xworm | 9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
Size 727KB
Sample260810-rm1rfawtht
SHA256 9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264
MD5 12236c7e2d7acd537eec932ffc042da2
SHA1 9dce57fca6edadb4f1bdcfe9c96bbfd9d89e432d
SHA512 bf84cfc9cd11f9d67f28e41921a5d76747020b37f9120296d0b9e1f2b1a16d9d447b0ff104d48d125d7e13892c70be538effdd0c1b9f74bebb5bf153c95340da
SSDEEP 12288:DlJdbv0EcfJGtMQ8YMtkJf89E6OuoQ4P2dHGzPY7+V0MP81fTY48kCRKwicUL:D7cfJGtMQ8Y984CGzBk9TYVvRKwgL
TLSH
T1A2F4125C2A49D903CA6543B58FB5F37862A95DFCB811C3139FEDAEDFFA25A008C44186
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery evasion execution xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:1012

Mutex

aGO284VKfQVe8Vup

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2248-12-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6116	powershell.exe
4140	powershell.exe
2428	powershell.exe
4956	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe

Executes dropped EXE 4 IoCs

pid	Process
4720	bin.exe
5076	bin.exe
4664	bin.exe
5656	bin.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2932 set thread context of 2248	2932	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	90
PID 4720 set thread context of 5076	4720	bin.exe	108
PID 4664 set thread context of 5656	4664	bin.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6116	powershell.exe
6116	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
2428	powershell.exe
2428	powershell.exe
4956	powershell.exe
4956	powershell.exe
2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
Token: SeDebugPrivilege	6116	powershell.exe
Token: SeIncreaseQuotaPrivilege	6116	powershell.exe
Token: SeSecurityPrivilege	6116	powershell.exe
Token: SeTakeOwnershipPrivilege	6116	powershell.exe
Token: SeLoadDriverPrivilege	6116	powershell.exe
Token: SeSystemProfilePrivilege	6116	powershell.exe
Token: SeSystemtimePrivilege	6116	powershell.exe
Token: SeProfSingleProcessPrivilege	6116	powershell.exe
Token: SeIncBasePriorityPrivilege	6116	powershell.exe
Token: SeCreatePagefilePrivilege	6116	powershell.exe
Token: SeBackupPrivilege	6116	powershell.exe
Token: SeRestorePrivilege	6116	powershell.exe
Token: SeShutdownPrivilege	6116	powershell.exe
Token: SeDebugPrivilege	6116	powershell.exe
Token: SeSystemEnvironmentPrivilege	6116	powershell.exe
Token: SeRemoteShutdownPrivilege	6116	powershell.exe
Token: SeUndockPrivilege	6116	powershell.exe
Token: SeManageVolumePrivilege	6116	powershell.exe
Token: 33	6116	powershell.exe
Token: 34	6116	powershell.exe
Token: 35	6116	powershell.exe
Token: 36	6116	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeIncreaseQuotaPrivilege	4140	powershell.exe
Token: SeSecurityPrivilege	4140	powershell.exe
Token: SeTakeOwnershipPrivilege	4140	powershell.exe
Token: SeLoadDriverPrivilege	4140	powershell.exe
Token: SeSystemProfilePrivilege	4140	powershell.exe
Token: SeSystemtimePrivilege	4140	powershell.exe
Token: SeProfSingleProcessPrivilege	4140	powershell.exe
Token: SeIncBasePriorityPrivilege	4140	powershell.exe
Token: SeCreatePagefilePrivilege	4140	powershell.exe
Token: SeBackupPrivilege	4140	powershell.exe
Token: SeRestorePrivilege	4140	powershell.exe
Token: SeShutdownPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeSystemEnvironmentPrivilege	4140	powershell.exe
Token: SeRemoteShutdownPrivilege	4140	powershell.exe
Token: SeUndockPrivilege	4140	powershell.exe
Token: SeManageVolumePrivilege	4140	powershell.exe
Token: 33	4140	powershell.exe
Token: 34	4140	powershell.exe
Token: 35	4140	powershell.exe
Token: 36	4140	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeIncreaseQuotaPrivilege	2428	powershell.exe
Token: SeSecurityPrivilege	2428	powershell.exe
Token: SeTakeOwnershipPrivilege	2428	powershell.exe
Token: SeLoadDriverPrivilege	2428	powershell.exe
Token: SeSystemProfilePrivilege	2428	powershell.exe
Token: SeSystemtimePrivilege	2428	powershell.exe
Token: SeProfSingleProcessPrivilege	2428	powershell.exe
Token: SeIncBasePriorityPrivilege	2428	powershell.exe
Token: SeCreatePagefilePrivilege	2428	powershell.exe
Token: SeBackupPrivilege	2428	powershell.exe
Token: SeRestorePrivilege	2428	powershell.exe
Token: SeShutdownPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeSystemEnvironmentPrivilege	2428	powershell.exe
Token: SeRemoteShutdownPrivilege	2428	powershell.exe
Token: SeUndockPrivilege	2428	powershell.exe
Token: SeManageVolumePrivilege	2428	powershell.exe
Token: 33	2428	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2248	2932	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	90
PID 2932 wrote to memory of 2248	2932	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	90
PID 2932 wrote to memory of 2248	2932	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	90
PID 2932 wrote to memory of 2248	2932	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	90
PID 2932 wrote to memory of 2248	2932	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	90
PID 2248 wrote to memory of 6116	2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	91
PID 2248 wrote to memory of 4140	2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	94
PID 2248 wrote to memory of 2428	2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	97
PID 2248 wrote to memory of 4956	2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	99
PID 2248 wrote to memory of 4204	2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	101
PID 2248 wrote to memory of 5840	2248	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe	105
PID 5840 wrote to memory of 1376	5840	csc.exe	107
PID 4720 wrote to memory of 5076	4720	bin.exe	108
PID 4720 wrote to memory of 5076	4720	bin.exe	108
PID 4720 wrote to memory of 5076	4720	bin.exe	108
PID 4720 wrote to memory of 5076	4720	bin.exe	108
PID 4720 wrote to memory of 5076	4720	bin.exe	108
PID 4664 wrote to memory of 5656	4664	bin.exe	110
PID 4664 wrote to memory of 5656	4664	bin.exe	110
PID 4664 wrote to memory of 5656	4664	bin.exe	110
PID 4664 wrote to memory of 5656	4664	bin.exe	110
PID 4664 wrote to memory of 5656	4664	bin.exe	110

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe

C:\Users\Admin\AppData\Local\Temp\9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
"C:\Users\Admin\AppData\Local\Temp\9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe
  "C:\Users\Admin\AppData\Local\Temp\9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe"
  2⤵
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4956
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4204
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_9b386e8d9eff4eef9bf1fd643ff50e8b.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5840
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA81.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA3FE81D11D644A27A2DEDA5D1CE0867E.TMP"
      4⤵
      PID:1376

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5076

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 9483e0df6467aa4522b319e20257b308e3de620fcf8a4bbade4f18fd6806f288
MD5 f43b98cfc478a49652f1a0ce42f1fcdb
SHA1 af56246ae2e00e95f73a56d2b2969dca14ae0d98
SHA512 e2d38bcec5eec26caa3fac17542023c560b3d2e898310ee3e0545dd884fd8d8601b7b015c84067441b08531832d5dff264369536c400a45653a5aae7371d3512
SSDEEP 384:a1eBaoT1iBGAGW14btu2yE/01D8eCHI2P4lIAXz48+tW7TyzKwMvYbhNaPElRtre:KexZ6GrWihuNE/01uWIAXzX+MujbhNap
TLSH
T1E3A2C578213F6DC7D8D226B410D10AE7FBE4D489DAF611D4BF2BDA2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 2899466f920b1a9fdc2e6acd21645cb25c110ed478b32cd261acc1c74cee2e23
MD5 c157d87ead8cdc06bf5f84666d061187
SHA1 8aa3d76b4d8bbcfad5f36774e85991babea8707b
SHA512 20a3ce5af51f78fc687aae0b1bae3d171ab64f92cdde576440aa74f9e471023695c970cac8f8100ea6c6d59806535b8d88cd568464f4eb1046422eaf3bf00f6d
SSDEEP 384:cSEboT1iBG/bPye6l/+geCrrge8RUsEkmIAXIIEbQNoaqB3KFp9v2AeUJhtLRWhD:Q0Z6G/bPFc/+cE/e35IAXDNNoaM6F0UM
TLSH
T192A2FA2D26AF9DCBC491627450C24383EBF8D55863F6529BEF0FC91F1C41A7E5A501E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 a02f544335c3fa1122991d13681796d6152bb51122ad67fce390ca893e3b176f
MD5 b0e4396853b05790eac47343beb57c94
SHA1 9a32e273dc3e0d5a85a76ee50c24246c4bfd3602
SHA512 69704acf86b4c2d174a98bc67317bd009f69f1c0dbaab6ffd9b2045309a7686a622fdcce68dea45d6d04da7d507f7486412bfd5aef55b145f793bc92d4370c28
SSDEEP 384:i8mboT1iBG3GlbZmp0+gu01qy56VWZiUDzdC0kIAC9IobQtVZqBUwQv2AeUJhNRw:K0Z6G2lbZmp0+1KqA6UAUFC0kIATpXZS
TLSH
T194A2191C22AF58CBDC5220B810824786FBF8E559A7E192C7EB4BCD1F2C45A7D5E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESA81.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA81.tmp
Size 2KB
SHA256 ac3a81878acb9b7e65a45b7f4c859a10a94d41264e431f22caffa30f478587b4
MD5 fa8ca4ce4b56198772732cc5e4be595b
SHA1 bd5a955e2b905b2bc1e6863ab0b2a77f8687bba5
SHA512 7e82d423179c5259b33545ca846378a662f262299487b21eeaeafea2e3b947e09121ac8faa9322034441d98e4510d084ce5e0f798e53c726b52f54e8a0763706
TLSH
T1E841650447E8872BE1728731A8FB9759A6747946BAAE0B8E74C8132E5F03300EDC317D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nf3foxzo.05z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nf3foxzo.05z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 727KB
SHA256 9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264
MD5 12236c7e2d7acd537eec932ffc042da2
SHA1 9dce57fca6edadb4f1bdcfe9c96bbfd9d89e432d
SHA512 bf84cfc9cd11f9d67f28e41921a5d76747020b37f9120296d0b9e1f2b1a16d9d447b0ff104d48d125d7e13892c70be538effdd0c1b9f74bebb5bf153c95340da
SSDEEP 12288:DlJdbv0EcfJGtMQ8YMtkJf89E6OuoQ4P2dHGzPY7+V0MP81fTY48kCRKwicUL:D7cfJGtMQ8Y984CGzBk9TYVvRKwgL
TLSH
T1A2F4125C2A49D903CA6543B58FB5F37862A95DFCB811C3139FEDAEDFFA25A008C44186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA3FE81D11D644A27A2DEDA5D1CE0867E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA3FE81D11D644A27A2DEDA5D1CE0867E.TMP
Size 1KB
SHA256 c73a79dd71b0b3bf100933b8fd42d24ea8bfc95ebe1b03d06d99fd7b490eb4cd
MD5 fe3635337a6c4100109e18ca896bd3da
SHA1 58f2591e74ed4db7447c2b6cf48a0371642286e7
SHA512 8aa3202886fc14fd4bc35cb83abf76105b660103cf04aed08e158e7108d4fe232de1c50f04a568f1f1f98213711c56536eb361d7503906b31d8682ce9a0e7b48
TLSH
T13D21DF4466E8422FF2B38730A9F6C6A6A5A87913AD7E4BDD30C8135F5F17602844317D
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_9b386e8d9eff4eef9bf1fd643ff50e8b.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_9b386e8d9eff4eef9bf1fd643ff50e8b.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2248-47-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/2248-80-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/2248-67-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/2248-12-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2248-13-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/2248-71-0x00000000073A0000-0x000000000741C000-memory.dmp

Download

memory/2248-72-0x0000000007460000-0x0000000007468000-memory.dmp

Download

memory/2248-81-0x0000000008170000-0x0000000008332000-memory.dmp

Download

memory/2428-52-0x00000000716E0000-0x000000007172C000-memory.dmp

Download

memory/2932-8-0x0000000075072000-0x0000000075073000-memory.dmp

Download

memory/2932-7-0x0000000005250000-0x0000000005264000-memory.dmp

Download

memory/2932-2-0x0000000005590000-0x0000000005B4A000-memory.dmp

Download

memory/2932-9-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/2932-3-0x0000000005070000-0x0000000005102000-memory.dmp

Download

memory/2932-0-0x0000000075072000-0x0000000075073000-memory.dmp

Download

memory/2932-14-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/2932-1-0x0000000000560000-0x000000000061C000-memory.dmp

Download

memory/2932-4-0x0000000005B50000-0x0000000005EAB000-memory.dmp

Download

memory/2932-11-0x0000000007A30000-0x0000000007AD6000-memory.dmp

Download

memory/2932-6-0x0000000005050000-0x000000000505A000-memory.dmp

Download

memory/2932-5-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/2932-10-0x0000000007990000-0x0000000007A2C000-memory.dmp

Download

memory/4140-43-0x00000000716F0000-0x000000007173C000-memory.dmp

Download

memory/4140-42-0x0000000006540000-0x000000000658C000-memory.dmp

Download

memory/4140-46-0x0000000007280000-0x0000000007323000-memory.dmp

Download

memory/4664-86-0x0000000007650000-0x00000000076F6000-memory.dmp

Download

memory/4720-70-0x0000000006010000-0x0000000006024000-memory.dmp

Download

memory/4956-59-0x00000000716E0000-0x000000007172C000-memory.dmp

Download

memory/6116-23-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/6116-38-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/6116-36-0x0000000007AB0000-0x0000000007B46000-memory.dmp

Download

memory/6116-35-0x00000000078B0000-0x00000000078BA000-memory.dmp

Download

memory/6116-34-0x0000000007840000-0x000000000785A000-memory.dmp

Download

memory/6116-33-0x0000000007E80000-0x00000000084FC000-memory.dmp

Download

memory/6116-32-0x0000000007700000-0x00000000077A3000-memory.dmp

Download

memory/6116-31-0x00000000076A0000-0x00000000076C0000-memory.dmp

Download

memory/6116-28-0x00000000716E0000-0x000000007172C000-memory.dmp

Download

memory/6116-27-0x00000000076C0000-0x00000000076F6000-memory.dmp

Download

memory/6116-26-0x00000000068C0000-0x000000000690C000-memory.dmp

Download

memory/6116-25-0x00000000064C0000-0x00000000064DE000-memory.dmp

Download

memory/6116-24-0x0000000006060000-0x00000000063BB000-memory.dmp

Download

memory/6116-22-0x0000000005F10000-0x0000000005F76000-memory.dmp

Download

memory/6116-19-0x0000000005600000-0x0000000005622000-memory.dmp

Download

memory/6116-17-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/6116-18-0x0000000005690000-0x0000000005CDA000-memory.dmp

Download

memory/6116-16-0x0000000075060000-0x000000007581C000-memory.dmp

Download

memory/6116-15-0x0000000005000000-0x0000000005036000-memory.dmp

Download