp

                        Filesize

                        8.0MB

                        Download

                      • memory/5944-5-0x0000000074720000-0x0000000074ED0000-memory.dmp

                        Filesize

                        7.7MB

                        Download

                      • memory/5944-4-0x0000000005940000-0x000000000594A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/5944-3-0x0000000005780000-0x0000000005812000-memory.dmp

                        Filesize

                        584KB

                        Download

                      • memory/5944-32-0x0000000074720000-0x0000000074ED0000-memory.dmp

                        Filesize

                        7.7MB

                        Download