xworm | 37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b

Analysis

max time kernel
179s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contract9021_06_07_26.exe
Size 833KB
Sample260706-ls5ppahs7q
SHA256 37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b
MD5 5053320a66a5c4989c44a932a8720b7d
SHA1 f63c54193c17199031d7826b5ad0660db4ffb6e5
SHA512 b04be55de3d996eaeae43095b1be0b875b3719fc025ebe03a57aebc90f14c33c326401cddef93017f48bea2dbeed084e620585ddb34ce83aaed2fb69b6ccab1c
SSDEEP 24576:DRvV0Ldy2hY+QY/4WeSGQ2LRXv2QEfP5HVLotL9p:DRN0LY2O+QYESH29/bEJdoD
TLSH
T1E3050168675DE801C8210735ADB4E6BC16693E6DBA11D3171FECBEEFB9367168C40382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery evasion execution xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:443

Mutex

70vLmgcqMEnUJOeL

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2544-9-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Contract9021_06_07_26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe
4144	powershell.exe
3192	powershell.exe
1664	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Contract9021_06_07_26.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	Contract9021_06_07_26.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	Contract9021_06_07_26.exe

Executes dropped EXE 9 IoCs

pid	Process
2352	bin.exe
1332	bin.exe
3532	bin.exe
2164	bin.exe
4228	bin.exe
4216	bin.exe
864	bin.exe
1640	bin.exe
2216	bin.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	Contract9021_06_07_26.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/3048-6-0x0000000006BA0000-0x0000000006BBC000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 2544	3048	Contract9021_06_07_26.exe	94
PID 2352 set thread context of 3532	2352	bin.exe	112
PID 2164 set thread context of 864	2164	bin.exe	117
PID 1640 set thread context of 2216	1640	bin.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Contract9021_06_07_26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Contract9021_06_07_26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4144	powershell.exe
4144	powershell.exe
3192	powershell.exe
3192	powershell.exe
1664	powershell.exe
1664	powershell.exe
2544	Contract9021_06_07_26.exe
2544	Contract9021_06_07_26.exe
2352	bin.exe
2352	bin.exe
2164	bin.exe
2164	bin.exe
2164	bin.exe
2164	bin.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	Contract9021_06_07_26.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	2352	bin.exe
Token: SeDebugPrivilege	3532	bin.exe
Token: SeDebugPrivilege	2164	bin.exe
Token: SeDebugPrivilege	864	bin.exe
Token: SeDebugPrivilege	2216	bin.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2544	3048	Contract9021_06_07_26.exe	94
PID 3048 wrote to memory of 2544	3048	Contract9021_06_07_26.exe	94
PID 3048 wrote to memory of 2544	3048	Contract9021_06_07_26.exe	94
PID 3048 wrote to memory of 2544	3048	Contract9021_06_07_26.exe	94
PID 3048 wrote to memory of 2544	3048	Contract9021_06_07_26.exe	94
PID 2544 wrote to memory of 4844	2544	Contract9021_06_07_26.exe	95
PID 2544 wrote to memory of 4144	2544	Contract9021_06_07_26.exe	97
PID 2544 wrote to memory of 3192	2544	Contract9021_06_07_26.exe	99
PID 2544 wrote to memory of 1664	2544	Contract9021_06_07_26.exe	102
PID 2544 wrote to memory of 4464	2544	Contract9021_06_07_26.exe	104
PID 2544 wrote to memory of 1656	2544	Contract9021_06_07_26.exe	108
PID 1656 wrote to memory of 3888	1656	csc.exe	110
PID 2352 wrote to memory of 1332	2352	bin.exe	111
PID 2352 wrote to memory of 3532	2352	bin.exe	112
PID 2352 wrote to memory of 3532	2352	bin.exe	112
PID 2352 wrote to memory of 3532	2352	bin.exe	112
PID 2352 wrote to memory of 3532	2352	bin.exe	112
PID 2352 wrote to memory of 3532	2352	bin.exe	112
PID 2164 wrote to memory of 4228	2164	bin.exe	115
PID 2164 wrote to memory of 4216	2164	bin.exe	116
PID 2164 wrote to memory of 864	2164	bin.exe	117
PID 2164 wrote to memory of 864	2164	bin.exe	117
PID 2164 wrote to memory of 864	2164	bin.exe	117
PID 2164 wrote to memory of 864	2164	bin.exe	117
PID 2164 wrote to memory of 864	2164	bin.exe	117
PID 1640 wrote to memory of 2216	1640	bin.exe	119
PID 1640 wrote to memory of 2216	1640	bin.exe	119
PID 1640 wrote to memory of 2216	1640	bin.exe	119
PID 1640 wrote to memory of 2216	1640	bin.exe	119
PID 1640 wrote to memory of 2216	1640	bin.exe	119

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe

C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe
"C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe
  "C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2544
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Contract9021_06_07_26.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4464
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_3e10fd8d34b34b6e912eed48bade70fa.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DBF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7312861169C14274A8AD282302994FD.TMP"
      4⤵
      PID:3888

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3532

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:864

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Contract9021_06_07_26.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Contract9021_06_07_26.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
TLSH
T104219B303222B5D84D022F530C0869C513EF4759BB64EE2CB959231EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 40b86f0a230b957af4fbd0991aad3a5cc6e03a9a2bb48f1375a849c904f93717
MD5 76c51f4c8512d299f9a95cc432aa4111
SHA1 8870bbf2dcc0a0bb5debe270cc936a79d746db9e
SHA512 2a3184437fa1b5509b5f8ad734189ec80d97ffe5a73e11cfb3bc5b00f673c17a704c0995f74e2f4bdd80be0ed0af4750aed3ceaa4e14ac1df0c9efeb58bd9bbc
SSDEEP 384:wsf+B39i+j5j8bOCJk6xh2T9K6seYwME/t03SoZ5fYSgAjEDk2Q0gdMtkKhD:9fWgy3Kh2T9Nfr2S8W+ED7Cm3
TLSH
T1B082D66E611F16C3C48613B8E11B055FE8F2DD8D531A13D87B1E9F3B8AACA9E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 1361beb1be998fd028503e76d29261aa2f67b52ce94431811c71a1594212bf62
MD5 5be20f33d1641666f788ec57a257b965
SHA1 aee6c87929b3a274d894145fd06c57438e30e8f2
SHA512 7bf8f26a069a0ff3a7114da95e64461422b120f57dfa10467ca04ce4c2b568054efb410063f0885af7b2fb74cc29aab76e9ceb5e8d083ae37723e972e55b5a13
SSDEEP 384:86+BP991puR/B2y3kYbZunT9NcfVLGZcYo8h5DEelq+nUMtkKhi0SO1:9OpuFktT9NUVVYxh5DEEUmri0H
TLSH
T11D821AA9221F6ADBC0B523F4D43747EBDE709DCE930007DE5A8A1E3B05DA27984590EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 3aec29d5bc9b6db015f3582382d9f9150d963c410152cf9ebe859bcf52dcd409
MD5 c9c1e239c234c7b2b244c3fa97e6f158
SHA1 eca404a69db079c9b76ec7dbf537d8f4d5ada0f5
SHA512 7af92fb5561b492cf69f7ce7de33ec89c75ab20514196c9de4874c7c284182255904f97cad311b19e4ba93b30039f7e7dc980356cf3115432ea5ddf100830a11
SSDEEP 384:f6+B/iJqUznGxo4zE+Qeo72qno7LjwP8xKPxf0yU1mR/idcpwjnw75:SKiUUSxy+Qem7nSjw0kZ0DIidV05
TLSH
T15C82D8B74F2D3BB5DA5FCBAB8EEA167D4E1033F69360E1FA0324614604D3663B855061
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1DBF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1DBF.tmp
Size 1KB
SHA256 8720b9f2013b4daebe91279cff8557cfea8a68ec48e39e8b3961b10529940ff0
MD5 25007d51c5caa21f5bc7f5bc27fae5ca
SHA1 68b97bf93ecb35f26cbf1c3d3dcc52e0d419d2d5
SHA512 c22767c858afbf1881634e241e6d8a91eee9f756173beb419140238d26b4aaeeafe31cef5f48565e2694a44f6bf1ca5d2a385092e0435728855edd81744f359f
TLSH
T1FD41024483D84B1FF172473129F74716A674BE95AE9A475DB488132E2F12740DEC36B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4avxoq3j.pzc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4avxoq3j.pzc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 833KB
SHA256 37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b
MD5 5053320a66a5c4989c44a932a8720b7d
SHA1 f63c54193c17199031d7826b5ad0660db4ffb6e5
SHA512 b04be55de3d996eaeae43095b1be0b875b3719fc025ebe03a57aebc90f14c33c326401cddef93017f48bea2dbeed084e620585ddb34ce83aaed2fb69b6ccab1c
SSDEEP 24576:DRvV0Ldy2hY+QY/4WeSGQ2LRXv2QEfP5HVLotL9p:DRN0LY2O+QYESH29/bEJdoD
TLSH
T1E3050168675DE801C8210735ADB4E6BC16693E6DBA11D3171FECBEEFB9367168C40382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7312861169C14274A8AD282302994FD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC7312861169C14274A8AD282302994FD.TMP
Size 1KB
SHA256 171c5cd3554d5f2a55194a07eee017319231355333c22b16e2888039e0487793
MD5 10306a21d28bf669d5e6217c85ead59b
SHA1 636db20879340ac7feb7f480553620a0b53b5110
SHA512 0b513315a446272acd332bfb022d186f9697d5baa4b21079fafb8551a3200284576b22618f8342f82b56505f5a3b00b8d06dd7a7b3605412ec63838c1daf9b91
TLSH
T1E221AD4593E8561EF1B3477039F58363A178BE929C7943DC348C135F2B15A0086836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_3e10fd8d34b34b6e912eed48bade70fa.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_3e10fd8d34b34b6e912eed48bade70fa.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1664-94-0x000000006FC70000-0x000000006FCBC000-memory.dmp

Download

memory/2544-107-0x0000000005690000-0x00000000056A0000-memory.dmp

Download

memory/2544-111-0x0000000007020000-0x0000000007028000-memory.dmp

Download

memory/2544-119-0x0000000005690000-0x00000000056A0000-memory.dmp

Download

memory/2544-120-0x0000000007D30000-0x0000000007EF2000-memory.dmp

Download

memory/2544-9-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2544-110-0x0000000006FA0000-0x000000000701C000-memory.dmp

Download

memory/3048-6-0x0000000006BA0000-0x0000000006BBC000-memory.dmp

Download

memory/3048-7-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/3048-8-0x00000000060F0000-0x0000000006196000-memory.dmp

Download

memory/3048-0-0x0000000000360000-0x0000000000436000-memory.dmp

Download

memory/3048-5-0x00000000050A0000-0x000000000513C000-memory.dmp

Download

memory/3048-4-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Download

memory/3048-3-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/3048-2-0x0000000004E50000-0x0000000004EE2000-memory.dmp

Download

memory/3048-1-0x0000000005400000-0x00000000059A4000-memory.dmp

Download

memory/3192-77-0x000000006FC70000-0x000000006FCBC000-memory.dmp

Download

memory/4144-60-0x000000006FC70000-0x000000006FCBC000-memory.dmp

Download

memory/4844-12-0x0000000004E50000-0x0000000004E86000-memory.dmp

Download

memory/4844-43-0x00000000079D0000-0x0000000007A66000-memory.dmp

Download

memory/4844-44-0x0000000007950000-0x0000000007961000-memory.dmp

Download

memory/4844-45-0x0000000007980000-0x000000000798E000-memory.dmp

Download

memory/4844-46-0x0000000007990000-0x00000000079A4000-memory.dmp

Download

memory/4844-47-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Download

memory/4844-48-0x0000000007A70000-0x0000000007A78000-memory.dmp

Download

memory/4844-42-0x00000000077C0000-0x00000000077CA000-memory.dmp

Download

memory/4844-41-0x0000000007750000-0x000000000776A000-memory.dmp

Download

memory/4844-40-0x0000000007D90000-0x000000000840A000-memory.dmp

Download

memory/4844-39-0x0000000007410000-0x00000000074B3000-memory.dmp

Download

memory/4844-38-0x00000000073E0000-0x00000000073FE000-memory.dmp

Download

memory/4844-30-0x000000006FC70000-0x000000006FCBC000-memory.dmp

Download

memory/4844-29-0x00000000069F0000-0x0000000006A22000-memory.dmp

Download

memory/4844-28-0x00000000064A0000-0x00000000064EC000-memory.dmp

Download

memory/4844-27-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/4844-26-0x0000000005E50000-0x00000000061A4000-memory.dmp

Download

memory/4844-17-0x0000000005500000-0x0000000005566000-memory.dmp

Download

memory/4844-18-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Download

memory/4844-16-0x0000000005460000-0x0000000005482000-memory.dmp

Download

memory/4844-15-0x0000000005580000-0x0000000005BA8000-memory.dmp

Download

memory/4844-14-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download

memory/4844-13-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download