Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
01/08/2025, 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe
Resource
win11-20250619-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20250619-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe
- Size 825KB
- Sample250801-bs821a1zat
- SHA256 7b232254d4b4be67111e92f5c2e34bc331403393c2d019b31e256ca7d798cd08
- MD5 5ea006803bba64c15fe68791a8db5005
- SHA1 f10dd374c76e194c8b7e0381a80db57281a1e77b
- SHA512 abb8a1832786925e65fb51560b0c37eaca550b76208d72d7830e0ecf467d4e601b8259deee443bc55c992736d47afddb9f2aaf20b72ea8e52173fc3e2f17481a
- SSDEEP 24576:R3pUDihK+O9H9d7TW9qJuoj3wwU7FuGOeYt4xzz:J2iKZnd7TWsJVjA1FuDcz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
hexa.dnsframe.com:66
Mutex
-
FzSIsfqlHwWWhS56
Attributes
-
Install_directory
%AppData%
-
install_file
inj.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/2160-70-0x0000000000F00000-0x0000000000F0E000-memory.dmp family_xworm - Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 5116 created 3296 5116 Nation.pif 51 PID 5116 created 3296 5116 Nation.pif 51 - Xworm family
- Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\inj.lnk MSBuild.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\inj.lnk MSBuild.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpectraFox.url cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpectraFox.url cmd.exe - Executes dropped EXE 1 IoCs
pid Process 5116 Nation.pif - Loads dropped DLL 1 IoCs
pid Process 1916 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 6000 tasklist.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\CityPurse 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe File opened for modification C:\Windows\LoverEdition 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nation.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language waitfor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language extrac32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4616 schtasks.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 6000 tasklist.exe Token: SeDebugPrivilege 2160 MSBuild.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 5116 Nation.pif 5116 Nation.pif 5116 Nation.pif - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 5840 1916 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe 77 PID 1916 wrote to memory of 5840 1916 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe 77 PID 1916 wrote to memory of 5840 1916 7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe 77 PID 5840 wrote to memory of 4460 5840 cmd.exe 79 PID 5840 wrote to memory of 4460 5840 cmd.exe 79 PID 5840 wrote to memory of 4460 5840 cmd.exe 79 PID 4460 wrote to memory of 6000 4460 cmd.exe 80 PID 4460 wrote to memory of 6000 4460 cmd.exe 80 PID 4460 wrote to memory of 6000 4460 cmd.exe 80 PID 4460 wrote to memory of 3724 4460 cmd.exe 81 PID 4460 wrote to memory of 3724 4460 cmd.exe 81 PID 4460 wrote to memory of 3724 4460 cmd.exe 81 PID 4460 wrote to memory of 1552 4460 cmd.exe 83 PID 4460 wrote to memory of 1552 4460 cmd.exe 83 PID 4460 wrote to memory of 1552 4460 cmd.exe 83 PID 4460 wrote to memory of 4952 4460 cmd.exe 84 PID 4460 wrote to memory of 4952 4460 cmd.exe 84 PID 4460 wrote to memory of 4952 4460 cmd.exe 84 PID 4460 wrote to memory of 5116 4460 