Overview

overview

10

Static

static

1

message_98..._0.eml

windows10-2004-x64

10

message_98..._0.eml

windows11-21h2-x64

1

Sipari=?UT...?=.rar

windows10-2004-x64

1

Sipari=?UT...?=.rar

windows11-21h2-x64

1

Sipariş -...26.vbs

windows10-2004-x64

10

Sipariş -...26.vbs

windows11-21h2-x64

10

email-html-2.html

windows10-2004-x64

7

email-html-2.html

windows11-21h2-x64

8

email-plain-1.txt

windows10-2004-x64

1

email-plain-1.txt

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    898s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/06/2026, 10:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    message_9811_part_0.eml
  • Size 48KB
  • Sample260604-mexmladv5q
  • SHA256 9085c9ed562ee4401ea4b1a96fb6c80a99e8880cab3a833906448f4414773101
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryexecutionxwormratspywaretrojan

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 203.202.232.132:2828

Mutex

  • BHbzRLXXV6MmhGaf

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 1 IoCs
  • Process spawned unexpected child process 8 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 8 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 51 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\message_9811_part_0.eml"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4052
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4244
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Sipariş - 05.04.2026\" -spe -an -ai#7zMap2295:100:7zEvent31920
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4748
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4532
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3080
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2948
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4316
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
          PID:3784
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:908
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
        1⤵
        • Process spawned unexpected child process
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2584
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:548
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
        1⤵
        • Process spawned unexpected child process
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:976
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:4948
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
        1⤵
        • Process spawned unexpected child process
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:976
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2324
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:2812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
        1⤵
        • Process spawned unexpected child process
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1372
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs"
        1⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sipariş - 05.04.2026.vbs' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:5064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& ([ScriptBlock]::Create(${env:INTERNAL_DB_CACHE}))"
        1⤵
        • Process spawned unexpected child process
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4152

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSBuild.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
            • Size 323B
            • SHA256 5a99dc099cb5297a4d7714af94b14f170d8a0506899c82d6b8231a220f8dba5d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Sipariş - 05.04.2026.7z
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\08D2ACFJ\Sipariş - 05.04.2026.7z
            • Size 31KB
            • SHA256 bc4353cae5df38df81a951571f81f97d1edad589e0b556cb9aa3fbf3b4069d3f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ModuleAnalysisCache
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
            • Size 53KB
            • SHA256 2ffd2a7bf78952889c52ff2f0fc490ab6e7570fdbd8afe9790e35eda95cde040
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 cca87ec44c85c441cccd731f2ab08146490b8c30c77473bdb7a8bee0432223e8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 2afe7688a7f8090bba2ad60d5df62c9bfd3b0b82517308b87ce2e458e29551d8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 2d4a39cbbd597a7cfff477817c3c7c541c14974c8d234b4c0de6d229e3a3ce97
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 db34d44a764abe98ab93c23cd7ef48ca8170e362b1123498d672b015946011d0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 1749016c02d7755e330580afb5c2df77b1b81986c11283160c475db095aef431
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 0bcbe921e49d7e8ede4198c0f9e5577c3ee9e6514389b19de22bc5296935de52
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 d67953f22615c8e9de1eb51ee031d4668ce953ea084f671a3531e933af1ec97f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 a28890c82033d3deaf5770ecd1b0239c77321acc93704b1d4b1e167b91e30aeb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 9780e7a93d5d6ab92e2d0c24a613d978bdedd8acab2a7e7bd383121adefd4f9b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 a8a0c273a7e911edb39a0468ac3390e4558d9fa1e6fa774e93f7f2486a4e7986
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 4c7cc81b5376fd63028a6411bb499ccea172008494a04c2e8a3e5a41ce137310
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 f60494dea146d0c046ccb18ed8b99ade3bac0060ace24ab15bca3e27146e432d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_40f3mqhl.ttc.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40f3mqhl.ttc.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            CUSTOM.DIC
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
            • Size 16B
            • SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
            • MD5 SHA1 SHA512
            Submit Download

            Sipariş - 05.04.2026.7z:Zone.Identifier
            • Path C:\Users\Admin\Desktop\Sipariş - 05.04.2026.7z:Zone.Identifier
            • Size 26B
            • SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
            • MD5 SHA1 SHA512
            Submit Download

            Sipariş - 05.04.2026.vbs
            • Path C:\Users\Admin\Desktop\Sipariş - 05.04.2026\Sipariş - 05.04.2026.vbs
            • Size 2.4MB
            • SHA256 5f45b1ee165a750cae48dea599b7ed585fe28b44f4a7e215e62486efa6480513
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2948-202-0x0000000006A20000-0x0000000006AB2000-memory.dmp
            Download

            memory/2948-143-0x0000000000400000-0x000000000040E000-memory.dmp
            Download

            memory/2948-203-0x0000000007070000-0x0000000007614000-memory.dmp
            Download

            memory/2948-151-0x0000000005F10000-0x0000000005F76000-memory.dmp
            Download

            memory/2948-146-0x0000000005810000-0x00000000058AC000-memory.dmp
            Download

            memory/3080-141-0x00000232F41C0000-0x00000232F4274000-memory.dmp
            Download

            memory/3080-142-0x00000232F4020000-0x00000232F402A000-memory.dmp
            Download

            memory/4052-0-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
            Download

            memory/4052-7-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-13-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
            Download

            memory/4052-15-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-12-0x00007FFE0B610000-0x00007FFE0B620000-memory.dmp
            Download

            memory/4052-10-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-2-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
            Download

            memory/4052-49-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-11-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-14-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-9-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-8-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-6-0x00007FFE4D6F0000-0x00007FFE4D8E5000-memory.dmp
            Download

            memory/4052-1-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
            Download

            memory/4052-5-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
            Download

            memory/4052-4-0x00007FFE0D770000-0x00007FFE0D780000-memory.dmp
            Download

            memory/4052-3-0x00007FFE4D78D000-0x00007FFE4D78E000-memory.dmp
            Download

            memory/4524-107-0x00000260D41E0000-0x00000260D4202000-memory.dmp
            Download