Overview

overview

10

Static

static

1

_40f84ae72...352.js

windows10-2004-x64

10

_40f84ae72...352.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    110s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _40f84ae721a13a383e13d18ba0d4cd120db5fe61fae4eefc117347fa6d1a4352.js
  • Size 305KB
  • Sample260702-dalj4abt3y
  • SHA256 40f84ae721a13a383e13d18ba0d4cd120db5fe61fae4eefc117347fa6d1a4352
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionxwormpersistencepyinstallerransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 198.23.177.200:4445

Mutex

  • LrDcyfhc57bMsbC3

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\_40f84ae721a13a383e13d18ba0d4cd120db5fe61fae4eefc117347fa6d1a4352.js
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NonInteractive -NoLogo -File "C:\Temp\ps_J9koZJUlPAro_1782960503717.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5792
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
          PID:2968
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
          3⤵
            PID:5816
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
            3⤵
              PID:2224
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
              3⤵
                PID:5268
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                3⤵
                  PID:2508
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:5464
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_6aa4815a30a84d8cba2e390fb46a321a.cs"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3040
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6306.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC378B2E3CE7D9448B97B474C9FB4B4F3F.TMP"
                      5⤵
                        PID:5508
                    • C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
                      "C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe" 5464
                      4⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4728
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_e6c7ffeceb3148fa9761a794fc050e26.cs"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3460
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDAD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC55A3555950A04902A260A5274996D634.TMP"
                        5⤵
                          PID:1344
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\3nknww4w4bn.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\qj2zqvkbggt.exe'"
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2032
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\epec4lsa\epec4lsa.cmdline"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2388
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E74.tmp" "c:\Users\Admin\AppData\Local\Temp\epec4lsa\CSCF708B41F2BC547CA9AEC90C5884419A4.TMP"
                            6⤵
                              PID:4260
                          • C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\qj2zqvkbggt.exe
                            "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\qj2zqvkbggt.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1240
                            • C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\qj2zqvkbggt.exe
                              "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\qj2zqvkbggt.exe"
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:4840
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /F /IM chrome.exe
                                7⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5696
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /F /IM brave.exe
                                7⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4160
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /F /IM msedge.exe
                                7⤵
                                • Kills process with taskkill
                                PID:3280
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    1⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2640
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    1⤵
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:5328
                    • C:\Windows\explorer.exe
                      explorer.exe /LOADSAVEDWINDOWS
                      2⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:5664
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:3348
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:3732

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        JavaScript

                        1
                        T1059.007

                        PowerShell

                        1
                        T1059.001

                        Persistence

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Active Setup

                        1
                        T1547.014

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Active Setup

                        1
                        T1547.014

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Defense Evasion

                        Modify Registry

                        3
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        2
                        T1120

                        Query Registry

                        3
                        T1012

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        ps_J9koZJUlPAro_1782960503717.ps1
                        • Path C:\Temp\ps_J9koZJUlPAro_1782960503717.ps1
                        • Size 185KB
                        • SHA256 2ab5f710d071ebe465197df0d105c68d4e381cbfbfd465adbe49cb44cff608c3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ModuleAnalysisCache
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                        • Size 67KB
                        • SHA256 9664b478a1e6f74892648d1f9d56900fe55e882d87f24e6b02f2ada2751e8f1c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        prep_Activatable Class_Hermes_perf.cache
                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                        • Size 607B
                        • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        prep_Activatable Class_Hermes_perf.cache
                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                        • Size 599B
                        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        3nknww4w4bn.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\3nknww4w4bn.ps1
                        • Size 1KB
                        • SHA256 99eee43dc235017728b51a9697ac562f2da26f82799c40a1ac6f4bd59ade870b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        qj2zqvkbggt.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_kzxesfja4nh\qj2zqvkbggt.exe
                        • Size 10.1MB
                        • SHA256 61a7989ded8bd5ef9abb110fa66f8579f315946d9ae1c8289e675b0cb1fced6a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        RES2E74.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RES2E74.tmp
                        • Size 1KB
                        • SHA256 b83b97a735532a61f806079bacbec8db3fa5e62743168a0ab1b08995c0822497
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RES6306.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RES6306.tmp
                        • Size 1KB
                        • SHA256 34002352168b989802746f79d7cff83e8753729dc5db417a6d3c277dc28a1a93
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RESDAD.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RESDAD.tmp
                        • Size 1KB
                        • SHA256 e29a79aa192cb0de4a31d23cd5bc0b9e854d34aef1f0e4a66ad906c124e40f23
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        _chacha20.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Cipher\_chacha20.pyd
                        • Size 10KB
                        • SHA256 c47eac09db874fb173a8f92af90bcd51ee2d045357fe225bccf82cd7d26701e5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _raw_aes.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Cipher\_raw_aes.pyd
                        • Size 17KB
                        • SHA256 bc5a926a9001ed94c7b040db1f4986a507379dd3e4ee0102862b2582bdc3db37
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _raw_aesni.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Cipher\_raw_aesni.pyd
                        • Size 11KB
                        • SHA256 b71906a166c3bf344fd2d60f104cebb9519a1cace400da10c5e68bc8764d9f45
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _raw_ctr.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Cipher\_raw_ctr.pyd
                        • Size 10KB
                        • SHA256 f0ab4ea93ca216441a4403715f7a2c8314d261a99aa14b9a6c93faf56e554a8d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _raw_ecb.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Cipher\_raw_ecb.pyd
                        • Size 9KB
                        • SHA256 91c21caf52a213e9c1c48851307b5b7e455d844634a42bce118efda0b41cd871
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _BLAKE2s.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Hash\_BLAKE2s.pyd
                        • Size 11KB
                        • SHA256 630fbfbffb43d7abfa444519f9a95d44fd8e63ae6b0d1207cd8a2eac3dfd2a1b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ghash_clmul.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Hash\_ghash_clmul.pyd
                        • Size 10KB
                        • SHA256 ca8d9594e16da66696b3674c7932263aa6f94e739a76cdb71f60c98a8a9ad23d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ghash_portable.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Hash\_ghash_portable.pyd
                        • Size 10KB
                        • SHA256 9cd7b663918648fec18a87c88356431b53cccf9a7f49da44822490ff224fee02
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _poly1305.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Hash\_poly1305.pyd
                        • Size 11KB
                        • SHA256 387ec446781eb5554ee23cdaafd673c29c5f2412b8f5b713d3d6796964e83819
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _cpuid_c.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\Crypto\Util\_cpuid_c.pyd
                        • Size 9KB
                        • SHA256 10e3fcef5e0b7de6319e8db63a238e9ac4a4632826dd903f1f105d2b988216bc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VCRUNTIME140.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\VCRUNTIME140.dll
                        • Size 117KB
                        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VCRUNTIME140_1.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\VCRUNTIME140_1.dll
                        • Size 48KB
                        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _bz2.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_bz2.pyd
                        • Size 50KB
                        • SHA256 2f26db49a787063a4ce2bce5a90871da8b3e78e3801f6f18e9b345add44991e3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _ctypes.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_ctypes.pyd
                        • Size 64KB
                        • SHA256 2202b5cdacec8b923dffb79438fea65de38831a22ac1ff4a06ca95fc510f6a36
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _lzma.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_lzma.pyd
                        • Size 87KB
                        • SHA256 f60654d44f3d29fd0a487a24b4e8bafc3792116e2c581f53c977a643645e5914
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _socket.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_socket.pyd
                        • Size 45KB
                        • SHA256 37eae46ecdba0091811de4ce84f57224b691b49acc543be45fe0852ca04da53a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _sqlite3.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_sqlite3.pyd
                        • Size 59KB
                        • SHA256 ff9e0d97ecbb28516eadff85865d9a0a42a68f5a4324b10e94404832e00b17aa
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        _wmi.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_wmi.pyd
                        • Size 30KB
                        • SHA256 8bcea63a10547ec7e6dd25c68b97ea8d59a9953dce55798bc1b3354efc271150
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        base_library.zip
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\base_library.zip
                        • Size 1.3MB
                        • SHA256 af3e4f7dfcb438efe43f9730897867d3c4eb1bb023b47196bd2d602a7c10a1ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        libffi-8.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\libffi-8.dll
                        • Size 29KB
                        • SHA256 516743d3e2e8ea88243747060cda2f2fc9174c538a29305d62b830f7bca89d98
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        python313.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\python313.dll
                        • Size 1.8MB
                        • SHA256 425f2d00057beea4a924c413cc801cd7ae90924ac8c927eaec8e41ca18a87a4f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        select.pyd
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\select.pyd
                        • Size 26KB
                        • SHA256 69654034477b0414f1632704f0afbe02d5e34a7972c7cf87c98f27dba37d9a46
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        sqlite3.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\sqlite3.dll
                        • Size 645KB
                        • SHA256 0ad401f5177320d1d2fcaaeee1a9b3ec4c819062928a9021e47c3c4054b7f53d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        __PSScriptPolicyTest_b0sndmy5.nmq.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0sndmy5.nmq.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        aspnet_compiler.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
                        • Size 5KB
                        • SHA256 44f8fb3c975b81941811d4345c58af02f3efa433b8d9d2e92a6427550df096a5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        epec4lsa.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\epec4lsa\epec4lsa.dll
                        • Size 3KB
                        • SHA256 c0bfa11f4fe16c0646bace29804452f2f7e8cb50d6a646884884e8e0e6c12d5f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSC378B2E3CE7D9448B97B474C9FB4B4F3F.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\CSC378B2E3CE7D9448B97B474C9FB4B4F3F.TMP
                        • Size 1KB
                        • SHA256 a90afa9b627d86babfc78e795984727845e59697f765ff7402fdfa883ed7ef79
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSCF708B41F2BC547CA9AEC90C5884419A4.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\epec4lsa\CSCF708B41F2BC547CA9AEC90C5884419A4.TMP
                        • Size 652B
                        • SHA256 71f2445cfcb23b12085969b43543945591d76d07a48d579ffeea82bfd10e23f2
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        epec4lsa.0.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\epec4lsa\epec4lsa.0.cs
                        • Size 268B
                        • SHA256 c1160e5ff5eca52dccd6774dbe1d9f5cc9f2e6931bf37fc8cad913a28b516536
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        epec4lsa.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\epec4lsa\epec4lsa.cmdline
                        • Size 369B
                        • SHA256 60ae7146d1d68342bd2ed73974f9acf6d26c92ae7b84c11056bde8af42922ded
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        guardian_src_6aa4815a30a84d8cba2e390fb46a321a.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_6aa4815a30a84d8cba2e390fb46a321a.cs
                        • Size 4KB
                        • SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/2032-287-0x0000000007830000-0x00000000078C6000-memory.dmp
                        Download

                        memory/2032-266-0x0000000006100000-0x000000000645B000-memory.dmp
                        Download

                        memory/2032-272-0x0000000007CB0000-0x000000000832C000-memory.dmp
                        Download

                        memory/2032-273-0x0000000006AC0000-0x0000000006ADA000-memory.dmp
                        Download

                        memory/2032-269-0x0000000006580000-0x00000000065CC000-memory.dmp
                        Download

                        memory/2032-268-0x0000000006550000-0x000000000656E000-memory.dmp
                        Download

                        memory/2032-263-0x0000000005820000-0x0000000005886000-memory.dmp
                        Download

                        memory/2032-288-0x0000000007560000-0x0000000007582000-memory.dmp
                        Download

                        memory/2032-262-0x0000000005780000-0x00000000057A2000-memory.dmp
                        Download

                        memory/2032-286-0x0000000006B30000-0x0000000006B38000-memory.dmp
                        Download

                        memory/2032-261-0x0000000005950000-0x0000000005F9A000-memory.dmp
                        Download

                        memory/2032-260-0x0000000002D10000-0x0000000002D46000-memory.dmp
                        Download

                        memory/2640-27-0x000001F9AE710000-0x000001F9AE83F000-memory.dmp
                        Download

                        memory/2640-19-0x000001F9AEC30000-0x000001F9AEC78000-memory.dmp
                        Download

                        memory/3348-107-0x0000015E01E10000-0x0000015E01E30000-memory.dmp
                        Download

                        memory/3348-76-0x0000015E001E0000-0x0000015E002E0000-memory.dmp
                        Download

                        memory/3348-122-0x0000015E14210000-0x0000015E14230000-memory.dmp
                        Download

                        memory/3348-92-0x0000015E01E90000-0x0000015E01F90000-memory.dmp
                        Download

                        memory/3348-77-0x0000015E001E0000-0x0000015E002E0000-memory.dmp
                        Download

                        memory/3348-78-0x0000015E001E0000-0x0000015E002E0000-memory.dmp
                        Download

                        memory/3348-90-0x0000015E01A50000-0x0000015E01A70000-memory.dmp
                        Download

                        memory/4728-50-0x0000000000D10000-0x0000000000D18000-memory.dmp
                        Download

                        memory/4840-417-0x00007FFDA1750000-0x00007FFDA175D000-memory.dmp
                        Download

                        memory/4840-431-0x00007FFDA0180000-0x00007FFDA0199000-memory.dmp
                        Download

                        memory/4840-426-0x00007FFDA1760000-0x00007FFDA1787000-memory.dmp
                        Download

                        memory/4840-427-0x00007FFDA6390000-0x00007FFDA639F000-memory.dmp
                        Download

                        memory/4840-428-0x00007FFDA01D0000-0x00007FFDA01E9000-memory.dmp
                        Download

                        memory/4840-439-0x00007FFDA0790000-0x00007FFDA079C000-memory.dmp
                        Download

                        memory/4840-429-0x00007FFDA01A0000-0x00007FFDA01CB000-memory.dmp
                        Download

                        memory/4840-430-0x00007FFDA6380000-0x00007FFDA638F000-memory.dmp
                        Download

                        memory/4840-432-0x00007FFDA1750000-0x00007FFDA175D000-memory.dmp
                        Download

                        memory/4840-433-0x00007FFDA0150000-0x00007FFDA0175000-memory.dmp
                        Download

                        memory/4840-435-0x00007FFDA15B0000-0x00007FFDA15BB000-memory.dmp
                        Download

                        memory/4840-436-0x00007FFDA0130000-0x00007FFDA0142000-memory.dmp
                        Download

                        memory/4840-361-0x00007FFD831D0000-0x00007FFD83834000-memory.dmp
                        Download

                        memory/4840-437-0x00007FFDA0DC0000-0x00007FFDA0DCC000-memory.dmp
                        Download

                        memory/4840-438-0x00007FFDA0800000-0x00007FFDA080C000-memory.dmp
                        Download

                        memory/4840-366-0x00007FFDA1760000-0x00007FFDA1787000-memory.dmp
                        Download

                        memory/4840-365-0x00007FFDA6390000-0x00007FFDA639F000-memory.dmp
                        Download

                        memory/4840-434-0x00007FFD91BC0000-0x00007FFD91D3F000-memory.dmp
                        Download

                        memory/4840-370-0x00007FFDA01D0000-0x00007FFDA01E9000-memory.dmp
                        Download

                        memory/4840-440-0x00007FFDA0120000-0x00007FFDA012C000-memory.dmp
                        Download

                        memory/4840-372-0x00007FFDA01A0000-0x00007FFDA01CB000-memory.dmp
                        Download

                        memory/4840-441-0x00007FFDA0110000-0x00007FFDA011B000-memory.dmp
                        Download

                        memory/4840-377-0x00007FFDA6380000-0x00007FFDA638F000-memory.dmp
                        Download

                        memory/4840-442-0x00007FFDA0100000-0x00007FFDA010B000-memory.dmp
                        Download

                        memory/4840-443-0x00007FFDA00F0000-0x00007FFDA00FB000-memory.dmp
                        Download

                        memory/4840-380-0x00007FFDA0180000-0x00007FFDA0199000-memory.dmp
                        Download

                        memory/4840-444-0x00007FFDA00E0000-0x00007FFDA00EC000-memory.dmp
                        Download

                        memory/4840-425-0x00007FFD831D0000-0x00007FFD83834000-memory.dmp
                        Download

                        memory/4840-383-0x00007FFDA1750000-0x00007FFDA175D000-memory.dmp
                        Download

                        memory/4840-423-0x00007FFD91BC0000-0x00007FFD91D3F000-memory.dmp
                        Download

                        memory/4840-387-0x00007FFDA0150000-0x00007FFDA0175000-memory.dmp
                        Download

                        memory/4840-390-0x00007FFD91BC0000-0x00007FFD91D3F000-memory.dmp
                        Download

                        memory/4840-389-0x00007FFD831D0000-0x00007FFD83834000-memory.dmp
                        Download

                        memory/4840-424-0x00007FFDA00E0000-0x00007FFDA00EC000-memory.dmp
                        Download

                        memory/4840-421-0x00007FFDA0150000-0x00007FFDA0175000-memory.dmp
                        Download

                        memory/4840-394-0x00007FFDA15B0000-0x00007FFDA15BB000-memory.dmp
                        Download

                        memory/4840-422-0x00007FFDA00F0000-0x00007FFDA00FB000-memory.dmp
                        Download

                        memory/4840-400-0x00007FFDA0DC0000-0x00007FFDA0DCC000-memory.dmp
                        Download

                        memory/4840-402-0x00007FFDA0800000-0x00007FFDA080C000-memory.dmp
                        Download

                        memory/4840-399-0x00007FFDA0130000-0x00007FFDA0142000-memory.dmp
                        Download

                        memory/4840-418-0x00007FFDA0100000-0x00007FFDA010B000-memory.dmp
                        Download

                        memory/4840-414-0x00007FFDA0110000-0x00007FFDA011B000-memory.dmp
                        Download

                        memory/4840-413-0x00007FFDA0180000-0x00007FFDA0199000-memory.dmp
                        Download

                        memory/4840-406-0x00007FFDA0790000-0x00007FFDA079C000-memory.dmp
                        Download

                        memory/4840-409-0x00007FFDA0120000-0x00007FFDA012C000-memory.dmp
                        Download

                        memory/4840-408-0x00007FFDA6380000-0x00007FFDA638F000-memory.dmp
                        Download

                        memory/5464-36-0x0000000007550000-0x0000000007B0A000-memory.dmp
                        Download

                        memory/5464-35-0x0000000006EF0000-0x0000000006F82000-memory.dmp
                        Download

                        memory/5464-38-0x0000000006F90000-0x000000000700C000-memory.dmp
                        Download

                        memory/5464-250-0x0000000018680000-0x00000000190D8000-memory.dmp
                        Download

                        memory/5464-249-0x000000000F840000-0x000000001067C000-memory.dmp
                        Download

                        memory/5464-29-0x0000000005AF0000-0x0000000005B56000-memory.dmp
                        Download

                        memory/5464-39-0x0000000007040000-0x0000000007048000-memory.dmp
                        Download

                        memory/5464-25-0x0000000005460000-0x00000000054FC000-memory.dmp
                        Download

                        memory/5464-24-0x0000000000400000-0x000000000040E000-memory.dmp
                        Download

                        memory/5792-23-0x000001F8D4D50000-0x000001F8D4D58000-memory.dmp
                        Download

                        memory/5792-26-0x000001F8D4E00000-0x000001F8D4F2F000-memory.dmp
                        Download

                        memory/5792-52-0x000001F8D4E00000-0x000001F8D4F2F000-memory.dmp
                        Download

                        memory/5792-3-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-18-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-20-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-21-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-9-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-22-0x000001F8D4C90000-0x000001F8D4C9C000-memory.dmp
                        Download

                        memory/5792-16-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-15-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-17-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-4-0x000001F8D4CA0000-0x000001F8D4CC2000-memory.dmp
                        Download

                        memory/5792-2-0x00007FFD8BEFF000-0x00007FFD8BF00000-memory.dmp
                        Download

                        memory/5792-30-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-33-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-34-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-245-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-12-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-7-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-11-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-10-0x00007FFD8BD70000-0x00007FFD8C714000-memory.dmp
                        Download

                        memory/5792-37-0x000001F8D4E00000-0x000001F8D4F2F000-memory.dmp
                        Download