cmd.exe 85 PID 4460 wrote to memory of 5116 4460 cmd.exe 85 PID 4460 wrote to memory of 5116 4460 cmd.exe 85 PID 4460 wrote to memory of 5024 4460 cmd.exe 86 PID 4460 wrote to memory of 5024 4460 cmd.exe 86 PID 4460 wrote to memory of 5024 4460 cmd.exe 86 PID 5116 wrote to memory of 2396 5116 Nation.pif 87 PID 5116 wrote to memory of 2396 5116 Nation.pif 87 PID 5116 wrote to memory of 2396 5116 Nation.pif 87 PID 5116 wrote to memory of 5264 5116 Nation.pif 89 PID 5116 wrote to memory of 5264 5116 Nation.pif 89 PID 5116 wrote to memory of 5264 5116 Nation.pif 89 PID 2396 wrote to memory of 4616 2396 cmd.exe 91 PID 2396 wrote to memory of 4616 2396 cmd.exe 91 PID 2396 wrote to memory of 4616 2396 cmd.exe 91 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92 PID 5116 wrote to memory of 2160 5116 Nation.pif 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe"C:\Users\Admin\AppData\Local\Temp\7b232254d4b4be67111e92f5c2e34bc331403393c2d01.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Conditions.jpg3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.execmd4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6000
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set xHvwkMjyoqyYzDYqTcDIezINglQITjPbj=AutoIt3.exe & Set nESMQIqKqyOT=.a3x & Set MWpZLDzF=3005⤵
- System Location Discovery: System Language Discovery
PID:3724
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y Tackle.jpg *.*5⤵
- System Location Discovery: System Language Discovery
PID:1552
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "upskirt" Alarm5⤵
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\Users\Admin\AppData\Local\Temp\416815\Nation.pifNation.pif b5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
-
C:\Windows\SysWOW64\waitfor.exewaitfor /T 5 MWpZLDzF5⤵
- System Location Discovery: System Language Discovery
PID:5024
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Started" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ColorSync Dynamics\SpectraFox.js'" /sc minute /mo 5 /F2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Started" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ColorSync Dynamics\SpectraFox.js'" /sc minute /mo 5 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpectraFox.url" & echo URL="C:\Users\Admin\AppData\Local\ColorSync Dynamics\SpectraFox.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpectraFox.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5264
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\416815\Nation.pif
- Size 957KB
- SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
- MD5 f589c1095824c52a5ed3625d0d851b22
- SHA1 2eac026b394548268cc8ee783de99c88cfb1e408
- SHA512 f47f3bf4930191eb0d01b1a1bd737ccbe368266c99d5ee1c22d7db49125d7b3ca0685fb2c057f891e9240d215ddb96209db2e971c640592e1d487e794cc93e46
- SSDEEP 24576:hMd+PsPy8Fv7yw56uX4Nw1ImcY3a2hrbBz:hzPsPy8Yw5EN62srb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\416815\b
- Size 252KB
- SHA256 32844c1e9b0d7c851182bea761baf41cb60bdeabf4721ac35d546dec75f49662
- MD5 59b0023e471fc4b773cc02f5877c6c53
- SHA1 67a459b9b3fbe98efb034fcdb01959db04c55c2b
- SHA512 308273c2dcc2f3952d422a8ec8138425bc05682e01bc7684ae513013336a0c3450e9a2a14bae6b66025be7d6dbcdf9ec11c3bec3d47db3a94fe3ba9a05b840f8
- SSDEEP 6144:Fh2cL9Qceklt7UFiefTmo0zGVURKRMnHBYKOwl/q5:72cLReYtAF/KXzMUIenHB9y5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Alarm
- Size 322B
- SHA256 3120ed3699b4106cf6aac5b8fc97c39c95e08c5dede1458bad7e93e84b20f5e8
- MD5 cdc72cde22ecc75460fc46ec531b7e3a
- SHA1 59b9261d67a92b2797d0b8851f8aff1ef45a6dac
- SHA512 10cbb156c05feec62dddfd91a83017e98efee3ddef5d487de609519a1b555a321cf38c7267e7855878273ec55dd1c2f4ecc1c58771dcaedca98148f8a805439e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Briefly
- Size 120KB
- SHA256 da91cca3415c33e34a272f6d647fd8e8095e6ed9828806777b53cd570e599a67
- MD5 b554fc9fe8b83dd2c96db713adbd7bad
- SHA1 e75a44b9342abb88f7ae56c414a93d7157b8f5d7
- SHA512 8ef14da508e0c6c0482379bb9e6e0198a61d8e3fd9b50b8af19e1a3e35162d79a37b51765390b04166107a100c4fa60ac7c8232daa95eec2f71409e6ae098860
- SSDEEP 3072:wsL9jC0O2iSW4QlXUxPrCtTRVB4Y3I09JwCIj4BPb1XuE/gcS:xx1WUyB4Y3IW5IuhS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cent
- Size 142KB
- SHA256 1b5accb8487addc0f92f039fda87fd80b87adecc3648985040a7ed67dbb677d4
- MD5 f72db6fa01b1ab777508378ff4129d67
- SHA1 305065ef953beb18865184ad75c4ec0dda0a180c
- SHA512 ac318068742585e7843eefee7ec4f273b482fd8e263c7e49cb4d18fe78f371e2b0e39b88442c93c2381977bd8e2f7e7bdbd03768e59090ed485800cc01c2501f
- SSDEEP 1536:9JaGloaj6bs8jcd/TcI3s+uXkrfhrRj3oh63EYrDWyu0uZo2+93:/am6OzmkrJrRj4h6DWy4ZNk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Circus.jpg
- Size 175KB
- SHA256 fd1f4fa3ae296ea469e615398dcf892e09a6b84012a2b70502f873dbdcc8da23
- MD5 18139d2f4c9997bc035762f855b6d5d1
- SHA1 3e44804de41a61934c7fdda9f6d3c1937a08f3d4
- SHA512 155579e8c6117d5ec3fe493aa12f9a5c9afe91c3f10c34c48fc58c35732d9df3915b3ae78d6fd1f7a615634599905f38925a631594c46dba4e4058fa2dea5bea
- SSDEEP 3072:Fnh7CcMsYAHL98Ip2cek8ct7UFR4jifgpcaImkNBGzYxt733:Fh2cL9Qceklt7UFiefTmo0zGVH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Conditions.jpg
- Size 20KB
- SHA256 c5df26fd3409ce100bfd79910d231d2064652e18f8987445aa539031175ec7f4
- MD5 77c0b5f0568037478788bc63cb798899
- SHA1 b33772463a166c6ba704612772f45378cbc4e9af
- SHA512 aa3d5e8007072ab5e64a09ff30fe434a3d8deb26350ebe7074aaa39f85f1ca95c7484f075c99d308a9c3e5c204e66005a6f5c00e4358b8e8d7c8a939771646c6
- SSDEEP 384:UM3higjbwTNMj8GXGqpWbUWPm27PUb1J3WDAAGZKw/:UM3himbKN4XGaJcvUbq3G3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Magnetic
- Size 55KB
- SHA256 8a5791b0aad6f266ba3c7f88721017c49e6a2757d35986300f485acccc99f1df
- MD5 2644f6413f8df0d981db0a74537e896f
- SHA1 f14f7f52d38f7ea5f342513dcc0de36a5d28b290
- SHA512 594e132ba419007112156ee85e7852c34c96187c8f3047a2fa21a563f305f820f08eb1c7118351073b25b1fc1fd7729fe8698cc105687b21faee4b069c2b6a68
- SSDEEP 1536:h4T2ubSWJKWNJELHW/EJlrZlYR+68cNk3smf:m2ubSW4wC2mYR+Hf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Postage
- Size 139KB
- SHA256 0cf09e4cdd05a19a5fe82c051d78ca901f4d0c0d3ccd6222966ddb4cc7c2841c
- MD5 d33c274b1eacbfa60ff92c14fc61df66
- SHA1 6fe5b27cb01b1b8e608c92e6031f697307af1648
- SHA512 002aaf8cafc0cc136b26d618685cbc0ad9d10493ac041e91988d50cdc703cec3ab257facad9e3cdf6788414660595240c50acf05352359cc62c00dc5473e34c7
- SSDEEP 3072:ixRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3MD8jjJ8lghHzJL:iXuN2KFIyt+8ZUlhxb8AV8lghTR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Publicly
- Size 120KB
- SHA256 4177b4e03fdf9dc7fcbeac232311e19552a3e96bed6aa7484ed418c0db7d22c9
- MD5 3ac9eb1889e273c47027f3692ca0b73f
- SHA1 b9865272c252037c99dbcbf23ddc5bde429f1688
- SHA512 9f16d93097d2f04b3d549404d44685f04133cf9c1cef6c1c9367901d0e02ec6356c8200c68cf1f4acde7fa1e703598a0c0141bc309aacfdbe79458b6c8dc11ff
- SSDEEP 3072:rypAXoegz8StjOrOJGGMBwvqXQGYlawwBonp:epAI8StQOAGlXuwwW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Shark
- Size 85KB
- SHA256 68de54543c1310ccfcec132b8385c6c250f5c1516aee0fb9ab3b01af0af73426
- MD5 419d278bd43fe25ddb79cd1251b7363b
- SHA1 797f177c8a2a348652aacbe9f1a22353b3c9bed5
- SHA512 f9adf1d1bdf6a5c80c793889c12d64d2bb6bd9dd946cde657e8ed8674a0eab883eee5f5d8dcc062cac50297ab267434e2e2794e333c287c6fa39db5d35483884
- SSDEEP 768:7q6LqgaHbdMNkNDUzSLKPDvFQC7Vkr5M4INduPbOU7aI4kWD9vmCupxhSaAwu+2k:7tmgMbFuz08QuklMBNIWPuwaAwu+1PH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Sheets
- Size 122KB
- SHA256 4b03af51aa01191e2a5242f1e3ae3ed562305d27e92feb39537b5d43974758b2
- MD5 399fe1a5c3d6160683ef56172ef116c4
- SHA1 2cdcccfaa98809eb8dcfc8f8355729c373a42a66
- SHA512 d4feb70a214c6b4a7c62a4ff422033d4de1544c8b0971e85d2a4cb8b71971a61a770179f85c835b81c1a4306d8d75725c65263dc536b73482a057d8efd5ad067
- SSDEEP 1536:pUsb1yAwsc8MxqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijtNOKc+48918JsdVCsF:8DXOXT/CfXib+tSijpcVMFXDR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Specifics.jpg
- Size 77KB
- SHA256 36b8b46a7562cc1afc5a93d483c4eed990cf141d5108fdccabc8507b05a17b95
- MD5 5f40cb08393ab35bad16c403d76204b6
- SHA1 79139a918b791d4bf48980bf5416c84d10a14008
- SHA512 9ca5bdb95bdb90b98094d3d6181c558fb9df4d8250d94d776bf6cd193aada53a6b845c7ecb47aab052b36d5dfcd9710ef0ebf28190b8c3bc3c4186acbaf72672
- SSDEEP 1536:02/JYALUUGwZWiLCFeTTDrzMiK4zCngrzceqXYKAgxO22ZrhJFjHslZhvqJe6:0cGw4iLhTTAnQW5XYKlZ2t5jMl/qc6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tackle.jpg
- Size 494KB
- SHA256 2408ca787d06e6c8d54b2f075ed7dffaa1318110e9866e608362069a9bea40d3
- MD5 2e493940eb676afc3e78de1d6f8c6635
- SHA1 b1f1d7c0c158a8563f4b2b4e215fec3c1b638ce6
- SHA512 cb36da8669ce849d3a5c77d748bb20b21b2939d5240994ab99c3d144a68554c1cb49abd3cf48a7e713736bc97c396853151003a2d985efa0ad017bcbe1cab36b
- SSDEEP 12288:Rz3rKWLIM4LbtCdX9Iaa/9qf73B0u4gKNyUrnVnwB3NF1:Rzr0dHodX9Q9q6u4NNW3p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Temporarily
- Size 130KB
- SHA256 9453b49cdf51ac78c66e29a4ee48df73a24c24f48215337abafd2081abd0218b
- MD5 4087b1edbdd242f600047f688254cd44
- SHA1 9ceffcbb85ae2328f1388e6377db552e12eb24ad
- SHA512 654fd3ad96989df9eaf3d651dd94632a94830697b6901ae9ccd0320b3083ec6f3bb920a6827775b0eb1734f3e1a9294446edc9f681c2ecbc99cba167c71f9e65
- SSDEEP 1536:ft0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xe5b:6eVzOqD1IGuTpMgKYbwR5Exe2/RTX/4t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tied
- Size 43KB
- SHA256 9a153b6cefe52b221c6ff8e950e43a4ec61c259f9f8866e23e7ac981ab58293d
- MD5 fefe1d66c38b1a3a2219a819873398f2
- SHA1 70eea09590949cf11401cfd49999918f1841adfd
- SHA512 ab2a61b2475e2e17662a26d743180e976979f346af4f789574efe662f0f8a15aa257ca6113d90a17732d53f6e38328feca5d9480555b35244ce31ef732db977b
- SSDEEP 768:xrKHD9OTGQfoz66t4dP+8pN5XvrsY916ojfvSb2Tal0xiVWV9+k:xr+DATG62rt4dP+iX7DjfvSSuyxiQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsp8953.tmp\nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP