xworm | b88601fb0a108041fd61e63ac47a3be6ae983f41e2a6012fa78d9e42bb642905

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RECONFIRM BANK DETAILZ FOR PAYMENTpdf.vbs
Size 1.2MB
Sample260720-lccc7sfw7x
SHA256 b88601fb0a108041fd61e63ac47a3be6ae983f41e2a6012fa78d9e42bb642905
MD5 8c4b1915975199f7161c543719624b7b
SHA1 fbef3be2bde940131e727abd3e0c67dcb26eeb03
SHA512 5ec4aa6a8cadf9ea84968f323c7b7da5217e1f8614acfab394b833245e06816f38adb050b8824534ee7587f9d600180a2bd60f53dd7e8d564aa4afbed4f887a6
SSDEEP 192:8V8B0yHYj4F01tQQVLraJJtwJJBetyk6M0xzRcfsOjOlxKtrNlV:wmtKxKtrTV
TLSH
T10B557413BE84BC60F7D637A1CDE4259019F89C2BFF9795AA4205A113789BE13E9803D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence pyinstaller rat spyware stealer trojan upx

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4712-17-0x0000000000400000-0x000000000041C000-memory.dmp	family_xworm

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4500	powershell.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	4500	powershell.exe	89

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4452	powershell.exe
10	864	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1104	CasPol.exe
4224	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
3380	DW
1436	DW

Loads dropped DLL 22 IoCs

pid	Process
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe
5152	r03h41f0tj0.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4716	WScript.exe
4988	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4452 set thread context of 4712	4452	powershell.exe	96

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c5a3-174.dat	upx
behavioral2/memory/5152-177-0x00007FFAC3540000-0x00007FFAC3BA4000-memory.dmp	upx
behavioral2/files/0x000d00000001c596-181.dat	upx
behavioral2/files/0x000d00000001c5a0-184.dat	upx
behavioral2/files/0x000d00000001c595-186.dat	upx
behavioral2/memory/5152-185-0x00007FFAE0C20000-0x00007FFAE0C2F000-memory.dmp	upx
behavioral2/memory/5152-183-0x00007FFAE0470000-0x00007FFAE0497000-memory.dmp	upx
behavioral2/memory/5152-189-0x00007FFAE0BD0000-0x00007FFAE0BE9000-memory.dmp	upx
behavioral2/files/0x000d00000001c599-190.dat	upx
behavioral2/memory/5152-191-0x00007FFAE0440000-0x00007FFAE046B000-memory.dmp	upx
behavioral2/files/0x000d00000001c59d-192.dat	upx
behavioral2/memory/5152-195-0x00007FFAE0C10000-0x00007FFAE0C1F000-memory.dmp	upx
behavioral2/files/0x000d00000001c59a-197.dat	upx
behavioral2/memory/5152-199-0x00007FFAE0410000-0x00007FFAE0429000-memory.dmp	upx
behavioral2/files/0x000d00000001c5af-200.dat	upx
behavioral2/memory/5152-202-0x00007FFAE0400000-0x00007FFAE040D000-memory.dmp	upx
behavioral2/files/0x000d00000001c59b-203.dat	upx
behavioral2/memory/5152-206-0x00007FFAE03D0000-0x00007FFAE03F5000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b0-205.dat	upx
behavioral2/memory/5152-209-0x00007FFAC9820000-0x00007FFAC999F000-memory.dmp	upx
behavioral2/memory/5152-208-0x00007FFAC3540000-0x00007FFAC3BA4000-memory.dmp	upx
behavioral2/memory/5152-230-0x00007FFAE0360000-0x00007FFAE036C000-memory.dmp	upx
behavioral2/memory/5152-229-0x00007FFAE0C10000-0x00007FFAE0C1F000-memory.dmp	upx
behavioral2/files/0x000d00000001c585-228.dat	upx
behavioral2/memory/5152-227-0x00007FFAE0370000-0x00007FFAE037C000-memory.dmp	upx
behavioral2/memory/5152-226-0x00007FFAE0440000-0x00007FFAE046B000-memory.dmp	upx
behavioral2/files/0x000d00000001c569-224.dat	upx
behavioral2/memory/5152-223-0x00007FFAE0380000-0x00007FFAE038C000-memory.dmp	upx
behavioral2/files/0x000e00000001c557-221.dat	upx
behavioral2/memory/5152-220-0x00007FFAE0390000-0x00007FFAE039C000-memory.dmp	upx
behavioral2/files/0x000e00000001c55a-218.dat	upx
behavioral2/memory/5152-217-0x00007FFAE03A0000-0x00007FFAE03B2000-memory.dmp	upx
behavioral2/memory/5152-216-0x00007FFAE0470000-0x00007FFAE0497000-memory.dmp	upx
behavioral2/files/0x000e00000001c559-214.dat	upx
behavioral2/memory/5152-213-0x00007FFAE03C0000-0x00007FFAE03CB000-memory.dmp	upx
behavioral2/files/0x000d00000001c591-211.dat	upx
behavioral2/memory/5152-231-0x00007FFAE0410000-0x00007FFAE0429000-memory.dmp	upx
behavioral2/memory/5152-232-0x00007FFAE0350000-0x00007FFAE035B000-memory.dmp	upx
behavioral2/memory/5152-233-0x00007FFAE03D0000-0x00007FFAE03F5000-memory.dmp	upx
behavioral2/memory/5152-234-0x00007FFADEE50000-0x00007FFADEE5B000-memory.dmp	upx
behavioral2/memory/5152-237-0x00007FFADED40000-0x00007FFADED4C000-memory.dmp	upx
behavioral2/memory/5152-236-0x00007FFADED50000-0x00007FFADED5B000-memory.dmp	upx
behavioral2/memory/5152-235-0x00007FFAC9820000-0x00007FFAC999F000-memory.dmp	upx
behavioral2/memory/5152-242-0x00007FFAE0BD0000-0x00007FFAE0BE9000-memory.dmp	upx
behavioral2/memory/5152-252-0x00007FFAE0380000-0x00007FFAE038C000-memory.dmp	upx
behavioral2/memory/5152-253-0x00007FFAE0370000-0x00007FFAE037C000-memory.dmp	upx
behavioral2/memory/5152-258-0x00007FFADED40000-0x00007FFADED4C000-memory.dmp	upx
behavioral2/memory/5152-257-0x00007FFADED50000-0x00007FFADED5B000-memory.dmp	upx
behavioral2/memory/5152-256-0x00007FFADEE50000-0x00007FFADEE5B000-memory.dmp	upx
behavioral2/memory/5152-255-0x00007FFAE0350000-0x00007FFAE035B000-memory.dmp	upx
behavioral2/memory/5152-254-0x00007FFAE0360000-0x00007FFAE036C000-memory.dmp	upx
behavioral2/memory/5152-248-0x00007FFAC9820000-0x00007FFAC999F000-memory.dmp	upx
behavioral2/memory/5152-251-0x00007FFAE0390000-0x00007FFAE039C000-memory.dmp	upx
behavioral2/memory/5152-250-0x00007FFAE03A0000-0x00007FFAE03B2000-memory.dmp	upx
behavioral2/memory/5152-249-0x00007FFAE03C0000-0x00007FFAE03CB000-memory.dmp	upx
behavioral2/memory/5152-247-0x00007FFAE03D0000-0x00007FFAE03F5000-memory.dmp	upx
behavioral2/memory/5152-246-0x00007FFAE0400000-0x00007FFAE040D000-memory.dmp	upx
behavioral2/memory/5152-239-0x00007FFAC3540000-0x00007FFAC3BA4000-memory.dmp	upx
behavioral2/memory/5152-243-0x00007FFAE0440000-0x00007FFAE046B000-memory.dmp	upx
behavioral2/memory/5152-245-0x00007FFAE0410000-0x00007FFAE0429000-memory.dmp	upx
behavioral2/memory/5152-244-0x00007FFAE0C10000-0x00007FFAE0C1F000-memory.dmp	upx
behavioral2/memory/5152-241-0x00007FFAE0C20000-0x00007FFAE0C2F000-memory.dmp	upx
behavioral2/memory/5152-240-0x00007FFAE0470000-0x00007FFAE0497000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4452	powershell.exe
864	powershell.exe
5660	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001000000001c551-108.dat	pyinstaller

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DW
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DW

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
712	taskkill.exe
5064	taskkill.exe
5728	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	Caspol.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
4712	Caspol.exe
4712	Caspol.exe
864	powershell.exe
864	powershell.exe
864	powershell.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe
1104	CasPol.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	4712	Caspol.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	1104	CasPol.exe
Token: SeDebugPrivilege	5660	powershell.exe
Token: SeDebugPrivilege	712	taskkill.exe
Token: SeDebugPrivilege	5064	taskkill.exe
Token: SeDebugPrivilege	5728	taskkill.exe
Token: SeDebugPrivilege	5152	r03h41f0tj0.exe
Token: SeDebugPrivilege	5152	r03h41f0tj0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	conhost.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 5904	2564	conhost.exe	94
PID 4452 wrote to memory of 5508	4452	powershell.exe	95
PID 4452 wrote to memory of 4712	4452	powershell.exe	96
PID 4452 wrote to memory of 4712	4452	powershell.exe	96
PID 4452 wrote to memory of 4712	4452	powershell.exe	96
PID 4452 wrote to memory of 4712	4452	powershell.exe	96
PID 4452 wrote to memory of 4712	4452	powershell.exe	96
PID 4712 wrote to memory of 4724	4712	Caspol.exe	97
PID 4712 wrote to memory of 4988	4712	Caspol.exe	100
PID 4712 wrote to memory of 1532	4712	Caspol.exe	101
PID 1532 wrote to memory of 5732	1532	csc.exe	105
PID 4712 wrote to memory of 1104	4712	Caspol.exe	106
PID 4712 wrote to memory of 6104	4712	Caspol.exe	108
PID 6104 wrote to memory of 5656	6104	csc.exe	110
PID 4712 wrote to memory of 5144	4712	Caspol.exe	111
PID 5144 wrote to memory of 2420	5144	csc.exe	113
PID 4712 wrote to memory of 4320	4712	Caspol.exe	114
PID 4320 wrote to memory of 1156	4320	csc.exe	116
PID 4712 wrote to memory of 5660	4712	Caspol.exe	117
PID 5660 wrote to memory of 4180	5660	powershell.exe	119
PID 4180 wrote to memory of 3376	4180	csc.exe	120
PID 5660 wrote to memory of 4224	5660	powershell.exe	121
PID 4224 wrote to memory of 5152	4224	r03h41f0tj0.exe	122
PID 5152 wrote to memory of 712	5152	r03h41f0tj0.exe	123
PID 5152 wrote to memory of 5064	5152	r03h41f0tj0.exe	125
PID 5152 wrote to memory of 5728	5152	r03h41f0tj0.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RECONFIRM BANK DETAILZ FOR PAYMENTpdf.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:illui"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  PID:5508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DW" /tr "C:\Users\Admin\AppData\Local\Temp\DW"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4724
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hmhgnv.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_694b9b7a8f814381ba85114b956f4d5a.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2AB0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3B4181D369A740EF8A196E29EBDB86.TMP"
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 4712
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_38f711e456b04c30890b2edde2848b1b.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8851.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC986191BF4F649EF808B965F9CC07A55.TMP"
      4⤵
      PID:5656
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_1e4f84e319e54a138223d2f47304c1b9.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A64.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7AE35E1CE32F4AFBA61ED387FE7A1C6B.TMP"
      4⤵
      PID:2420
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_13b9083a461e4117a5edf1e69bfe98f2.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9428.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC442E6734D7549FFB130E93B8F8A78D.TMP"
      4⤵
      PID:1156
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\vz4d1tifonj.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\r03h41f0tj0.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3gnnxgyb\3gnnxgyb.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB53D.tmp" "c:\Users\Admin\AppData\Local\Temp\3gnnxgyb\CSC99EE6946ECAF4BA694FE77415FE508D.TMP"
        5⤵
        
        PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\r03h41f0tj0.exe
      "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\r03h41f0tj0.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\r03h41f0tj0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\r03h41f0tj0.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5152
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:712
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5728

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:5904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:streptothricin"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Users\Admin\AppData\Local\Temp\DW
"C:\Users\Admin\AppData\Local\Temp\DW"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3380

C:\Users\Admin\AppData\Local\Temp\DW
"C:\Users\Admin\AppData\Local\Temp\DW"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 04c13abe17cc561d4978c1e00ddb0f0f0d3a7256b1aa1a9ee5562dbf4718319e
MD5 5e9397611ef2fac4437d0419e26e3811
SHA1 7f09432c5f7008cd8736378650202f9608ede5b7
SHA512 8722072f3b32ab074cd367dabf01ed0088bb61c3aeeec37dbb0a501e0b286dcdd2e4ae9e87dd5a9d4002999e02ae981bc18f8d4ff825e46c0fd221078c199b4c
TLSH
T151218673F3CC8614DC9A403600CEAC1036B687DB409ECE5BBB84D248A42F698DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
MD5 f623929fbf303a8b140095d9568ac988
SHA1 8c39ae9758011dabd587c6f4ae7a63b11343106d
SHA512 a75f1a30783549196144f66a43688f6eda179859f804ced37e03a1ee4d445e87466f1f43b6288dfe775833f9cda36e23ce2796a771515202691ae59162d6efe6
TLSH
T1F7215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

3gnnxgyb.dll

Path C:\Users\Admin\AppData\Local\Temp\3gnnxgyb\3gnnxgyb.dll
Size 3KB
SHA256 c7e030b819c5950504b3d23891466e4a8e3bd4088c56225396547abaa35270fc
MD5 bfb2242b72ef858f975bf63bf032b61b
SHA1 70e14f1b8fefb544cf39481820567d86132264eb
SHA512 1c7ad019496590cc1d8d96e584c827f7a3eb866f9790747aee9ef61c2cc92c7a8fb58c6a3e7aa6660d2353b81c2a0b6f93b4a6a1cf75f537bea7b43c2fbcf333
TLSH
T16551991AA3E84A2BE4670730ADE3431637B8FC549FB3575E19804229ACA57545E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 1c9effdf2bb2c8305ff08e643dee80a5f0456fdc61a36fd39f16dc0e630ea344
MD5 b314dd58412c534493b7ea26aea4a2ff
SHA1 93dae06fca3d4fd73a31e46586f83cadf8de4404
SHA512 b953ae3d41753b8dc95b4af11468fd9a7cc65e0fd8036562777418546939eb7e89f537e047c1fe1d077787bc489df1468293bf06589b30b94b5f3ab0206f6c01
SSDEEP 96:qdew7V9qOOoT8BynqgHlNxNEb7yKk2zNt:qv2OOWoyqgHjob70Q
TLSH
T13BC1A287979C4366E0620731B8B303512778E9225B6BABAF24E4137A3EB639009573F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r03h41f0tj0.exe

Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\r03h41f0tj0.exe
Size 10.1MB
SHA256 61a7989ded8bd5ef9abb110fa66f8579f315946d9ae1c8289e675b0cb1fced6a
MD5 3b310dc53796b40fc76eed863cd15ae8
SHA1 2741a6acbb5099cd1875faa5197e634870eccb66
SHA512 080de9cdc692e600cfffc32c6631865f0e2ae8d5f0583eeba1686c0455f5b9557f6d88d4d360a771630db39eb4a8bbf185212b4b46973fba2791df18c4779be2
SSDEEP 196608:l20fS8CIVwfI9jUCW6rlaZLH7qRGaIYQoF/s8LTGNrmhnRtECdemZEM:l2oSuaInD0d/YVF/5VdeJM
TLSH
T143B633966AC004F6E8E7A939E8D396128B31BEB017D0C7DB42546B3A1F231F154B9F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vz4d1tifonj.ps1

Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_3eieonc5ddq\vz4d1tifonj.ps1
Size 1KB
SHA256 c259a215dbb00527e01047e80f906dae88f9a4e1043387f99659da4d04c9112e
MD5 a50fcd23bae71688d009cafc0258187a
SHA1 8692288ee121c5ebf4168ad583c1939faba74a2c
SHA512 dc4192c3c0862d569c6e7232acacf15ef0b6cf758e25f3a7f57482eb16d8e3fa00e0475025375189012e3996e387a3b2b2b4b81e2c7771ed92798c73738b3977
TLSH
T16C2110857AE6A72285324B084E46D395C51F123620A3250077EC8341FF7869FC669BDD
MD5 SHA1 SHA512 TLSH

Submit Download

RES2AB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2AB0.tmp
Size 1KB
SHA256 36ec6e55f442e508de08b6c5548d9d6848fca0d01de75ce38d9da3e61fe0a915
MD5 80ca7bd0ece4dc52d38a6209d61c23ca
SHA1 9cd4d160ae6f9341b2b9d875b6e6b93fd609f3b3
SHA512 672d0f99fe0b1fc93bd18d09bacb8a9e97c98e10a24db618a5e971bf3efc86617065380453b298ace3780ecbad4c02fee4ad56c620a86a4661ca6e29b64061ec
TLSH
T16841114193E84B1EE172473168F78715A678FE659FAA436D7484122E1E12780DE836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES8851.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8851.tmp
Size 1KB
SHA256 6c7221c5afe0cd501c30eba3168a6d11f7ec4b38a595b82d62e41aa1e8dc57bc
MD5 47dacc675c657d7ca93b258ab5dc47ce
SHA1 ca6576b3e48c14cb20c980710e6c1fc8ee462d45
SHA512 427908135db20ca72c936966ea3b6eb725cc0322f823d7f1c1a82a523c592eaf3bf3a5e743daf4ce5f99299f4959aaf92c55e421607f2577e1f1c9f8e7b05e75
TLSH
T19641114183E84B1EE172573168F75715A278FE669FAA475D74C8122F1E02740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES8A64.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8A64.tmp
Size 1KB
SHA256 a067302aee09d86869fcd100eca84fe645b78d91d94dbf195fc246b9b5c7c4b0
MD5 cebd3d63e52efdb7e982cd5d7a41abed
SHA1 8c4c9ec4132dc35c118b489f8f2c2808173d25c9
SHA512 cafad5a2dc43720cb423d345abd1b7afe055b8f604d5ee7021d1905bbdd1d3b7c8b6d3ab3ac251f2d9e97ca0b85dbc9ae510b5660f20589d5a84487dd0452011
TLSH
T1CD41314183E84B1FE172073168F78315A234FE65AFAA436D7488122F2F02740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES9428.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9428.tmp
Size 1KB
SHA256 bb3a272f5987376230de7ad3a709a3d31dac39a28aa9b75aeeb2e916a0d16244
MD5 dd0c38d27c57989630ac861ffe64ea85
SHA1 02837d899d53b7a7db58c697872c9184d88844ac
SHA512 d070fd63cb68706d3b5d34b5396b2504c5a942d2f842c392a82823d85c93aca81811683857431196cdd9170a49cef4d0f0d48717eb5e0443df9a45697a81ab36
TLSH
T1AA41310183E84B1EE172073128F78715A238FE659FAA436E7488132E1F12780DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESB53D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB53D.tmp
Size 1KB
SHA256 cb3c08bba8d750bdbd01552ad2ede142d9c6cdb86e0af46e6924a79249610d48
MD5 bfc5d19a8707daf56ea22b49e758f7cf
SHA1 500d045867491465c25811e677100d1acf6d3838
SHA512 f7ff7c94cecad4db3be2b5e0256960a748ece0f733a987c5b6f01c13d33be9219f37b7326320d3d79fe3c61efa09285f9483b8f03b80d533ced210182102a653
TLSH
T13A21C20553E9471FF077473169FA036B9374FD59EFB2535B454002291C61200DFA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

_chacha20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\Crypto\Cipher\_chacha20.pyd
Size 10KB
SHA256 c47eac09db874fb173a8f92af90bcd51ee2d045357fe225bccf82cd7d26701e5
MD5 9cac6634d0c505275e81ce1d0d444083
SHA1 36c44f0f4a86f6f2cb84d80afeaf5cffd8829fb7
SHA512 513fc7b8387f167025f45b65678953ea9930804a2b96cf8e604f4a923f5811eae7fc94a70ed6cb4c83ec0a6e4a284c47f0217c099e43bf42528b0254a1ff556b
SSDEEP 192:8QMgWcmpbVnK8V0e4Eg0pCkeDa+QzEIJillcKkYj273QJXhnNAkc9lk:ecMVae4EgHDa+uEIJ1KZa7gJX3/c9
TLSH
T1EE227CDB531AE0FCC85644B309A78988BF713C33A6125F0F19D4217FADB3EA46A10631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\Crypto\Cipher\_raw_aes.pyd
Size 17KB
SHA256 bc5a926a9001ed94c7b040db1f4986a507379dd3e4ee0102862b2582bdc3db37
MD5 940476bb647158428febd1e68d2178d6
SHA1 c0dfc1ffee7595f432f7127e3236e1f3e43247ca
SHA512 6ece420809c741b214b3c6d4bfb92731183ab47d3e05490ae56f77d5dd4aed7e3afad5255853f408396826e43d61be39b312f1c299b2770b1d2b7c6d37368358
SSDEEP 384:/KO4ybrS6X6d0Gtbdc/4xOxmOq4JAQnpvnOIh+duZa7gJX8CS://tKvcg4IOqkAMpvDpMCS
TLSH
T1F372AFE5A2BEC8FCC8B560320CE25969F7217B6B6413031F0590267E5EB3D541F36B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\Crypto\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 b71906a166c3bf344fd2d60f104cebb9519a1cace400da10c5e68bc8764d9f45
MD5 66e11637a30e0a6ac5503007fa973558
SHA1 2c6a7caffc86b28f7612840b84c00df863253071
SHA512 27f9b9cb1e399ca3f5ed0cd17879f244c75a5ea0fd3508781a4975741e158230bd8369ff2c27d3377956b8f7e67c7941100570388dd13efc60742eabbe2ab564
SSDEEP 192:atpdrvzmhp8BShP1nmQ2Ia+hyKnhSqwT4RRL4MDkYj273QJXlEnLU:uLl0hP/vLys0q+4gMDZa7gJXW
TLSH
T109329ED78219EAFCC4B674B358A75A94FB323436112A9B2F08C9377E9CB76143020774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\Crypto\Hash\_BLAKE2s.pyd
Size 11KB
SHA256 630fbfbffb43d7abfa444519f9a95d44fd8e63ae6b0d1207cd8a2eac3dfd2a1b
MD5 0c1dd6c924463d7a4114c94422eace37
SHA1 7f568932f79b0af09f67797bb9dbe633c8b64806
SHA512 dad1b6c39e0c4c334aba55f35e89e7d7650f4a37f42d2c770700215dd381e0f69be4d51df8a7ebc24332398a0df34cec40c8d95f5e23f2c6ed30555ef8f23730
SSDEEP 192:wDPewzRKCnCLrNy++19mdxJnPAnARooC32/bdkYj273QJXbniA3P:kPewzaLrI++7mFPyARfdZa7gJXOc
TLSH
T138325DE7C2D6E97CC876AAB608675848E7317C279205571F09A431BF5CB2A923A30773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_poly1305.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\Crypto\Hash\_poly1305.pyd
Size 11KB
SHA256 387ec446781eb5554ee23cdaafd673c29c5f2412b8f5b713d3d6796964e83819
MD5 014e57265accb1efccc8cc812fa177ad
SHA1 42e3031daf796074976da780d2e9232ab89417aa
SHA512 896c1cb8b6152ea5286490f92598699cb8775504ec68db11d91686f1972ee8f58349a858ae202ec342f5b5cbeb193f029d2b2fd729e873ef01e9077c3c1c4db0
SSDEEP 192:snUIoSVglOuObZmA8ZShML/8kCZODhYgbQGWPYkYj273QJXZnqg:DRlOuObZ857NSODh5xaYZa7gJX8
TLSH
T143327DEB5A46D6B8C56B5CF1186A8CC8FB7A7813A512671F68F036FF0CF72542920630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\Crypto\Util\_cpuid_c.pyd
Size 9KB
SHA256 10e3fcef5e0b7de6319e8db63a238e9ac4a4632826dd903f1f105d2b988216bc
MD5 b5032e108fb3bdb47bed67a1fea60e54
SHA1 9a14c8f44f167c4c0ffebc67b2b58b93c6cb1986
SHA512 43b97e3514d0d0305ecf475f5954ce4f4e980477ea64bad13756ead775eeed3c56959aca9d6a2b38ebc1d2930409a43392a446ec87586b2ab94df82757b1d987
SSDEEP 192:dkSlQHLyJVf5DoE+uJL72iD5UR9rGHcO4rhkYj273QJXpHzI:qSGoVf9L7DD569q8OkhZa7gJXZI
TLSH
T187124CF7937EF2FCC53654B60A4A4858FA65F83BD222131F01E532FA4CA62527D22271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\_bz2.pyd
Size 50KB
SHA256 2f26db49a787063a4ce2bce5a90871da8b3e78e3801f6f18e9b345add44991e3
MD5 9effb75170147c0fa5897f8e57a7a45c
SHA1 5380e27884fa621f8a3d6e720fd575f789026837
SHA512 dd5ab5189a05977a73c6dca79a24eb564576623d62a7d18fdcbdd30908fe8c36ca99be33002d752ba612de3e4e7514d3ddb7f6f36cc0001d92fdbb3be61c90b4
SSDEEP 1536:4TvumeSe2uD4e4elWrlkIDLVzZ7yo47Q9M/fITjNO:GvxeSeVd4elsGIDLVzZkY1O
TLSH
T16433D0CA83BA8057EF9369B191E0E8DBFE353BD39814421A3099B59A1E537C1C71133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\_ctypes.pyd
Size 64KB
SHA256 2202b5cdacec8b923dffb79438fea65de38831a22ac1ff4a06ca95fc510f6a36
MD5 4a8c4df330385606331fbbbd580dd51c
SHA1 aa7416ca1c731411e911c37571610a6b031badf7
SHA512 7a591e86340e72b3ed2dcac61b86de96ac02e3c19cb4e61cee762b915194433631b7e85b82e74004c2eabb0e0ae200c2c8b6e46065996e64cca15b7e8f33b9be
SSDEEP 1536:gZADR3OqwGETEepRgi29lY68KULvIDyPI37yo47Q9efITKE2:gWDVCGMEmgRJUzIDyPI33f2
TLSH
T17E53D0C249698027EB238FB1A2D2C9C7B9387B639120467A51E522715B577E4F337328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\_lzma.pyd
Size 87KB
SHA256 f60654d44f3d29fd0a487a24b4e8bafc3792116e2c581f53c977a643645e5914
MD5 7b6cd4cee5a7ae3bc97207c6b7860924
SHA1 88001ebe8fcea1f4513f35e8137b3cf7e5fb2a13
SHA512 e0e19e801e20842a80b11821725012a85a9b428500e69a13f95a6747eec738323e14e22e3da286ff897f678946cf97b5c1373b35ec00460f8b7ae70d10c53ca9
SSDEEP 1536:zE29OZvi4bwTlI+rWNp+UavAZauaND+cJyBvNMRq/2ID01497yo47Q9gfIbvFFZ:lMviSJj+Jea7RytGvID0149p5f
TLSH
T1999302C5DFB48017D991DDB196E0DA82B4B4B3EB5C70D88F30AA95A60D533D0E748B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\_socket.pyd
Size 45KB
SHA256 37eae46ecdba0091811de4ce84f57224b691b49acc543be45fe0852ca04da53a
MD5 3523c31b27e716a16860cc8a5bd5ee73
SHA1 d9f0c2ad6eb6ad9febf8a312e6d0daf25eb06de1
SHA512 6f7db177cb0c98d9021e40c7729a02d94446c4a4454a259ae4810c6b16b39521317aec83d11089d7318208591800cdc36de660fc57f735065aac832cc7898e78
SSDEEP 768:IVO07RbhED2LEIuo4OCYvmDrzbKXh4sSpuu7QptTnIDywjmRQ+Eyobo+Y7N2Ip4f:6PkD2LEIuo4EsAtSplKTnIDywjma7yo7
TLSH
T19F23D0DA86FC905AF6429BB252E4D990FB34BB939840C71F30E6516B4C537C0E71627D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\_sqlite3.pyd
Size 59KB
SHA256 ff9e0d97ecbb28516eadff85865d9a0a42a68f5a4324b10e94404832e00b17aa
MD5 0de94e91892efd4aeb396947e7086d65
SHA1 d8546478c46d4a95cc5c819e4f6c7722a1d05b16
SHA512 44d5f2d6a7e6e2583153a5445518bfeb8349bf5ca25bdc82f02916270ff372f18f291240b426800f4c19b5f7916750adb310aa7f2df504c9e6fdaebfc9d19edc
SSDEEP 1536:EjbxuYH/ubG5c+D4aBRYjia2DaaAUaF6IDvQDF7yo47Q9e0fIbF/:wbUYH/MoZDB/DpAUaoIDvQDFqZ
TLSH
T10E53E1C949BC4049EE53AFB292E1F5C2FD74E7D394778F5F6097A2290E92340A305366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\_wmi.pyd
Size 30KB
SHA256 8bcea63a10547ec7e6dd25c68b97ea8d59a9953dce55798bc1b3354efc271150
MD5 2980fe5727634871a69ed4992afffd66
SHA1 4a7920befb95df4a49f51ec9001e59fc2f53e16c
SHA512 ea975bf3f132f1eb6f82b44ac181893ae0acbbbc039135e8d3466736aa49f6b78b24be6bdfc7ef5933d0fdd9f9ecd77274157ecf9209959b065dec31c1279e26
SSDEEP 768:/uIi2GqkkJXzrpl7IIDLiOmQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/uIicX77IIDLiOn7yo47Q98fIW44D8rr
TLSH
T135E2AFDB853C8166EE93AE7162E5DD82F834BBD39411461B30DA62EA0D673C0E316339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\base_library.zip
Size 1.3MB
SHA256 af3e4f7dfcb438efe43f9730897867d3c4eb1bb023b47196bd2d602a7c10a1ef
MD5 e024d486afd8ec4d0c4ec7798dc5bad4
SHA1 7c3d29b5778f2dae842d735287c774e712553732
SHA512 6be98a6d6eea51afe1adf5c2cd93a14352257060aeb4dc17567d236ab08343762776687e8de580ea2190feed8a75aaca30e523706a69691e85e9737fa8a7ec1b
SSDEEP 12288:x6TL+Dci2W7WpfuOBa80201jwCVRDVoioSYB/i2cPPdxhYqPaQrZ56RjZXqtYzGF:37Wpfz/5cPPdxhYbSeT1GJdZ+LJit
TLSH
T177550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\libffi-8.dll
Size 29KB
SHA256 516743d3e2e8ea88243747060cda2f2fc9174c538a29305d62b830f7bca89d98
MD5 658fa8b1b9e9bd4f57607507c2b2508a
SHA1 0fcd0e582132141eb45ea5e0228b030db4a22528
SHA512 555906c7ad0cd7ccaa4337314272d9568e1e1ed0e32d6b5fcc3d9a3a0226400a3723c1b136168e4de8049a40bf5090d5d3148e15f26140b27bbdeeb2dce98535
SSDEEP 768:op/6aepjG56w24Up3p45YiSyvkIPxWEqG:qA154spK7SytPxF
TLSH
T199D2CFB34521BC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\python313.dll
Size 1.8MB
SHA256 425f2d00057beea4a924c413cc801cd7ae90924ac8c927eaec8e41ca18a87a4f
MD5 e0a9948b92524e2dec22ae62c9da511c
SHA1 30ee8784b1948ee57a28b29bbb920c84c2da433c
SHA512 658e3f75be217b701f5fdd8cc8f36e69d911b61331bcd4755c0991312791f188716a92c825baa185fabdbf033e13c35b8257acdc5a15a89e2e3a1a596c891bf2
SSDEEP 49152:xCVE4q6qI1HNZYzIUJQTNOT9ZhXzXFWnJaeiZkYxaKE:xduqi5xOZZxzVRe6bI
TLSH
T195853333ADCE45F3D5DB56B193DBEF111D2EAA43911D42C5D890EA930E87620172BB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\select.pyd
Size 26KB
SHA256 69654034477b0414f1632704f0afbe02d5e34a7972c7cf87c98f27dba37d9a46
MD5 c3fc7efde1366631e2e6ff149186141c
SHA1 a5d5649fb1da08415c4e7640b89cf0d90d1ad551
SHA512 dbcf495bc85a3fac3c80570ba0482a56d1d461d2b6bdac827c0cec99aa1cafa898dc775576286e06fb592d4e74b62858640d35de17e2aa674d68a761f316f53c
SSDEEP 768:VaWKrKpYrmID9GuOQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:0lrprmID9Gu/7yo47Q9S+fIir
TLSH
T1E5C2BFCE067C9257DE63AAB141E0DD92FD38B7835914828F30DDA1BA0D533D1A31A37A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42242\sqlite3.dll
Size 645KB
SHA256 0ad401f5177320d1d2fcaaeee1a9b3ec4c819062928a9021e47c3c4054b7f53d
MD5 2428c9e3e6177545e8404a2fcb5e740e
SHA1 a9f7226f79bccc442d93e78f09fc60333ce6deeb
SHA512 1b62e39a66df88ca05826bc49ffbf8739451a2438e1f4a4851684ba8620664a9fd17057d4074843da079a3db38e358d387ae35b74e10b9d98d9affe1cde37763
SSDEEP 12288:GpZ29aLlU2+a9Li5EMtSJS3mIgwgPlXtovn7RY/AWHAGPxVNpxQ+ch:qvipaE5gNOvlYIGAAith
TLSH
T175E423E31ABA4E0CE9F260709BC624D1A424336265F96AEFF55453FC2E9FAD1D1B0144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jnqy2cvq.g1s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnqy2cvq.g1s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

hmhgnv.vbs

Path C:\Users\Admin\AppData\Local\Temp\hmhgnv.vbs
Size 1.0MB
SHA256 05707b52ef1938ed8160817c555059d5d226d690f8a2d33ceaf291d80ecc4d21
MD5 4d03c2b5ceea4e5a8d33243e8080d366
SHA1 4c28104c99f3955e9e500c56ffc685bf1b52f022
SHA512 6961c5c94e3754ced1806469c96b71fa3acda54d76e0b47349f383bc3106db7ec7259617f944bac4510c6005f4827bdbe87436cfefa55d8cec53379c6d831af0
SSDEEP 384:zcM3wVxmznSz3L75XMCK3kQsN7mVLiHxLic6ndnd6slEniGFYXKK:IW
TLSH
T1FE25FF2F943DF49E70E43E81F51BAA3F167B78661359E1863EC93C526A0328166F01DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3gnnxgyb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3gnnxgyb\3gnnxgyb.0.cs
Size 268B
SHA256 c1160e5ff5eca52dccd6774dbe1d9f5cc9f2e6931bf37fc8cad913a28b516536
MD5 1957c3da379ac8b0c7ef286efa80bdbe
SHA1 d211114cd7c6f072fafcc74b1889e2bd0fba7f08
SHA512 e3a6abccc9210b6e3bd91e1a1af135079b7c3ad0ac30dd31159b9d762e7f27e8a1cc3725e4a263c4c7136d85ea53c061b4a2c9dc6398a728fa16216e51492cce
TLSH
T17AD05B286652EFB1442248164D42D0EDF65B5131127B190476E51311EF6B0199239D5D
MD5 SHA1 SHA512 TLSH

Submit Download

3gnnxgyb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3gnnxgyb\3gnnxgyb.cmdline
Size 369B
SHA256 d91f112de1fef3832d3b833a6f596d9d9dad0165149d35a382395c2eb421a725
MD5 701e319c8f3ccccd30307f8a43729d39
SHA1 c2bc9e7a2e70d94f20e22faf3b7a008d2caa860e
SHA512 862d34617ebf27119244f4825ef6ac8e2f6781764aa84e517bf7a3126dec17c8197cc4ec2363f555250b9f7c40512de955a70346d5338ae15416c94234ed1650
TLSH
T183E0682A4287C27D01D9104F2169C8ACC3B34E472A803F885240C40FD03780627D17CD
MD5 SHA1 SHA512 TLSH

Submit Download

CSC99EE6946ECAF4BA694FE77415FE508D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3gnnxgyb\CSC99EE6946ECAF4BA694FE77415FE508D.TMP
Size 652B
SHA256 c9678e815fe0a80f5447f189898f86f79c1e64a90bfb1c280a8fb1fdcc952ebb
MD5 18506122461bf574a0a69dc85d124c95
SHA1 97f503aa53bc95a073b54c70fa88ced92d52d928
SHA512 31a699e7bf91a25f0f02aaee2962bf85ce8370abfe74b9122dbc83db873e7994c97f0582fe303f7047b1cd7da3ce13a8c4a7e868ab50de0d900342c8cb20f42a
TLSH
T123F05E0963F8420EF0F74B70BDF643A391A8FC65DE7293ED2440031928745108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3B4181D369A740EF8A196E29EBDB86.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC3B4181D369A740EF8A196E29EBDB86.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_694b9b7a8f814381ba85114b956f4d5a.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_694b9b7a8f814381ba85114b956f4d5a.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-47-0x0000000000230000-0x0000000000238000-memory.dmp

Download

memory/3380-262-0x0000000000670000-0x000000000068C000-memory.dmp

Download

memory/4452-15-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-7-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-13-0x0000025E35720000-0x0000025E3572A000-memory.dmp

Download

memory/4452-11-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-10-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-9-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-8-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-12-0x0000025E4D7A0000-0x0000025E4D854000-memory.dmp

Download

memory/4452-6-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-5-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-14-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-4-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-16-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-0-0x00007FFAC5F6F000-0x00007FFAC5F70000-memory.dmp

Download

memory/4452-19-0x00007FFAC5DE0000-0x00007FFAC6784000-memory.dmp

Download

memory/4452-3-0x0000025E356F0000-0x0000025E35712000-memory.dmp

Download

memory/4712-50-0x0000000007C70000-0x0000000007CA4000-memory.dmp

Download

memory/4712-69-0x0000000016F90000-0x00000000179E8000-memory.dmp

Download

memory/4712-17-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4712-20-0x00000000058B0000-0x000000000594C000-memory.dmp

Download

memory/4712-21-0x0000000005810000-0x0000000005876000-memory.dmp

Download

memory/4712-22-0x0000000005F10000-0x00000000064CA000-memory.dmp

Download

memory/4712-24-0x0000000007D60000-0x0000000007DF2000-memory.dmp

Download

memory/4712-31-0x0000000007BA0000-0x0000000007BD0000-memory.dmp

Download

memory/4712-32-0x0000000007BF0000-0x0000000007BF8000-memory.dmp

Download

memory/4712-51-0x0000000007BE0000-0x0000000007BE6000-memory.dmp

Download

memory/4712-56-0x0000000011150000-0x0000000011F8C000-memory.dmp

Download

memory/4712-61-0x0000000009380000-0x0000000009388000-memory.dmp

Download

memory/4712-60-0x00000000093D0000-0x000000000944C000-memory.dmp

Download

memory/5152-195-0x00007FFAE0C10000-0x00007FFAE0C1F000-memory.dmp

Download

memory/5152-256-0x00007FFADEE50000-0x00007FFADEE5B000-memory.dmp

Download

memory/5152-240-0x00007FFAE0470000-0x00007FFAE0497000-memory.dmp

Download

memory/5152-191-0x00007FFAE0440000-0x00007FFAE046B000-memory.dmp

Download

memory/5152-241-0x00007FFAE0C20000-0x00007FFAE0C2F000-memory.dmp

Download

memory/5152-244-0x00007FFAE0C10000-0x00007FFAE0C1F000-memory.dmp

Download

memory/5152-183-0x00007FFAE0470000-0x00007FFAE0497000-memory.dmp

Download

memory/5152-185-0x00007FFAE0C20000-0x00007FFAE0C2F000-memory.dmp

Download

memory/5152-199-0x00007FFAE0410000-0x00007FFAE0429000-memory.dmp

Download

memory/5152-245-0x00007FFAE0410000-0x00007FFAE0429000-memory.dmp

Download

memory/5152-202-0x00007FFAE0400000-0x00007FFAE040D000-memory.dmp

Download

memory/5152-243-0x00007FFAE0440000-0x00007FFAE046B000-memory.dmp

Download

memory/5152-206-0x00007FFAE03D0000-0x00007FFAE03F5000-memory.dmp

Download

memory/5152-239-0x00007FFAC3540000-0x00007FFAC3BA4000-memory.dmp

Download

memory/5152-209-0x00007FFAC9820000-0x00007FFAC999F000-memory.dmp

Download

memory/5152-208-0x00007FFAC3540000-0x00007FFAC3BA4000-memory.dmp

Download

memory/5152-230-0x00007FFAE0360000-0x00007FFAE036C000-memory.dmp

Download

memory/5152-229-0x00007FFAE0C10000-0x00007FFAE0C1F000-memory.dmp

Download

memory/5152-246-0x00007FFAE0400000-0x00007FFAE040D000-memory.dmp

Download

memory/5152-227-0x00007FFAE0370000-0x00007FFAE037C000-memory.dmp

Download

memory/5152-226-0x00007FFAE0440000-0x00007FFAE046B000-memory.dmp

Download

memory/5152-177-0x00007FFAC3540000-0x00007FFAC3BA4000-memory.dmp

Download

memory/5152-223-0x00007FFAE0380000-0x00007FFAE038C000-memory.dmp

Download

memory/5152-247-0x00007FFAE03D0000-0x00007FFAE03F5000-memory.dmp

Download

memory/5152-220-0x00007FFAE0390000-0x00007FFAE039C000-memory.dmp

Download

memory/5152-249-0x00007FFAE03C0000-0x00007FFAE03CB000-memory.dmp

Download

memory/5152-217-0x00007FFAE03A0000-0x00007FFAE03B2000-memory.dmp

Download

memory/5152-216-0x00007FFAE0470000-0x00007FFAE0497000-memory.dmp

Download

memory/5152-250-0x00007FFAE03A0000-0x00007FFAE03B2000-memory.dmp

Download

memory/5152-213-0x00007FFAE03C0000-0x00007FFAE03CB000-memory.dmp

Download

memory/5152-251-0x00007FFAE0390000-0x00007FFAE039C000-memory.dmp

Download

memory/5152-231-0x00007FFAE0410000-0x00007FFAE0429000-memory.dmp

Download

memory/5152-232-0x00007FFAE0350000-0x00007FFAE035B000-memory.dmp

Download

memory/5152-233-0x00007FFAE03D0000-0x00007FFAE03F5000-memory.dmp

Download

memory/5152-234-0x00007FFADEE50000-0x00007FFADEE5B000-memory.dmp

Download

memory/5152-237-0x00007FFADED40000-0x00007FFADED4C000-memory.dmp

Download

memory/5152-236-0x00007FFADED50000-0x00007FFADED5B000-memory.dmp

Download

memory/5152-235-0x00007FFAC9820000-0x00007FFAC999F000-memory.dmp

Download

memory/5152-242-0x00007FFAE0BD0000-0x00007FFAE0BE9000-memory.dmp

Download

memory/5152-252-0x00007FFAE0380000-0x00007FFAE038C000-memory.dmp

Download

memory/5152-253-0x00007FFAE0370000-0x00007FFAE037C000-memory.dmp

Download

memory/5152-258-0x00007FFADED40000-0x00007FFADED4C000-memory.dmp

Download

memory/5152-257-0x00007FFADED50000-0x00007FFADED5B000-memory.dmp

Download

memory/5152-189-0x00007FFAE0BD0000-0x00007FFAE0BE9000-memory.dmp

Download

memory/5152-255-0x00007FFAE0350000-0x00007FFAE035B000-memory.dmp

Download

memory/5152-254-0x00007FFAE0360000-0x00007FFAE036C000-memory.dmp

Download

memory/5152-248-0x00007FFAC9820000-0x00007FFAC999F000-memory.dmp

Download

memory/5660-107-0x0000000006B30000-0x0000000006B52000-memory.dmp

Download

memory/5660-92-0x00000000060A0000-0x00000000060BA000-memory.dmp

Download

memory/5660-91-0x00000000074A0000-0x0000000007B1C000-memory.dmp

Download

memory/5660-88-0x0000000005B50000-0x0000000005B9C000-memory.dmp

Download

memory/5660-87-0x0000000005680000-0x000000000569E000-memory.dmp

Download

memory/5660-85-0x00000000056E0000-0x0000000005A3B000-memory.dmp

Download

memory/5660-84-0x0000000005550000-0x00000000055B6000-memory.dmp

Download

memory/5660-81-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/5660-105-0x0000000006110000-0x0000000006118000-memory.dmp

Download

memory/5660-79-0x0000000004630000-0x0000000004666000-memory.dmp

Download

memory/5660-80-0x0000000004CD0000-0x000000000531A000-memory.dmp

Download

memory/5660-106-0x0000000006E20000-0x0000000006EB6000-memory.dmp

Download