xworm | c7ca8ab7360335abfd24c031a3e6eca9f2241e650ffad3caae0e361a5769714c

Analysis

user interaction
yes
max time kernel
56s
max time network
63s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/05/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
1442.exe
Size 28KB
Sample260509-aefmvsfy2t
SHA256 c7ca8ab7360335abfd24c031a3e6eca9f2241e650ffad3caae0e361a5769714c
MD5 070d580cc3ee8bd7bba0268f953cff9a
SHA1 37db0f82dd66114275757526d3f54400e658dd16
SHA512 39c23e9b226b8073a98dcb1b5ac07f45f053a3835db03295b42489e914792d49b448a5e0c10340061d7d1a21aa5bc4a12af7a8dbbf554233e0e758ba6d747932
SSDEEP 384:71BLpDUYN2Z0u4ocfQYcQzVEI2yKYymNru/ttQ9a9stDLq2OUOOu3LTShQ:npIYN2jcfQjyKtkru/LQIM6hUDhQ
TLSH
T127D2BE2552C54236DBAE0F365C63B39147B2F316ED7B8F7F18D4E12AEEA32488522131
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

lmfao1337.ddns.net:1337

Mutex

UiR5OIZFhVEO2o6k

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000028353-13.dat	family_xworm
behavioral1/memory/3772-23-0x0000000000D90000-0x0000000000DA0000-memory.dmp	family_xworm

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	1442.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\International\Geo\Nation	System32.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	System32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	System32.exe

Executes dropped EXE 3 IoCs

pid	Process
3772	System32.exe
1432	System32.exe
5116	ciaxlj.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\System32.exe"	System32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	ciaxlj.exe
File opened (read-only)	\??\Y:	ciaxlj.exe
File opened (read-only)	\??\B:	ciaxlj.exe
File opened (read-only)	\??\D:	ciaxlj.exe
File opened (read-only)	\??\H:	ciaxlj.exe
File opened (read-only)	\??\L:	ciaxlj.exe
File opened (read-only)	\??\S:	ciaxlj.exe
File opened (read-only)	\??\U:	ciaxlj.exe
File opened (read-only)	\??\W:	ciaxlj.exe
File opened (read-only)	\??\G:	ciaxlj.exe
File opened (read-only)	\??\J:	ciaxlj.exe
File opened (read-only)	\??\K:	ciaxlj.exe
File opened (read-only)	\??\O:	ciaxlj.exe
File opened (read-only)	\??\Z:	ciaxlj.exe
File opened (read-only)	\??\I:	ciaxlj.exe
File opened (read-only)	\??\N:	ciaxlj.exe
File opened (read-only)	\??\Q:	ciaxlj.exe
File opened (read-only)	\??\A:	ciaxlj.exe
File opened (read-only)	\??\M:	ciaxlj.exe
File opened (read-only)	\??\P:	ciaxlj.exe
File opened (read-only)	\??\R:	ciaxlj.exe
File opened (read-only)	\??\T:	ciaxlj.exe
File opened (read-only)	\??\V:	ciaxlj.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	ciaxlj.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000\Control Panel\Desktop\Wallpaper	ciaxlj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ciaxlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4696	taskkill.exe
3524	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	ciaxlj.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1653660789-1211287304-2482568781-1000\{BCA2DC19-F0E4-4599-9358-094ADD2B702F}	ciaxlj.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4664	WMIC.exe
4664	WMIC.exe
4664	WMIC.exe
4664	WMIC.exe
1968	WMIC.exe
1968	WMIC.exe
1968	WMIC.exe
1968	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	System32.exe
Token: SeDebugPrivilege	3772	System32.exe
Token: SeDebugPrivilege	1432	System32.exe
Token: SeDebugPrivilege	3524	taskkill.exe
Token: SeDebugPrivilege	4696	taskkill.exe
Token: SeShutdownPrivilege	5116	ciaxlj.exe
Token: SeCreatePagefilePrivilege	5116	ciaxlj.exe
Token: SeIncreaseQuotaPrivilege	4664	WMIC.exe
Token: SeSecurityPrivilege	4664	WMIC.exe
Token: SeTakeOwnershipPrivilege	4664	WMIC.exe
Token: SeLoadDriverPrivilege	4664	WMIC.exe
Token: SeSystemProfilePrivilege	4664	WMIC.exe
Token: SeSystemtimePrivilege	4664	WMIC.exe
Token: SeProfSingleProcessPrivilege	4664	WMIC.exe
Token: SeIncBasePriorityPrivilege	4664	WMIC.exe
Token: SeCreatePagefilePrivilege	4664	WMIC.exe
Token: SeBackupPrivilege	4664	WMIC.exe
Token: SeRestorePrivilege	4664	WMIC.exe
Token: SeShutdownPrivilege	4664	WMIC.exe
Token: SeDebugPrivilege	4664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4664	WMIC.exe
Token: SeRemoteShutdownPrivilege	4664	WMIC.exe
Token: SeUndockPrivilege	4664	WMIC.exe
Token: SeManageVolumePrivilege	4664	WMIC.exe
Token: 33	4664	WMIC.exe
Token: 34	4664	WMIC.exe
Token: 35	4664	WMIC.exe
Token: 36	4664	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4664	WMIC.exe
Token: SeSecurityPrivilege	4664	WMIC.exe
Token: SeTakeOwnershipPrivilege	4664	WMIC.exe
Token: SeLoadDriverPrivilege	4664	WMIC.exe
Token: SeSystemProfilePrivilege	4664	WMIC.exe
Token: SeSystemtimePrivilege	4664	WMIC.exe
Token: SeProfSingleProcessPrivilege	4664	WMIC.exe
Token: SeIncBasePriorityPrivilege	4664	WMIC.exe
Token: SeCreatePagefilePrivilege	4664	WMIC.exe
Token: SeBackupPrivilege	4664	WMIC.exe
Token: SeRestorePrivilege	4664	WMIC.exe
Token: SeShutdownPrivilege	4664	WMIC.exe
Token: SeDebugPrivilege	4664	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4664	WMIC.exe
Token: SeRemoteShutdownPrivilege	4664	WMIC.exe
Token: SeUndockPrivilege	4664	WMIC.exe
Token: SeManageVolumePrivilege	4664	WMIC.exe
Token: 33	4664	WMIC.exe
Token: 34	4664	WMIC.exe
Token: 35	4664	WMIC.exe
Token: 36	4664	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1968	WMIC.exe
Token: SeSecurityPrivilege	1968	WMIC.exe
Token: SeTakeOwnershipPrivilege	1968	WMIC.exe
Token: SeLoadDriverPrivilege	1968	WMIC.exe
Token: SeSystemProfilePrivilege	1968	WMIC.exe
Token: SeSystemtimePrivilege	1968	WMIC.exe
Token: SeProfSingleProcessPrivilege	1968	WMIC.exe
Token: SeIncBasePriorityPrivilege	1968	WMIC.exe
Token: SeCreatePagefilePrivilege	1968	WMIC.exe
Token: SeBackupPrivilege	1968	WMIC.exe
Token: SeRestorePrivilege	1968	WMIC.exe
Token: SeShutdownPrivilege	1968	WMIC.exe
Token: SeDebugPrivilege	1968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1968	WMIC.exe
Token: SeRemoteShutdownPrivilege	1968	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5116	ciaxlj.exe
5116	ciaxlj.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3076	4240	1442.exe	83
PID 4240 wrote to memory of 3772	4240	1442.exe	85
PID 3076 wrote to memory of 3968	3076	cmd.exe	86
PID 3772 wrote to memory of 1592	3772	System32.exe	90
PID 3772 wrote to memory of 5116	3772	System32.exe	95
PID 5116 wrote to memory of 3156	5116	ciaxlj.exe	96
PID 3156 wrote to memory of 3524	3156	cmd.exe	98
PID 3156 wrote to memory of 4696	3156	cmd.exe	99
PID 3156 wrote to memory of 4664	3156	cmd.exe	100
PID 3156 wrote to memory of 1968	3156	cmd.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1442.exe
"C:\Users\Admin\AppData\Local\Temp\1442.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1442.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\system32\mode.com
    mode con: cols=100 lines=30
    3⤵
    PID:3968
- C:\Users\Admin\AppData\Local\Temp\System32.exe
  "C:\Users\Admin\AppData\Local\Temp\System32.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Users\Admin\AppData\Roaming\System32.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\ciaxlj.exe
    "C:\Users\Admin\AppData\Local\Temp\ciaxlj.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies WinLogon
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' set FullName='UR NEXT'
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' rename 'UR NEXT'
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown /f /r /t 0
        5⤵
        
        PID:4800

C:\Users\Admin\AppData\Roaming\System32.exe
"C:\Users\Admin\AppData\Roaming\System32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a20855 /state1:0x41c64e6d
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 04a5921258e4b3cf1d50a718c1b0c1c26ec93abd1629351d2f064e3181c1293b
MD5 367b00709fff147aedd39a8c45deda9b
SHA1 2c0b4d34c68fd5140bcd443ead713803bc5437f0
SHA512 d8effb14ab4a169dffd67a57422e9886a7572ca1ac1aa056448dc2d22c07c610420a73994f444606d56e6d1261e0d9d508505ce66bec13498ea8bb5d0f10a093
SSDEEP 768:w0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:uZP2tFPuNnY4UmqEMioTaBacg
TLSH
T12E154137D190B085CF2C71B1E5ED5F08BA23B10712E052465FB8A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1442.bat

Path C:\Users\Admin\AppData\Local\Temp\1442.bat
Size 1KB
SHA256 61378a1ba4700876659848d553fa1caa5a5748ff9255af13cd2f539b3ae1bfdc
MD5 691cb7efa6ca2ceb7455475895dc871b
SHA1 0ec4c83db438dcc469b5fd5b29d04f8efa8b13e5
SHA512 6102d0abbcb24681892bda526bded56d6dcd951dbc3cdabd45eec4d0ef7106fd8873134cf2f5b02e692422c38c6f7f198199e9e597f14b02922b923912f69e8b
TLSH
T1BD31E3613D38D4526CE2DD8B1F7E9497FBA2128F01289DA4B23F09F367046C9799EC64
MD5 SHA1 SHA512 TLSH

Submit Download

System32.exe

Path C:\Users\Admin\AppData\Local\Temp\System32.exe
Size 35KB
SHA256 99552727ef350dcd99949e3fff24f15f291cdb1934ba45b19186e8b164522e7f
MD5 68d56ada5fe011d53f8850b249fdc6ef
SHA1 89542145476e1ec8652ba7089cc36dd664a115ed
SHA512 7a4403e89e6313d4abfea6c724ebeb8ed38ae99b356ee3db001f159710e5e024f7d75a6e97b6b468b889bf87c66e93dc12580554b1e3d6dcea39e22b294e48e5
SSDEEP 768:lkGLMt53p91cw2F5LFy19OkYO/hcyySG:S7TDMTF49OkYO/RG
TLSH
T1BCF25C4937A18726D5ED5FF86A73A2020574F6079D27EB5E0CC885AE7B37BC18A013E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ciaxlj.exe

Path C:\Users\Admin\AppData\Local\Temp\ciaxlj.exe
Size 6.7MB
SHA256 4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47
MD5 d5671758956b39e048680b6a8275e96a
SHA1 33c341130bf9c93311001a6284692c86fec200ef
SHA512 972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7
SSDEEP 3072:V3LA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuzzo9Y:lLJlC6j0CX4XmvWHVcd62uo9
TLSH
T12766F29B5ECC82E2FD3E05314062F676A6647EE903E14FCB62F80D47FA502E56C7119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

one.rtf

Path C:\Users\Admin\AppData\Local\Temp\one.rtf
Size 403B
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064
TLSH
T162E0ABB65C82D2C5018D15AA9E5040190F1D8E7AACB6A5CEB40AAC10B2A549C70809D2
MD5 SHA1 SHA512 TLSH

Submit Download

rniw.exe

Path C:\Users\Admin\AppData\Local\Temp\rniw.exe
Size 76KB
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877
SSDEEP 1536:3vosBknP2Uo+GjDZwue3jzFfcdhghUuV+ETNOh:3vVMCcHVcdhghUuzE
TLSH
T134735A83B6C10772C68146B145B23AB6C735973A87269FD7D34C5A07AFA44F1CCB22DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\text.txt
Size 396B
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f
MD5 SHA1 SHA512

Submit Download

windl.bat

Path C:\Users\Admin\AppData\Local\Temp\windl.bat
Size 771B
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6
TLSH
T1FF0128835579212398372F7C93CBEE479014DC1928C44B5739EF686AA7A2454B029BDE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1968-101-0x0000000000FD0000-0x0000000000FF5000-memory.dmp

Download

memory/3772-26-0x0000000001580000-0x00000000015EB000-memory.dmp

Download

memory/3772-27-0x000000001BAB0000-0x000000001BAC0000-memory.dmp

Download

memory/3772-105-0x0000000001580000-0x00000000015EB000-memory.dmp

Download

memory/3772-25-0x000000001BAB0000-0x000000001BAC0000-memory.dmp

Download

memory/3772-41-0x0000000001580000-0x00000000015EB000-memory.dmp

Download

memory/3772-23-0x0000000000D90000-0x0000000000DA0000-memory.dmp

Download

memory/3772-76-0x000000001C930000-0x000000001C93A000-memory.dmp

Download

memory/3772-39-0x0000000001580000-0x00000000015EB000-memory.dmp

Download

memory/4240-0-0x0000000000D50000-0x0000000000D5E000-memory.dmp

Download

memory/4240-1-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/4664-81-0x00000000015A0000-0x00000000015C5000-memory.dmp

Download

memory/5116-73-0x0000000009E10000-0x0000000009E1E000-memory.dmp

Download

memory/5116-78-0x000000000DC30000-0x000000000DC40000-memory.dmp

Download

memory/5116-79-0x000000000DC30000-0x000000000DC40000-memory.dmp

Download

memory/5116-82-0x000000000E030000-0x000000000E040000-memory.dmp

Download

memory/5116-85-0x000000000DC30000-0x000000000DC40000-memory.dmp

Download

memory/5116-86-0x000000000E030000-0x000000000E040000-memory.dmp

Download

memory/5116-77-0x000000000DC30000-0x000000000DC40000-memory.dmp

Download

memory/5116-84-0x000000000DC30000-0x000000000DC40000-memory.dmp

Download

memory/5116-83-0x000000000E030000-0x000000000E040000-memory.dmp

Download

memory/5116-80-0x000000000DC30000-0x000000000DC40000-memory.dmp

Download

memory/5116-72-0x000000000D3B0000-0x000000000D3E8000-memory.dmp

Download

memory/5116-56-0x0000000006AD0000-0x0000000007076000-memory.dmp

Download

memory/5116-55-0x0000000000A20000-0x00000000010CE000-memory.dmp

Download

memory/5116-104-0x0000000005A20000-0x0000000005AA7000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads