xworm | 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Size 735KB
Sample260809-ym5hysvdmc
SHA256 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
MD5 f3f5b3f73221c983693a4658a8875fc1
SHA1 53b4f3493184045d5bbff9de6b8a94b150c6e0e9
SHA512 f15a76928e03bf36fe368119d0811657f6361aeb5a60717786ab8cb8ac106a43c83e1c0a3577882bce05fcdfcae17704d06b8a79a02eeb71838228d72d32125d
SSDEEP 12288:D2LxnupjXgxUf1sOhbrotlBIeSYsJd3Q8mClXi2zGF9fiRWl:D8IjY0otpSY+d3Mr2zGDqR
TLSH
T10DF40228042BC40AE9F56EB11C71F1F5A7B73D9AB238D0296FC64D6F72636087D89325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:443

Mutex

70vLmgcqMEnUJOeL

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/6016-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3248	powershell.exe
2744	powershell.exe
5396	powershell.exe
3300	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe

Executes dropped EXE 8 IoCs

pid	Process
2056	bin.exe
4908	bin.exe
4872	bin.exe
1840	bin.exe
6096	bin.exe
5848	bin.exe
1288	bin.exe
3536	bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3624 set thread context of 6016	3624	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	89
PID 2056 set thread context of 1840	2056	bin.exe	105
PID 4908 set thread context of 5848	4908	bin.exe	107
PID 1288 set thread context of 3536	1288	bin.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3248	powershell.exe
3248	powershell.exe
2744	powershell.exe
2744	powershell.exe
5396	powershell.exe
5396	powershell.exe
3300	powershell.exe
3300	powershell.exe
2056	bin.exe
2056	bin.exe
4908	bin.exe
4908	bin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeIncreaseQuotaPrivilege	3248	powershell.exe
Token: SeSecurityPrivilege	3248	powershell.exe
Token: SeTakeOwnershipPrivilege	3248	powershell.exe
Token: SeLoadDriverPrivilege	3248	powershell.exe
Token: SeSystemProfilePrivilege	3248	powershell.exe
Token: SeSystemtimePrivilege	3248	powershell.exe
Token: SeProfSingleProcessPrivilege	3248	powershell.exe
Token: SeIncBasePriorityPrivilege	3248	powershell.exe
Token: SeCreatePagefilePrivilege	3248	powershell.exe
Token: SeBackupPrivilege	3248	powershell.exe
Token: SeRestorePrivilege	3248	powershell.exe
Token: SeShutdownPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeSystemEnvironmentPrivilege	3248	powershell.exe
Token: SeRemoteShutdownPrivilege	3248	powershell.exe
Token: SeUndockPrivilege	3248	powershell.exe
Token: SeManageVolumePrivilege	3248	powershell.exe
Token: 33	3248	powershell.exe
Token: 34	3248	powershell.exe
Token: 35	3248	powershell.exe
Token: 36	3248	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeIncreaseQuotaPrivilege	2744	powershell.exe
Token: SeSecurityPrivilege	2744	powershell.exe
Token: SeTakeOwnershipPrivilege	2744	powershell.exe
Token: SeLoadDriverPrivilege	2744	powershell.exe
Token: SeSystemProfilePrivilege	2744	powershell.exe
Token: SeSystemtimePrivilege	2744	powershell.exe
Token: SeProfSingleProcessPrivilege	2744	powershell.exe
Token: SeIncBasePriorityPrivilege	2744	powershell.exe
Token: SeCreatePagefilePrivilege	2744	powershell.exe
Token: SeBackupPrivilege	2744	powershell.exe
Token: SeRestorePrivilege	2744	powershell.exe
Token: SeShutdownPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeSystemEnvironmentPrivilege	2744	powershell.exe
Token: SeRemoteShutdownPrivilege	2744	powershell.exe
Token: SeUndockPrivilege	2744	powershell.exe
Token: SeManageVolumePrivilege	2744	powershell.exe
Token: 33	2744	powershell.exe
Token: 34	2744	powershell.exe
Token: 35	2744	powershell.exe
Token: 36	2744	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeIncreaseQuotaPrivilege	5396	powershell.exe
Token: SeSecurityPrivilege	5396	powershell.exe
Token: SeTakeOwnershipPrivilege	5396	powershell.exe
Token: SeLoadDriverPrivilege	5396	powershell.exe
Token: SeSystemProfilePrivilege	5396	powershell.exe
Token: SeSystemtimePrivilege	5396	powershell.exe
Token: SeProfSingleProcessPrivilege	5396	powershell.exe
Token: SeIncBasePriorityPrivilege	5396	powershell.exe
Token: SeCreatePagefilePrivilege	5396	powershell.exe
Token: SeBackupPrivilege	5396	powershell.exe
Token: SeRestorePrivilege	5396	powershell.exe
Token: SeShutdownPrivilege	5396	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeSystemEnvironmentPrivilege	5396	powershell.exe
Token: SeRemoteShutdownPrivilege	5396	powershell.exe
Token: SeUndockPrivilege	5396	powershell.exe
Token: SeManageVolumePrivilege	5396	powershell.exe
Token: 33	5396	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 6016	3624	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	89
PID 3624 wrote to memory of 6016	3624	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	89
PID 3624 wrote to memory of 6016	3624	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	89
PID 3624 wrote to memory of 6016	3624	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	89
PID 3624 wrote to memory of 6016	3624	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	89
PID 6016 wrote to memory of 3248	6016	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	90
PID 6016 wrote to memory of 2744	6016	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	93
PID 6016 wrote to memory of 5396	6016	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	95
PID 6016 wrote to memory of 3300	6016	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	97
PID 6016 wrote to memory of 4692	6016	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	99
PID 2056 wrote to memory of 4872	2056	bin.exe	104
PID 2056 wrote to memory of 1840	2056	bin.exe	105
PID 2056 wrote to memory of 1840	2056	bin.exe	105
PID 2056 wrote to memory of 1840	2056	bin.exe	105
PID 2056 wrote to memory of 1840	2056	bin.exe	105
PID 2056 wrote to memory of 1840	2056	bin.exe	105
PID 4908 wrote to memory of 6096	4908	bin.exe	106
PID 4908 wrote to memory of 5848	4908	bin.exe	107
PID 4908 wrote to memory of 5848	4908	bin.exe	107
PID 4908 wrote to memory of 5848	4908	bin.exe	107
PID 4908 wrote to memory of 5848	4908	bin.exe	107
PID 4908 wrote to memory of 5848	4908	bin.exe	107
PID 1288 wrote to memory of 3536	1288	bin.exe	110
PID 1288 wrote to memory of 3536	1288	bin.exe	110
PID 1288 wrote to memory of 3536	1288	bin.exe	110
PID 1288 wrote to memory of 3536	1288	bin.exe	110
PID 1288 wrote to memory of 3536	1288	bin.exe	110

C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
"C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
  "C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3300
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4692

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1840

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:6096
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5848

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 d7570fa61302ae74e1c49aea213f7a19b9bf684a7a5ab4e351d400424fbf2ef1
MD5 e541f6c90b7df9165b67f7f7d5f6709c
SHA1 afcd1e6218a98a5ce50bac392f86d4d95ec90b43
SHA512 647e0e793d7606d6c0f16dc05658ee50a6385165be182c96d44c924c92127e14af3716aee6843aad09d918a310515d8570131fcf73817f6fe43154dc8112fed3
SSDEEP 384:H1eBaoT1iBGLGW14b1aWa+EH+TqFrZhn5IAXz48+pWvutzKwQvYbhNaPUlRtPZRq:VexZ6GCWisWa+wlt7IAXzX+lVPbhNaP5
TLSH
T1ABA2A478213F6DC7D8D226B410D10AE7FBE4E489DAB611D4BF1BDA2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 bfca4c54e93fd1e8ddd708850cb45f0f92d325c5069c032e3bf5b0d236450dd6
MD5 8a4953d83e983decbc93568ff1eb3fd4
SHA1 ce6825e153a637992eaed063ad6c3436b7777611
SHA512 299646313ad7fa9fda58b485f79d332fedcec284058a8c9d048cd3c626d97c43f92d09764b8cf95e13e62863f53f733584368d3d753ad1f7e713bc97e41c9d24
SSDEEP 384:D1eBaoT1iBGTbw9YNDA00nlm2PtERiUDzdC0MIAgKIIEbQVVONqBRpMschNIJJhr:RexZ6GT0GNDA0+HuIUFC0MIAgKDNPONw
TLSH
T154A2F61D267F59CBC89061B810824387FBF8D598E6E251DBEB4BC91F1C81A7E5E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 5b81e398142ec119c3198842b8afc8639ceca9f8497ebab1d5c5333b34b1b58b
MD5 6c33831107fb6fe243aa91677aeb04b6
SHA1 41a3ab4008d204cfcff00ca2afc2c29db2166587
SHA512 e1cf2dab1e5ae8b9c3500c773882b502e7bbcbf3781a7386e13d4a1101207e8ddd92c3151c9d4985702b75ad6806b48f112c5f0d4a5b1a6b1cb305ce61f38e72
SSDEEP 384:W1eBaoT1iBGUnu4bqWSbetu+eaL3hWWOEkMoIACOIIGCXxjvqBUw8Nv27hieUJhX:2exZ6G94bqNbP45NJoIAXDxXxvMh7hFW
TLSH
T12CA2F729266F8DCBDA9120B810910786FBF4D555E7E151CBEF0BC91F2C85A7E8E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gwrrovuo.xe4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gwrrovuo.xe4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 735KB
SHA256 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
MD5 f3f5b3f73221c983693a4658a8875fc1
SHA1 53b4f3493184045d5bbff9de6b8a94b150c6e0e9
SHA512 f15a76928e03bf36fe368119d0811657f6361aeb5a60717786ab8cb8ac106a43c83e1c0a3577882bce05fcdfcae17704d06b8a79a02eeb71838228d72d32125d
SSDEEP 12288:D2LxnupjXgxUf1sOhbrotlBIeSYsJd3Q8mClXi2zGF9fiRWl:D8IjY0otpSY+d3Mr2zGDqR
TLSH
T10DF40228042BC40AE9F56EB11C71F1F5A7B73D9AB238D0296FC64D6F72636087D89325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2056-70-0x00000000069D0000-0x0000000006A72000-memory.dmp

Download

memory/2744-43-0x0000000070820000-0x000000007086C000-memory.dmp

Download

memory/3248-38-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3248-28-0x0000000070820000-0x000000007086C000-memory.dmp

Download

memory/3248-36-0x0000000007440000-0x00000000074D6000-memory.dmp

Download

memory/3248-35-0x0000000007240000-0x000000000724A000-memory.dmp

Download

memory/3248-34-0x00000000071D0000-0x00000000071EA000-memory.dmp

Download

memory/3248-33-0x0000000007810000-0x0000000007E8C000-memory.dmp

Download

memory/3248-32-0x0000000006EE0000-0x0000000006F83000-memory.dmp

Download

memory/3248-14-0x0000000002600000-0x0000000002636000-memory.dmp

Download

memory/3248-15-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3248-16-0x0000000005500000-0x0000000005B4A000-memory.dmp

Download

memory/3248-17-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3248-18-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3248-20-0x0000000005120000-0x0000000005186000-memory.dmp

Download

memory/3248-21-0x0000000005190000-0x00000000051F6000-memory.dmp

Download

memory/3248-19-0x0000000004F80000-0x0000000004FA2000-memory.dmp

Download

memory/3248-24-0x0000000005B50000-0x0000000005EAB000-memory.dmp

Download

memory/3248-25-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Download

memory/3248-26-0x0000000005F90000-0x0000000005FDC000-memory.dmp

Download

memory/3248-27-0x0000000006480000-0x00000000064B6000-memory.dmp

Download

memory/3248-31-0x00000000064C0000-0x00000000064E0000-memory.dmp

Download

memory/3300-57-0x0000000070820000-0x000000007086C000-memory.dmp

Download

memory/3624-6-0x0000000005510000-0x0000000005522000-memory.dmp

Download

memory/3624-4-0x00000000053B0000-0x00000000053BA000-memory.dmp

Download

memory/3624-1-0x0000000000730000-0x00000000007EE000-memory.dmp

Download

memory/3624-10-0x00000000077B0000-0x0000000007852000-memory.dmp

Download

memory/3624-9-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3624-0-0x00000000749B2000-0x00000000749B3000-memory.dmp

Download

memory/3624-7-0x0000000007850000-0x00000000078EC000-memory.dmp

Download

memory/3624-8-0x00000000749B2000-0x00000000749B3000-memory.dmp

Download

memory/3624-2-0x0000000005820000-0x0000000005DDA000-memory.dmp

Download

memory/3624-13-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3624-5-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3624-3-0x0000000005300000-0x0000000005392000-memory.dmp

Download

memory/5396-50-0x0000000070820000-0x000000007086C000-memory.dmp

Download

memory/6016-42-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/6016-65-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/6016-12-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/6016-69-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/6016-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download