xworm | 6ecdce814b4e49ffb10d7b221b75bfb0838aabe7f0f9a3890d3b4aecc4f23dab

Analysis

max time kernel
300s
max time network
298s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contract - CB-KLS+А+В2 (003) - 14.08.26.js
Size 199KB
Sample260815-twvb5adr41
SHA256 6ecdce814b4e49ffb10d7b221b75bfb0838aabe7f0f9a3890d3b4aecc4f23dab
MD5 f5dc6d992e73101e24432f95ac98cec8
SHA1 d38f5846440357a8c2b4fd1bec1bcf828ec02c79
SHA512 d71fca0ffe70f9d696679b7a3a855cb117eb1750e615ad5736f360803e2bf51de0332f47c6b6ff078da740a2b4cf50ad8428d8e0884b4c31a27e6c72332b3c27
SSDEEP 3072:FQgQmpbrRBHv8wmzyKQR+V2Ei518hL3B1uetCL0F4iJDCyQZv5OuCqE+bELs/2q/:FjL1rRBPCzkolyI+eqMI
TLSH
T14C147C78DA85342DF10509AD500F27FC2FF194445805BAA0EFB9DBE3A839DC2B5F19A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:1012

Mutex

aGO284VKfQVe8Vup

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5476-35-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1848	powershell.exe
5948	powershell.exe
3168	powershell.exe
2568	powershell.exe
2184	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe

Executes dropped EXE 6 IoCs

pid	Process
4396	bin.exe
5708	MSBuild.exe
264	bin.exe
5696	bin.exe
4936	bin.exe
3488	bin.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	MSBuild.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4840	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 5476	1848	powershell.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1848	powershell.exe
1848	powershell.exe
2184	powershell.exe
2184	powershell.exe
5948	powershell.exe
5948	powershell.exe
3168	powershell.exe
3168	powershell.exe
2568	powershell.exe
2568	powershell.exe
5476	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5476	MSBuild.exe
5476	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe
5708	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	5476	MSBuild.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeIncreaseQuotaPrivilege	2184	powershell.exe
Token: SeSecurityPrivilege	2184	powershell.exe
Token: SeTakeOwnershipPrivilege	2184	powershell.exe
Token: SeLoadDriverPrivilege	2184	powershell.exe
Token: SeSystemProfilePrivilege	2184	powershell.exe
Token: SeSystemtimePrivilege	2184	powershell.exe
Token: SeProfSingleProcessPrivilege	2184	powershell.exe
Token: SeIncBasePriorityPrivilege	2184	powershell.exe
Token: SeCreatePagefilePrivilege	2184	powershell.exe
Token: SeBackupPrivilege	2184	powershell.exe
Token: SeRestorePrivilege	2184	powershell.exe
Token: SeShutdownPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeSystemEnvironmentPrivilege	2184	powershell.exe
Token: SeRemoteShutdownPrivilege	2184	powershell.exe
Token: SeUndockPrivilege	2184	powershell.exe
Token: SeManageVolumePrivilege	2184	powershell.exe
Token: 33	2184	powershell.exe
Token: 34	2184	powershell.exe
Token: 35	2184	powershell.exe
Token: 36	2184	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeIncreaseQuotaPrivilege	5948	powershell.exe
Token: SeSecurityPrivilege	5948	powershell.exe
Token: SeTakeOwnershipPrivilege	5948	powershell.exe
Token: SeLoadDriverPrivilege	5948	powershell.exe
Token: SeSystemProfilePrivilege	5948	powershell.exe
Token: SeSystemtimePrivilege	5948	powershell.exe
Token: SeProfSingleProcessPrivilege	5948	powershell.exe
Token: SeIncBasePriorityPrivilege	5948	powershell.exe
Token: SeCreatePagefilePrivilege	5948	powershell.exe
Token: SeBackupPrivilege	5948	powershell.exe
Token: SeRestorePrivilege	5948	powershell.exe
Token: SeShutdownPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeSystemEnvironmentPrivilege	5948	powershell.exe
Token: SeRemoteShutdownPrivilege	5948	powershell.exe
Token: SeUndockPrivilege	5948	powershell.exe
Token: SeManageVolumePrivilege	5948	powershell.exe
Token: 33	5948	powershell.exe
Token: 34	5948	powershell.exe
Token: 35	5948	powershell.exe
Token: 36	5948	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeIncreaseQuotaPrivilege	3168	powershell.exe
Token: SeSecurityPrivilege	3168	powershell.exe
Token: SeTakeOwnershipPrivilege	3168	powershell.exe
Token: SeLoadDriverPrivilege	3168	powershell.exe
Token: SeSystemProfilePrivilege	3168	powershell.exe
Token: SeSystemtimePrivilege	3168	powershell.exe
Token: SeProfSingleProcessPrivilege	3168	powershell.exe
Token: SeIncBasePriorityPrivilege	3168	powershell.exe
Token: SeCreatePagefilePrivilege	3168	powershell.exe
Token: SeBackupPrivilege	3168	powershell.exe
Token: SeRestorePrivilege	3168	powershell.exe
Token: SeShutdownPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeSystemEnvironmentPrivilege	3168	powershell.exe
Token: SeRemoteShutdownPrivilege	3168	powershell.exe
Token: SeUndockPrivilege	3168	powershell.exe
Token: SeManageVolumePrivilege	3168	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 4840	1140	wscript.exe	89
PID 4840 wrote to memory of 1848	4840	wscript.exe	90
PID 1848 wrote to memory of 300	1848	powershell.exe	92
PID 300 wrote to memory of 5648	300	csc.exe	93
PID 1848 wrote to memory of 5476	1848	powershell.exe	94
PID 1848 wrote to memory of 5476	1848	powershell.exe	94
PID 1848 wrote to memory of 5476	1848	powershell.exe	94
PID 1848 wrote to memory of 5476	1848	powershell.exe	94
PID 1848 wrote to memory of 5476	1848	powershell.exe	94
PID 5476 wrote to memory of 2184	5476	MSBuild.exe	95
PID 5476 wrote to memory of 5948	5476	MSBuild.exe	98
PID 5476 wrote to memory of 3168	5476	MSBuild.exe	100
PID 5476 wrote to memory of 2568	5476	MSBuild.exe	102
PID 5476 wrote to memory of 1012	5476	MSBuild.exe	104
PID 5476 wrote to memory of 2816	5476	MSBuild.exe	109
PID 2816 wrote to memory of 5820	2816	csc.exe	111
PID 5476 wrote to memory of 5708	5476	MSBuild.exe	112

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Contract - CB-KLS+А+В2 (003) - 14.08.26.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\iio0bmt8\svc_58142_c957.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\iio0bmt8\clr_26294_c91c.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ezqnzivp\ezqnzivp.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:300
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78A1.tmp" "c:\Users\Admin\AppData\Local\Temp\ezqnzivp\CSC20E81A7DFA1B4F1AA29D5747E83377F2.TMP"
        5⤵
        
        PID:5648
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Creates a file in the Startup directory
      Accesses Microsoft Outlook profiles
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:5476
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5948
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2568
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1012
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_993fff64cdde4d61801b0ce349d3abdb.cs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE5E2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC984ADC8C5C248DB86E22B9881A92961.TMP"
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 5476
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5708

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4848

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:264

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5696

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4936

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 7684903fd6f2d24af89c2a7dc445e85ada6956d29752e897de5cde820bb91323
MD5 67ffcd9b0ec2deff861f49dc43ab5433
SHA1 a51f785635da5440634bfe1ff9c299aff0bcd14d
SHA512 db4428f50a2576d4daebfd471cd6666007347436f88339c18e82b1109577e3b1a2d006f9383044d8015e999784621cd12db0266642a4214f103515b7b6df54e2
SSDEEP 384:J1XBaGX1iBuyNb46dI8OzVn7d8vjaPzClhIAEr4KpgN+fJzmz9pmtlGkWm9Fvu3a:TXnF6uy8R8OzV58LE4IAErjgNyJzE+z1
TLSH
T18E92B66C513F6DC7D8D122B414D602E7FFE4E088DA7551A4EE2BDE3B1C90ABA4FA0524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 79c27bfe5cdb37bfb67eee340062ccf17aa46d8cfcfedd9062e39538e8b63809
MD5 16dfa88229cdc5aaa718b61d2abcabcc
SHA1 c021129b4cd50030270ec7de862685e5282dcb98
SHA512 d76e9deb537603529382be5e4fbaf49b235982dbf56ae2868eb496e43b7f66bc868cb3607d1e898aec10b831fb9a5118a29df4a64d7adb0575d5c046d501bfdb
SSDEEP 384:F1eBaoT1iBGCGW14bgn6z1m+geZyymFnMzdC1/COII+dW7utuwXHbhNaNmlRtsAG:vexZ6GZWiG6pm+TvrC5XD+VV3bhNaN+U
TLSH
T1A5A2F76C212F4CC3E9D212F415910BE6FBA4D486D9E641D9BB1BCE1E4C50EBE9E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3d96c4acda985b2401a8998e8147bf4a5bfa64b3a78040ae5140129069c03564
MD5 5d7b0d02af829cc13c27eef08ae8875a
SHA1 584a9850161dbdcfa9e9994ba5de601cd228ec99
SHA512 fbf190a52cef65e92324378deafde2ff946fa77c1ab488316dcee9e1faf9ff8dee4ab9c5268e4e1d06f429fe1c4e110de80d536f07553804f153844cfb74ade8
SSDEEP 384:V1eBaoT1iBG4lyHoen2EF6geHR2VWOEfzdC0wIACOIjWWEoaqB6Fplv27hNIJJhP:fexZ6G4lcoenN6GUNZC0wIAXvoaM6whM
TLSH
T1B6A2072C267F89CBC99161B410824386FBF8D455E7E651DBEB1BC92F1C41A7E8E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 35134cf797fdbaac9e8ffcfdc202d1f77530a18f3600e15c93928087200e4426
MD5 e8f040acce0b2eaf43099d5ad726c236
SHA1 c45770dd52e17412ac7b0c5ef0a13f14df2826c0
SHA512 0c107404ae0d347265c324fefd4a69e921e908f05ac05f67984baa1f4836554fbc718cc4d43836a70adbbbbef1c01e428412d109742ccb1dfc47951982141f5f
SSDEEP 384:P1eBaoT1iBGtRGlbPFdGI+geC5S2PnKhPIAgKIIiRQBoaqB6FwIvtchNIeUJhGRk:NexZ6GtEl7F0I+iD8PIAgKDiCBoaM6eK
TLSH
T1A1A2D61D266F99CBD491227810814383FBF8D598EBE152DBBF1BC92F2C45A7E4E501E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
Size 5KB
SHA256 45006d8a34e74d2d3d0509510191f6129ab36e60037b7f554714117c5ce3ac35
MD5 ee6e6a4b66130ff718bb7edd968cc86a
SHA1 b7453030382e668444297853ab17b8406b07e83e
SHA512 d804cde77eadda77e7304734c68d599f2e182467240a9d3d24d50ab184314269785f7c8947efd006b69b911228d04b2286c7d1781dcbd9e73b5f30444813e9ee
SSDEEP 96:bdew7V9bMLEgUyXqd8BynqgHlNxjEl7yxx4zNt:bvkLwuUoyqgHj+l7Ka
TLSH
T152C1C54697D847B7D066073079B3031167B8E8126A7B679F29E4127A7EB635008533B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES78A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES78A1.tmp
Size 1KB
SHA256 fd443934848f850ce237e55563918e3dd6dce3023512473ce5ef7e9c94db8cde
MD5 a0b93d90bfa1d7e2d859847efefbd465
SHA1 8161847a34293f9746e579359e1b92ce89dd981e
SHA512 28965e444c9690c1e3baf06bc3139c53806fd710db59132321d86ca812f10ce817202fe0dded18323bb5e543f9b9bf3559f871668068672301b7126e9f093d2a
TLSH
T13F21800593E8870AF0775731E9F6271FA274FD58EF62975B954041282C11504EEB1B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESE5E2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE5E2.tmp
Size 1KB
SHA256 82330db30cd99606f8fe217bb680c89a8e6dd5a40472bec1394f6aef72f6b093
MD5 422d88d3517afc79d8c642a19fb85a4c
SHA1 ac0d64c03d3d1571e947ad54bb8f09cacc2e3f8d
SHA512 dc6b5544e6b4e68b10330b31e2319032ef55229671243765428e84a3b7110a1018f13ddd9e96c559fa4b37ab599fb2afb84e1e411b054b98850c479009c2ffc6
TLSH
T10E412D4183D88B1FE172433169F79329A679BE96AA9E435EB884022E1E02340DDC3272
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_aucwh1bm.a2e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aucwh1bm.a2e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ezqnzivp.dll

Path C:\Users\Admin\AppData\Local\Temp\ezqnzivp\ezqnzivp.dll
Size 3KB
SHA256 6bc46f5f5d2200ad1052b9eef6e1eb3624384dfd7889a1956ed17506364887cd
MD5 1508b83b92da03ce4fc10e96377340e9
SHA1 2538c3c8d51c96c72f379d616d689423d729d11a
SHA512 1dd79d5b8e9e152454ecf252d38237b009e0d404071a4ba5cf1b80cf7fa6a22020ac5b534788b44a32a527741135abefb81b8ca21a601131a67c1df8e7c19b21
TLSH
T1EB51CB1AA7E8862BF0770B31AEF3431737B4FC509FB3A75E19904218AC216644E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

clr_26294_c91c.ps1

Path C:\Users\Admin\AppData\Local\Temp\iio0bmt8\clr_26294_c91c.ps1
Size 68KB
SHA256 af5d987ef22e801d706d226617fd704687dce94d39eb27bc2c13c57f1daa992f
MD5 71eb3e9348f4ef51733432b048618674
SHA1 43c50b6f1623cb3082fbd6ca04f9d78b4c09c8e6
SHA512 3f609e1efa671588d40683398e8d4e657e497ef40889d15e950336797acbda96ec98036d0b689e89a2f2b41a48cf8ab12b3fb7d0d34362db1ce46ad19310a33e
SSDEEP 1536:jXhm58gb7fEFb0S3Cq97Q/M7lSJ4amAbDDWgWGbPRnnMzT:QNb7Mb0S3Cq9Aasn/fWgW+WT
TLSH
T13563F1463A7D87C403CBBD6DA8B30A86B658C41B04480D64B3ACE9C46F4EA36D5C71FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_58142_c957.vbs

Path C:\Users\Admin\AppData\Local\Temp\iio0bmt8\svc_58142_c957.vbs
Size 228B
SHA256 ca91c0084405be97cc98b130f7f7a6ef3e9c4dbc3c4591f2d51fd151934fd429
MD5 d020ec6a46626d42cfabcdf4acb1217b
SHA1 4b3c437208b5c6ebd452b0faa108860d3295b68e
SHA512 397b2b358d6bf7fd65b2abdade0faf1c3d9e8c9c5af275214d70bb9bccbec57bf58fb37767b33bcca9bacf346b4b68151fdd906c2ab7056c654f382274c55123
TLSH
T12DD0A714653BD20C9C25C86A0572562CC9D3A89962002B62A7648904B991275CE5A149
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 249KB
SHA256 151d0125c20cdde578d02de3f2a56eb904870a887bb7f1c59bf61471da231916
MD5 f8e68d6abe411ce0c71d6b8c1c1b9048
SHA1 77360aa532c299f636f424a2866016ee6bd5c09b
SHA512 3e6c59395c8c5f07d39db829aa335420ffe426fb9a4ab831cfe1273e803afd5f91912ee341e01b4e108b298349bdeea9e7e52874b05fa1723ebc408be896b650
SSDEEP 3072:6DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:UHK2W0u1tvORstRXfM102bicw4
TLSH
T103446A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC984ADC8C5C248DB86E22B9881A92961.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC984ADC8C5C248DB86E22B9881A92961.TMP
Size 1KB
SHA256 a50a6f311d400c946c1444ca8be5df32c74461ece7f9e3b2b69446225a4d633c
MD5 61ffdac7eb1b54e0938a74d4496e4656
SHA1 5cffc47f2d55e1eb59f739c1eee23d4be1c9a200
SHA512 1afdfbb13c0e91288f1d5431aa58768987407556a0d9a1e05e5f52ace77446ac0e5ddfa845e22b6ab229f779dbcb64f3d751b79daaa31893bba5589013b8e12a
TLSH
T14C21AB41A2E8421EF2B3477079F2C363A16DBE569D7A43EC7888175F2F25A1085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC20E81A7DFA1B4F1AA29D5747E83377F2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ezqnzivp\CSC20E81A7DFA1B4F1AA29D5747E83377F2.TMP
Size 652B
SHA256 ce244498457c00261e381cefd0bc6606d4e5079f0a1454957bb191ce62d54c3f
MD5 c0c134924718f83b38e6984c0254ceaa
SHA1 0921593f157a26bf46fc576acff3f7d11e6abc1d
SHA512 25fa3570fbb09ccc3437355454235e069de72eb40e8597ca9c28e18c38dc437fbc6f59b1c8b2f240a7d8a4d6fbd55de3c62f0b3796aff7a66ea87f4cbd88d27e
TLSH
T1DBF05E0963F8420EF0F34B31BDF6536395A8BC68DE32A3ED2440031D68645208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ezqnzivp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ezqnzivp\ezqnzivp.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

ezqnzivp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ezqnzivp\ezqnzivp.cmdline
Size 369B
SHA256 dab8d7232ce4171c266eaf1d25759837fd2a577104c349c3a0dfc30f16fd9e6b
MD5 4afe2cccec2cb93988c141113e579dc1
SHA1 63591155e0a6c2bd3368b2e7e87ec0ec4c926f86
SHA512 898506e3a7d8645af5fa54002fb9dbaf866daf64bac57d0d9af926bddeccdd82f43e960b8f3afdf55aab5c6b91982629526db5f275305d5dc7c3cf1fda4ca7f5
TLSH
T1A2E0C06E4356C2FD61DD110FF17BC9ACC3724B4339427F845050840DF01710027D1791
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_993fff64cdde4d61801b0ce349d3abdb.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_993fff64cdde4d61801b0ce349d3abdb.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-16-0x0000014B7B4C0000-0x0000014B7B53C000-memory.dmp

Download

memory/1140-54-0x0000014B7B4C0000-0x0000014B7B53C000-memory.dmp

Download

memory/1848-41-0x0000000074290000-0x0000000074A4C000-memory.dmp

Download

memory/1848-14-0x0000000006820000-0x000000000683E000-memory.dmp

Download

memory/1848-33-0x0000000007A60000-0x0000000007A68000-memory.dmp

Download

memory/1848-19-0x0000000006E10000-0x0000000006E2A000-memory.dmp

Download

memory/1848-34-0x0000000007A70000-0x0000000007A78000-memory.dmp

Download

memory/1848-3-0x00000000742A2000-0x00000000742A3000-memory.dmp

Download

memory/1848-4-0x0000000002FD0000-0x0000000003006000-memory.dmp

Download

memory/1848-37-0x0000000007BC0000-0x0000000007C56000-memory.dmp

Download

memory/1848-38-0x0000000007B20000-0x0000000007B42000-memory.dmp

Download

memory/1848-39-0x0000000008CF0000-0x00000000092AA000-memory.dmp

Download

memory/1848-18-0x00000000080B0000-0x000000000872C000-memory.dmp

Download

memory/1848-20-0x0000000007A50000-0x0000000007A66000-memory.dmp

Download

memory/1848-15-0x0000000006880000-0x00000000068CC000-memory.dmp

Download

memory/1848-7-0x0000000074290000-0x0000000074A4C000-memory.dmp

Download

memory/1848-8-0x0000000005A60000-0x0000000005A82000-memory.dmp

Download

memory/1848-10-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Download

memory/1848-6-0x0000000005DB0000-0x00000000063FA000-memory.dmp

Download

memory/1848-9-0x0000000005C00000-0x0000000005C66000-memory.dmp

Download

memory/1848-5-0x0000000074290000-0x0000000074A4C000-memory.dmp

Download

memory/1848-13-0x0000000006400000-0x000000000675B000-memory.dmp

Download

memory/2184-53-0x00000000079E0000-0x00000000079EA000-memory.dmp

Download

memory/2184-52-0x00000000078B0000-0x0000000007953000-memory.dmp

Download

memory/2184-51-0x0000000006BE0000-0x0000000006C00000-memory.dmp

Download

memory/2184-48-0x000000006FCE0000-0x000000006FD2C000-memory.dmp

Download

memory/2184-47-0x00000000075C0000-0x00000000075F6000-memory.dmp

Download

memory/2184-46-0x0000000006990000-0x00000000069DC000-memory.dmp

Download

memory/2568-77-0x00000000708A0000-0x00000000708EC000-memory.dmp

Download

memory/3168-67-0x0000000005970000-0x0000000005CCB000-memory.dmp

Download

memory/3168-70-0x000000006FCE0000-0x000000006FD2C000-memory.dmp

Download

memory/4396-89-0x0000000005060000-0x00000000051BA000-memory.dmp

Download

memory/4396-88-0x0000000002A10000-0x0000000002A2A000-memory.dmp

Download

memory/4396-87-0x0000000000520000-0x0000000000560000-memory.dmp

Download

memory/4840-42-0x00000260C8AF0000-0x00000260C8B6C000-memory.dmp

Download

memory/5476-90-0x00000000071F0000-0x0000000007282000-memory.dmp

Download

memory/5476-91-0x0000000007390000-0x000000000740C000-memory.dmp

Download

memory/5476-92-0x0000000007430000-0x0000000007438000-memory.dmp

Download

memory/5476-36-0x0000000005120000-0x00000000051BC000-memory.dmp

Download

memory/5476-35-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5476-104-0x0000000008160000-0x0000000008322000-memory.dmp

Download

memory/5708-103-0x00000000008D0000-0x00000000008D8000-memory.dmp

Download

memory/5948-64-0x0000000006CF0000-0x0000000006D93000-memory.dmp

Download

memory/5948-61-0x00000000708A0000-0x00000000708EC000-memory.dmp

Download

memory/5948-60-0x0000000006020000-0x000000000606C000-memory.dmp

Download

memory/5948-58-0x00000000056F0000-0x0000000005A4B000-memory.dmp

Download