xworm | c7ca8ab7360335abfd24c031a3e6eca9f2241e650ffad3caae0e361a5769714c

Analysis

user interaction
yes
max time kernel
61s
max time network
73s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
1442.exe
Size 28KB
Sample260509-aev3jsfy3s
SHA256 c7ca8ab7360335abfd24c031a3e6eca9f2241e650ffad3caae0e361a5769714c
MD5 070d580cc3ee8bd7bba0268f953cff9a
SHA1 37db0f82dd66114275757526d3f54400e658dd16
SHA512 39c23e9b226b8073a98dcb1b5ac07f45f053a3835db03295b42489e914792d49b448a5e0c10340061d7d1a21aa5bc4a12af7a8dbbf554233e0e758ba6d747932
SSDEEP 384:71BLpDUYN2Z0u4ocfQYcQzVEI2yKYymNru/ttQ9a9stDLq2OUOOu3LTShQ:npIYN2jcfQjyKtkru/LQIM6hUDhQ
TLSH
T127D2BE2552C54236DBAE0F365C63B39147B2F316ED7B8F7F18D4E12AEEA32488522131
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

lmfao1337.ddns.net:1337

Mutex

UiR5OIZFhVEO2o6k

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/files/0x001a00000002b398-9.dat	family_xworm
behavioral3/memory/3584-18-0x0000000000680000-0x0000000000690000-memory.dmp	family_xworm

Disables Task Manager via registry modification
defense_evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	System32.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.lnk	System32.exe

Executes dropped EXE 3 IoCs

pid	Process
3584	System32.exe
1044	cgqvjg.exe
3324	System32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\System32.exe"	System32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	cgqvjg.exe
File opened (read-only)	\??\I:	cgqvjg.exe
File opened (read-only)	\??\S:	cgqvjg.exe
File opened (read-only)	\??\J:	cgqvjg.exe
File opened (read-only)	\??\K:	cgqvjg.exe
File opened (read-only)	\??\L:	cgqvjg.exe
File opened (read-only)	\??\N:	cgqvjg.exe
File opened (read-only)	\??\Q:	cgqvjg.exe
File opened (read-only)	\??\X:	cgqvjg.exe
File opened (read-only)	\??\A:	cgqvjg.exe
File opened (read-only)	\??\E:	cgqvjg.exe
File opened (read-only)	\??\G:	cgqvjg.exe
File opened (read-only)	\??\H:	cgqvjg.exe
File opened (read-only)	\??\M:	cgqvjg.exe
File opened (read-only)	\??\P:	cgqvjg.exe
File opened (read-only)	\??\R:	cgqvjg.exe
File opened (read-only)	\??\T:	cgqvjg.exe
File opened (read-only)	\??\B:	cgqvjg.exe
File opened (read-only)	\??\O:	cgqvjg.exe
File opened (read-only)	\??\U:	cgqvjg.exe
File opened (read-only)	\??\V:	cgqvjg.exe
File opened (read-only)	\??\W:	cgqvjg.exe
File opened (read-only)	\??\Y:	cgqvjg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	cgqvjg.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Desktop\Wallpaper	cgqvjg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cgqvjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2864	taskkill.exe
4064	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	cgqvjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	cgqvjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	cgqvjg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{B4AB5BE3-6851-4D8D-A20B-2352575BA83E}	cgqvjg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1276	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	System32.exe
Token: SeDebugPrivilege	3584	System32.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeShutdownPrivilege	1044	cgqvjg.exe
Token: SeCreatePagefilePrivilege	1044	cgqvjg.exe
Token: SeIncreaseQuotaPrivilege	1512	WMIC.exe
Token: SeSecurityPrivilege	1512	WMIC.exe
Token: SeTakeOwnershipPrivilege	1512	WMIC.exe
Token: SeLoadDriverPrivilege	1512	WMIC.exe
Token: SeSystemProfilePrivilege	1512	WMIC.exe
Token: SeSystemtimePrivilege	1512	WMIC.exe
Token: SeProfSingleProcessPrivilege	1512	WMIC.exe
Token: SeIncBasePriorityPrivilege	1512	WMIC.exe
Token: SeCreatePagefilePrivilege	1512	WMIC.exe
Token: SeBackupPrivilege	1512	WMIC.exe
Token: SeRestorePrivilege	1512	WMIC.exe
Token: SeShutdownPrivilege	1512	WMIC.exe
Token: SeDebugPrivilege	1512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1512	WMIC.exe
Token: SeRemoteShutdownPrivilege	1512	WMIC.exe
Token: SeUndockPrivilege	1512	WMIC.exe
Token: SeManageVolumePrivilege	1512	WMIC.exe
Token: 33	1512	WMIC.exe
Token: 34	1512	WMIC.exe
Token: 35	1512	WMIC.exe
Token: 36	1512	WMIC.exe
Token: SeDebugPrivilege	3324	System32.exe
Token: SeIncreaseQuotaPrivilege	1512	WMIC.exe
Token: SeSecurityPrivilege	1512	WMIC.exe
Token: SeTakeOwnershipPrivilege	1512	WMIC.exe
Token: SeLoadDriverPrivilege	1512	WMIC.exe
Token: SeSystemProfilePrivilege	1512	WMIC.exe
Token: SeSystemtimePrivilege	1512	WMIC.exe
Token: SeProfSingleProcessPrivilege	1512	WMIC.exe
Token: SeIncBasePriorityPrivilege	1512	WMIC.exe
Token: SeCreatePagefilePrivilege	1512	WMIC.exe
Token: SeBackupPrivilege	1512	WMIC.exe
Token: SeRestorePrivilege	1512	WMIC.exe
Token: SeShutdownPrivilege	1512	WMIC.exe
Token: SeDebugPrivilege	1512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1512	WMIC.exe
Token: SeRemoteShutdownPrivilege	1512	WMIC.exe
Token: SeUndockPrivilege	1512	WMIC.exe
Token: SeManageVolumePrivilege	1512	WMIC.exe
Token: 33	1512	WMIC.exe
Token: 34	1512	WMIC.exe
Token: 35	1512	WMIC.exe
Token: 36	1512	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1612	WMIC.exe
Token: SeSecurityPrivilege	1612	WMIC.exe
Token: SeTakeOwnershipPrivilege	1612	WMIC.exe
Token: SeLoadDriverPrivilege	1612	WMIC.exe
Token: SeSystemProfilePrivilege	1612	WMIC.exe
Token: SeSystemtimePrivilege	1612	WMIC.exe
Token: SeProfSingleProcessPrivilege	1612	WMIC.exe
Token: SeIncBasePriorityPrivilege	1612	WMIC.exe
Token: SeCreatePagefilePrivilege	1612	WMIC.exe
Token: SeBackupPrivilege	1612	WMIC.exe
Token: SeRestorePrivilege	1612	WMIC.exe
Token: SeShutdownPrivilege	1612	WMIC.exe
Token: SeDebugPrivilege	1612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1612	WMIC.exe
Token: SeRemoteShutdownPrivilege	1612	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	cgqvjg.exe
1044	cgqvjg.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1948	4484	1442.exe	80
PID 4484 wrote to memory of 3584	4484	1442.exe	82
PID 1948 wrote to memory of 3840	1948	cmd.exe	83
PID 3584 wrote to memory of 1276	3584	System32.exe	85
PID 3584 wrote to memory of 1044	3584	System32.exe	88
PID 1044 wrote to memory of 1808	1044	cgqvjg.exe	89
PID 1808 wrote to memory of 2864	1808	cmd.exe	92
PID 1808 wrote to memory of 4064	1808	cmd.exe	93
PID 1808 wrote to memory of 1512	1808	cmd.exe	94
PID 1808 wrote to memory of 1612	1808	cmd.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1442.exe
"C:\Users\Admin\AppData\Local\Temp\1442.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1442.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\system32\mode.com
    mode con: cols=100 lines=30
    3⤵
    PID:3840
- C:\Users\Admin\AppData\Local\Temp\System32.exe
  "C:\Users\Admin\AppData\Local\Temp\System32.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System32" /tr "C:\Users\Admin\AppData\Roaming\System32.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1276
- - C:\Users\Admin\AppData\Local\Temp\cgqvjg.exe
    "C:\Users\Admin\AppData\Local\Temp\cgqvjg.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies WinLogon
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' set FullName='UR NEXT'
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where name='Admin' rename 'UR NEXT'
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown /f /r /t 0
        5⤵
        
        PID:4520

C:\Users\Admin\AppData\Roaming\System32.exe
C:\Users\Admin\AppData\Roaming\System32.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a24855 /state1:0x41c64e6d
1⤵
PID:424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 d4d319fd90349128742763ed7f079cfefc8ebb868438126d533a8afde062c4c1
MD5 38978b17e2d6c962fc1b51448debceab
SHA1 72b5565a82f3e9f65c93c0bdd2951311f7cf977b
SHA512 1baf1ccbc3123dca1f4ff4d4fc5ce82a530e6f93097ffa58694d985605e3da92807f0c396af639205672ff8985c815f1412f6f6b774c7b685f8308946a077a27
SSDEEP 768:8f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX09oJImo:8NpZltjYpktMGAKt2hZ
TLSH
T1DAD44037D560B084CF2C75B1E1EC5F0CBE22B10B12E052465F74A67A7A633CA9D1B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1442.bat

Path C:\Users\Admin\AppData\Local\Temp\1442.bat
Size 1KB
SHA256 61378a1ba4700876659848d553fa1caa5a5748ff9255af13cd2f539b3ae1bfdc
MD5 691cb7efa6ca2ceb7455475895dc871b
SHA1 0ec4c83db438dcc469b5fd5b29d04f8efa8b13e5
SHA512 6102d0abbcb24681892bda526bded56d6dcd951dbc3cdabd45eec4d0ef7106fd8873134cf2f5b02e692422c38c6f7f198199e9e597f14b02922b923912f69e8b
TLSH
T1BD31E3613D38D4526CE2DD8B1F7E9497FBA2128F01289DA4B23F09F367046C9799EC64
MD5 SHA1 SHA512 TLSH

Submit Download

System32.exe

Path C:\Users\Admin\AppData\Local\Temp\System32.exe
Size 35KB
SHA256 99552727ef350dcd99949e3fff24f15f291cdb1934ba45b19186e8b164522e7f
MD5 68d56ada5fe011d53f8850b249fdc6ef
SHA1 89542145476e1ec8652ba7089cc36dd664a115ed
SHA512 7a4403e89e6313d4abfea6c724ebeb8ed38ae99b356ee3db001f159710e5e024f7d75a6e97b6b468b889bf87c66e93dc12580554b1e3d6dcea39e22b294e48e5
SSDEEP 768:lkGLMt53p91cw2F5LFy19OkYO/hcyySG:S7TDMTF49OkYO/RG
TLSH
T1BCF25C4937A18726D5ED5FF86A73A2020574F6079D27EB5E0CC885AE7B37BC18A013E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cgqvjg.exe

Path C:\Users\Admin\AppData\Local\Temp\cgqvjg.exe
Size 6.7MB
SHA256 4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47
MD5 d5671758956b39e048680b6a8275e96a
SHA1 33c341130bf9c93311001a6284692c86fec200ef
SHA512 972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7
SSDEEP 3072:V3LA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuzzo9Y:lLJlC6j0CX4XmvWHVcd62uo9
TLSH
T12766F29B5ECC82E2FD3E05314062F676A6647EE903E14FCB62F80D47FA502E56C7119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

one.rtf

Path C:\Users\Admin\AppData\Local\Temp\one.rtf
Size 403B
SHA256 e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690
MD5 6fbd6ce25307749d6e0a66ebbc0264e7
SHA1 faee71e2eac4c03b96aabecde91336a6510fff60
SHA512 35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064
TLSH
T162E0ABB65C82D2C5018D15AA9E5040190F1D8E7AACB6A5CEB40AAC10B2A549C70809D2
MD5 SHA1 SHA512 TLSH

Submit Download

rniw.exe

Path C:\Users\Admin\AppData\Local\Temp\rniw.exe
Size 76KB
SHA256 70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be
MD5 9232120b6ff11d48a90069b25aa30abc
SHA1 97bb45f4076083fca037eee15d001fd284e53e47
SHA512 b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877
SSDEEP 1536:3vosBknP2Uo+GjDZwue3jzFfcdhghUuV+ETNOh:3vVMCcHVcdhghUuzE
TLSH
T134735A83B6C10772C68146B145B23AB6C735973A87269FD7D34C5A07AFA44F1CCB22DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Local\Temp\text.txt
Size 396B
SHA256 38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48
MD5 9037ebf0a18a1c17537832bc73739109
SHA1 1d951dedfa4c172a1aa1aae096cfb576c1fb1d60
SHA512 4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f
MD5 SHA1 SHA512

Submit Download

windl.bat

Path C:\Users\Admin\AppData\Local\Temp\windl.bat
Size 771B
SHA256 b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7
MD5 a9401e260d9856d1134692759d636e92
SHA1 4141d3c60173741e14f36dfe41588bb2716d2867
SHA512 5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6
TLSH
T1FF0128835579212398372F7C93CBEE479014DC1928C44B5739EF686AA7A2454B029BDE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1044-76-0x000000000CF00000-0x000000000CF10000-memory.dmp

Download

memory/1044-80-0x000000000CF00000-0x000000000CF10000-memory.dmp

Download

memory/1044-906-0x0000000001BA0000-0x0000000001C7F000-memory.dmp

Download

memory/1044-903-0x0000000001BA0000-0x0000000001C7F000-memory.dmp

Download

memory/1044-45-0x0000000000B00000-0x00000000011AE000-memory.dmp

Download

memory/1044-46-0x0000000006430000-0x00000000069D6000-memory.dmp

Download

memory/1044-902-0x00000000019D0000-0x00000000019EA000-memory.dmp

Download

memory/1044-79-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/1044-78-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/1044-68-0x000000000C270000-0x000000000C2A8000-memory.dmp

Download

memory/1044-69-0x00000000095E0000-0x00000000095EE000-memory.dmp

Download

memory/1044-72-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/1044-75-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/1044-74-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/1044-73-0x000000000C5D0000-0x000000000C5E0000-memory.dmp

Download

memory/1044-77-0x000000000CF00000-0x000000000CF10000-memory.dmp

Download

memory/3584-21-0x000000001B250000-0x000000001B260000-memory.dmp

Download

memory/3584-31-0x000000001B8D0000-0x000000001C07E000-memory.dmp

Download

memory/3584-18-0x0000000000680000-0x0000000000690000-memory.dmp

Download

memory/3584-22-0x000000001B8D0000-0x000000001C07E000-memory.dmp

Download

memory/3584-44-0x000000001B8D0000-0x000000001C07E000-memory.dmp

Download

memory/3584-23-0x000000001B250000-0x000000001B260000-memory.dmp

Download

memory/3840-20-0x0000018A766D0000-0x0000018A76773000-memory.dmp

Download

memory/4484-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/4484-17-0x000000001B000000-0x000000001B7AE000-memory.dmp

Download

memory/4484-1-0x000000001AFF0000-0x000000001B000000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads