xworm | 07f832fec18520e00fd3366300677edebd045585873aee8c19c6a51148854429

Analysis

max time kernel
300s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MB320843298AE.js
Size 207KB
Sample260814-tkrrvsel5s
SHA256 07f832fec18520e00fd3366300677edebd045585873aee8c19c6a51148854429
MD5 fc35e7bac1d5fc7589b364648f1fe267
SHA1 6cdd8e75079a8ec759c1089687c39222f4c2fc11
SHA512 7d4056e5374c8cc305fb7d7690e4b50aa807338689de0cde486aa017261238789e4511b5c8770cc4aee4465b1fedd5252039cf84d9a6300a0ae5950a57b03c88
SSDEEP 3072:8tVTtcMFxf7Ax5gJdtrsDbascKT5RylDBjqscB/i+TpMyApXrLrziI5+qxyhjApg:4TuuxjAAJsjc2cloBH
TLSH
T13F248E6102B37E7CFB5426B9047F2AAB61F8FF012810F15BEAB27D475D25CA1C542A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:1012

Mutex

aGO284VKfQVe8Vup

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4948-38-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4304	powershell.exe
1788	powershell.exe
2440	powershell.exe
736	powershell.exe
3368	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe

Executes dropped EXE 7 IoCs

pid	Process
3300	bin.exe
4472	MSBuild.exe
3228	bin.exe
3048	bin.exe
4304	bin.exe
2116	bin.exe
4652	bin.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	MSBuild.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
60	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3368 set thread context of 4948	3368	powershell.exe	91

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	powershell.exe
3368	powershell.exe
4304	powershell.exe
4304	powershell.exe
1788	powershell.exe
1788	powershell.exe
2440	powershell.exe
2440	powershell.exe
736	powershell.exe
736	powershell.exe
4948	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4948	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe
4472	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	4948	MSBuild.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	4472	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 60	4140	wscript.exe	85
PID 60 wrote to memory of 3368	60	wscript.exe	86
PID 3368 wrote to memory of 1476	3368	powershell.exe	89
PID 1476 wrote to memory of 4372	1476	csc.exe	90
PID 3368 wrote to memory of 4948	3368	powershell.exe	91
PID 3368 wrote to memory of 4948	3368	powershell.exe	91
PID 3368 wrote to memory of 4948	3368	powershell.exe	91
PID 3368 wrote to memory of 4948	3368	powershell.exe	91
PID 3368 wrote to memory of 4948	3368	powershell.exe	91
PID 4948 wrote to memory of 4304	4948	MSBuild.exe	92
PID 4948 wrote to memory of 1788	4948	MSBuild.exe	94
PID 4948 wrote to memory of 2440	4948	MSBuild.exe	96
PID 4948 wrote to memory of 736	4948	MSBuild.exe	98
PID 4948 wrote to memory of 2288	4948	MSBuild.exe	100
PID 4948 wrote to memory of 4080	4948	MSBuild.exe	106
PID 4080 wrote to memory of 5068	4080	csc.exe	108
PID 4948 wrote to memory of 4472	4948	MSBuild.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MB320843298AE.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\s42a7mf3\dat_21022_4063.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\s42a7mf3\tmp_98541_4024.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vxu4bkfz\vxu4bkfz.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3236.tmp" "c:\Users\Admin\AppData\Local\Temp\vxu4bkfz\CSC87B61FC2E8224935AC5441D63966FA0.TMP"
        5⤵
        
        PID:4372
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Creates a file in the Startup directory
      Accesses Microsoft Outlook profiles
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:4948
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2440
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2288
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_7dd1b17615024f37b2d98d47bbf77634.cs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4080
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88F2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9FC8F5993A0440F2AB644F5662323AC3.TMP"
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 4948
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3300

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3228

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bin.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bin.exe.log
Size 841B
SHA256 ff981780f37479af6a428dd121eef68cf6e0b471ae92f080893a55320cc993f7
MD5 0efd0cfcc86075d96e951890baf0fa87
SHA1 6e98c66d43aa3f01b2395048e754d69b7386b511
SHA512 4e79f5a8494aac94f98af8dbbc71bdd0a57b02103757ad970da7e7d4e6a0dc5015ca008256a6bd2c5bdec3a0f5736a994e17b3ef004b0f374a3339e480ac41b1
TLSH
T11401B1303322F5D589026F07081C2AC517FF0759B664EF2CB55D225ED92A157AB322E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
MD5 25604a2821749d30ca35877a7669dff9
SHA1 49c624275363c7b6768452db6868f8100aa967be
SHA512 206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
TLSH
T1A4417B303125B5D84D435F5308286ED5A3EF874AAFA89F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 94ca44d976c2042cec4a01adc68d6ea397f4e5bb4014bc5f9af54081a072818c
MD5 8a7e69dc988d0481db2943365978b7e0
SHA1 767cd85f94377e46bcc33fd4563b7126129963de
SHA512 3a3dae31c3bea09e58d026c5e289d6fbd453a9b595020a41103ea05b47ea4d104240f82f12bc1075bab937cb57b8038903af0effc0636cb9c6449d6bd33ab953
SSDEEP 384:96+BY991n4i8CHjfTz5AtB+HNc9HG0ioZ+6udPq+nUQkki0SO1:8/nGCrvmL2NACx6udHUzki0H
TLSH
T1D382F8AD622F26D7C0A613B4C437479FEDF1CDDEC30507DE7B485A270A8666644A90EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 afcadc6f5eb624819e6613219e33adbc9fb8f0c17e2a9bb61c3cf99ed0fe7f31
MD5 049f92dfb88f17ddf935d650998f92c2
SHA1 13642fabaf90d5af99fddc0155e3e23588a5dd85
SHA512 7546bb7ed747ef3da104d8c922ece2c00d368e337c7ec01b069b466b1b2af69361b525f45fee68acb0ebba3306eb8a3fbec58f4bf427e4e30bf58ce5dbba95d4
SSDEEP 384:g6+Bp918ku/WMcU1ZEmYp+o9o5AZNY1fVLGZcifE6h5Bd9lq+nUmVkki0SO1:B6bu/WyEm6jo5AZNUVVifxh5Bd/UmikD
TLSH
T1F982F66A222F26DBC06623F4843747EBDEB08DCFD30047DE6709592B16DA26688954F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 e9f0e26180b84521dca7c131bc0e8f2e3cf0f644acf75d018bd9bb0273ac6287
MD5 afb0d1cf1b0b7ac64403a56eaece113a
SHA1 dbbba1faba8d31724360eaf6a5c16afeca2a3a04
SHA512 677f3b950f29cd0a57f5d8bac83cb9d0b3ba9ee667f9327fdec43f186db6df5c0b903c8bfab3502a2160d25db70615fd6895947c6bcfaddb7218f58304630257
SSDEEP 384:dvf+1Rx9p+dMxGZ0BBiQowTX/Zo9o2Tof6seY/9vGL/W/+lIzmXe/Kcyfek8K1+z:RfEIMLoQ3ryo2TogiJEu/9mLnepYds
TLSH
T17E92C56E700F16C3C8C65378D10B095FE4F2DE8D431907D9BB5E9E3B8AACA9E906D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6b71dc30bd9b8663f132eaa6aa8593dd74ec8335f589d31a34a675716d577801
MD5 a3966dc343f6e57f2158237badea8e96
SHA1 8b8b4bbf6b03262893b10363ec39af39396c191c
SHA512 ff3308c21bca815d47efa9c9f3c51f49029187a4f5e05f4d7885fde08bd437f4d9484463d32a3940352349136603d06321e40ae3c47ea2d814f963c8408c0dd5
SSDEEP 384:tsf+Bh91sZWsvkFlH0ho9o5ATEYY1NE/B03SoZFf1jEMvn0g1ItkKhD:yfSsZNkFN0So5ATbzqSgRE/j3
TLSH
T12582081E311F26C1D48613F4C027071FFCF2CDCDD34A17D97B499A3B8AA9A9A406A1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
Size 5KB
SHA256 59ceabcffcae4bb8a677cf306e6ef0c999e95adf21f64b8bd1c9e6d0fdb4f02f
MD5 561e6dee040a44f0216e422694f80970
SHA1 89663fad57c858ed5a89ea7bf358c0d04cfd02ec
SHA512 0d426fa29beb70622c7fe8602ac4796e7ecbb656113d5679ca2553bf4e27771cb853d925f1bdb9c5487b6126cd4b7aca8a8d47e4e4235368603ede6f9dbaa3e4
SSDEEP 96:M5dew7V9bMLEgUyXqd8BynqgHlNxjED7yxx4zNt:ovkLwuUoyqgHj+D7Ka
TLSH
T1D0C1D44687C847BAD067073078B3035127B8E812AA7BA79F29E4137A7EB639008033F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3236.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3236.tmp
Size 1KB
SHA256 e748059e9daf9ae0cd97795a1f4e363ff207c33070bd7c18ddffde628067aa55
MD5 da055f42541a0d7d4c03fa4038d19439
SHA1 a7281e493725fc85fa6c646455440bab0a416ae1
SHA512 bf9a237fc0ea4156bbe49cee623f6915792d2a4e8342fcc3b72b988ca980c6b66eeffee7d21ee1ab8dac80f78f96b7497d00b2acbf2b1d40ef8758518d2c4825
TLSH
T1F521EB0587E9471BF17343326AF6132F9235FC94EFA2936B8A0042281C51104EEB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES88F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES88F2.tmp
Size 1KB
SHA256 90c70df2c2221ecffcfbd1f5712217b1ddc50385930164f8e1e42f5154fd17f4
MD5 33858289d1412c5dbbc605f0fdade3be
SHA1 e4a5427f48a84491fa45a00265352e0cda987c35
SHA512 d2c95f6456b1cbed120ca8fa5f935a66a173b10b255f2ef1e4f9de346cf0d72e47d12cbc7f207be3589b93b41d75d2e4663d731b3e42d0f30b122ee46469e563
TLSH
T11F41234083D84B1FE172433129F7572AA279FE95AEAA475EB584522E2F12780CDC35B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sj2y53lj.apb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sj2y53lj.apb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dat_21022_4063.vbs

Path C:\Users\Admin\AppData\Local\Temp\s42a7mf3\dat_21022_4063.vbs
Size 228B
SHA256 a10384e3cba88a79245cfa63944218de437a8514d0c9a0657079623b23ead2d6
MD5 3124ae6910c62ff5e007b243a00ce0c6
SHA1 5f1ed3000edcdd9e7f0691fad3b3e03c4b605a8d
SHA512 32e90e7bbe74ac75dba061db60cd4b8c0832eb874f557eca688bcdcf6e95f6cacff57844fdfeb0e8c837e8a89e7c50cff06744632bdc2b48b934f12b51a2a174
TLSH
T1B3D0A7147179D21CAE25C4794563562CC793589D6604275167609D08F6C1176CE9E149
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_98541_4024.ps1

Path C:\Users\Admin\AppData\Local\Temp\s42a7mf3\tmp_98541_4024.ps1
Size 68KB
SHA256 ce6a456d37ea55c067a361f2cf6c98c824fde8ae57ceaacd66cd142724bdfecc
MD5 1591e1acff6fa9cd6f47a8ad12c398c6
SHA1 855a2fbbccb1492247e922e70dcecbf3136701ae
SHA512 3dba93452f4b8f7b21bf003aed1e898e1c1357a8772d4c253e9652ba68a70d8469bf0db65d65c7f8c1dbb59dda2419d57777b77ea481ba78c92558b09272e605
SSDEEP 1536:qytSo12JS0whNwICr+MzAC/+MbvzYDypv69cIzHSzB3Mzq:xtSoYJ1whNr0+MzACmMjzXN8eBMq
TLSH
T18163F10A6DB549FB08D36779C0E39546EABBE5F750181C48F5EC91C0EF23A1482CE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vxu4bkfz.dll

Path C:\Users\Admin\AppData\Local\Temp\vxu4bkfz\vxu4bkfz.dll
Size 3KB
SHA256 a53cc5c5fdf1aac9efea3bc5c0ef799d6f1a6d93c5429f0654b2fde0b918f5b2
MD5 9fed0ae0c44547383466d0f765bc6e95
SHA1 49ca0631f10918ac16fa601df1f9efabc90ccd3a
SHA512 ad644694f955f9ce4ad562e24eeef018736e7aeb5c745396001064eff4bbc4b1890d833920beabb608ab77ec493b8aaf92b03c64d589b24c579bcca8c3edd0dd
TLSH
T19451DD1B5BE8862BF0730B316EF3471777A4F8509BB3A35E5D900218AC616644A31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
TLSH
T125446A0163ED4615F6FF1AB4B8B059158B76F957E822D35E388CA1AC0F73780EA60763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9FC8F5993A0440F2AB644F5662323AC3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9FC8F5993A0440F2AB644F5662323AC3.TMP
Size 1KB
SHA256 a50a6f311d400c946c1444ca8be5df32c74461ece7f9e3b2b69446225a4d633c
MD5 61ffdac7eb1b54e0938a74d4496e4656
SHA1 5cffc47f2d55e1eb59f739c1eee23d4be1c9a200
SHA512 1afdfbb13c0e91288f1d5431aa58768987407556a0d9a1e05e5f52ace77446ac0e5ddfa845e22b6ab229f779dbcb64f3d751b79daaa31893bba5589013b8e12a
TLSH
T14C21AB41A2E8421EF2B3477079F2C363A16DBE569D7A43EC7888175F2F25A1085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_7dd1b17615024f37b2d98d47bbf77634.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_7dd1b17615024f37b2d98d47bbf77634.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC87B61FC2E8224935AC5441D63966FA0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vxu4bkfz\CSC87B61FC2E8224935AC5441D63966FA0.TMP
Size 652B
SHA256 e7379004f0a809ce66162fc1c90d9484359ef72ef831dff7b81bacd113e07c3f
MD5 1586d438e6ecd89239f80b34fed91e42
SHA1 cc5df263424f657f838ac16a4ccfdba8a0db85dc
SHA512 2356906ce4d5c02814785ff79c528c2fe093832d23d30cec92647afe72fc5d952aefc0acb8658aab5f7a5fc166715a97c8601188de9d28e5c5a3f5a5dfdcbb8b
TLSH
T1CDF05E0963F8021EF0F34B31BDF643A391A9BC65DE72A3FD1950031928645208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vxu4bkfz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vxu4bkfz\vxu4bkfz.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

vxu4bkfz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vxu4bkfz\vxu4bkfz.cmdline
Size 369B
SHA256 4c30a9bba2892b84601f46d01b25be245c430d6860a640429a93574092a1f2f4
MD5 a716c7fe034e0bbf89b5e7c780e18624
SHA1 2a0f9cef4c92bf5876e6364e837aa9401d881313
SHA512 97a003f6aabf2e21488b300be9c024ba7eae621fa391c1854032a0bac945782cd832e78bf1c1f1f5d69e1edd62c354f46bd15ff4b80727bd045e5d8a6af2663d
TLSH
T11FE0C07A6A5FC6BE03EE120B226BD4ACC27247432A463F847040440DE41750037E1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/736-119-0x0000000005720000-0x0000000005A74000-memory.dmp

Download

memory/736-123-0x00000000708F0000-0x000000007093C000-memory.dmp

Download

memory/1788-81-0x0000000005850000-0x0000000005BA4000-memory.dmp

Download

memory/1788-94-0x0000000007390000-0x00000000073A4000-memory.dmp

Download

memory/1788-93-0x0000000007340000-0x0000000007351000-memory.dmp

Download

memory/1788-84-0x00000000708F0000-0x000000007093C000-memory.dmp

Download

memory/1788-92-0x0000000007080000-0x0000000007123000-memory.dmp

Download

memory/1788-83-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Download

memory/2440-105-0x00000000708B0000-0x00000000708FC000-memory.dmp

Download

memory/2440-103-0x00000000061B0000-0x0000000006504000-memory.dmp

Download

memory/3300-138-0x0000000000710000-0x0000000000750000-memory.dmp

Download

memory/3300-140-0x0000000005100000-0x000000000525A000-memory.dmp

Download

memory/3300-139-0x0000000004EC0000-0x0000000004EDA000-memory.dmp

Download

memory/3368-8-0x0000000005200000-0x0000000005266000-memory.dmp

Download

memory/3368-36-0x0000000007130000-0x0000000007138000-memory.dmp

Download

memory/3368-6-0x00000000052B0000-0x00000000058D8000-memory.dmp

Download

memory/3368-7-0x0000000004F60000-0x0000000004F82000-memory.dmp

Download

memory/3368-4-0x0000000002630000-0x0000000002666000-memory.dmp

Download

memory/3368-3-0x0000000004C70000-0x0000000004C80000-memory.dmp

Download

memory/3368-23-0x0000000007120000-0x0000000007136000-memory.dmp

Download

memory/3368-21-0x0000000007900000-0x0000000007F7A000-memory.dmp

Download

memory/3368-18-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Download

memory/3368-5-0x0000000004C70000-0x0000000004C80000-memory.dmp

Download

memory/3368-9-0x00000000058E0000-0x0000000005946000-memory.dmp

Download

memory/3368-19-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/3368-22-0x00000000064E0000-0x00000000064FA000-memory.dmp

Download

memory/3368-42-0x0000000007F80000-0x0000000008524000-memory.dmp

Download

memory/3368-41-0x00000000071E0000-0x0000000007202000-memory.dmp

Download

memory/3368-40-0x0000000007280000-0x0000000007316000-memory.dmp

Download

memory/3368-17-0x0000000005950000-0x0000000005CA4000-memory.dmp

Download

memory/3368-37-0x0000000007150000-0x0000000007158000-memory.dmp

Download

memory/4304-70-0x0000000007F90000-0x0000000007FA4000-memory.dmp

Download

memory/4304-65-0x0000000007B80000-0x0000000007B9E000-memory.dmp

Download

memory/4304-55-0x0000000006EC0000-0x0000000006F0C000-memory.dmp

Download

memory/4304-46-0x0000000006350000-0x00000000066A4000-memory.dmp

Download

memory/4304-72-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

Download

memory/4304-71-0x0000000007FD0000-0x0000000007FEA000-memory.dmp

Download

memory/4304-69-0x0000000007F80000-0x0000000007F8E000-memory.dmp

Download

memory/4304-68-0x0000000007F20000-0x0000000007F31000-memory.dmp

Download

memory/4304-67-0x0000000007DC0000-0x0000000007DCA000-memory.dmp

Download

memory/4304-56-0x0000000007BA0000-0x0000000007BD2000-memory.dmp

Download

memory/4304-57-0x00000000708B0000-0x00000000708FC000-memory.dmp

Download

memory/4304-66-0x0000000007BF0000-0x0000000007C93000-memory.dmp

Download

memory/4472-156-0x0000000000710000-0x0000000000718000-memory.dmp

Download

memory/4948-144-0x0000000006A20000-0x0000000006A28000-memory.dmp

Download

memory/4948-38-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4948-143-0x0000000006980000-0x00000000069FC000-memory.dmp

Download

memory/4948-142-0x00000000067E0000-0x0000000006872000-memory.dmp

Download

memory/4948-157-0x0000000007750000-0x0000000007912000-memory.dmp

Download

memory/4948-39-0x00000000050F0000-0x000000000518C000-memory.dmp

Download