xworm | 054036f349028234ea15ddfd33de43adf6c2b1c00f2df1e02925d00d081b7b2e

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ 33419.js
Size 323KB
Sample260825-csjmsawcnc
SHA256 054036f349028234ea15ddfd33de43adf6c2b1c00f2df1e02925d00d081b7b2e
MD5 550016df041bf0251676aca2f29b62a6
SHA1 cd0d812b14f3a1b3ae6aac43f7baf63f285f3fa1
SHA512 2ceb3153548bb127735bc491c28a94a64eca60d7f68abd974f1f9ff03ebfe067a1fa29cb79e2cdff0c2ff2c7f360bae951ff4f24f9f24e0e7bf1623913283f40
SSDEEP 6144:zB5sDm3COFyY0DFbFdx1Tl6Zt0SKrBn0miRnuv5dJIRIwMWx2XC1rjJGSYZ:N1Fk156ZZKxzJv5dqxZ3YZ
TLSH
T1DB64BFD4E6825F361F4FA3958F5FC66446B851C363CA6CCCFA84325AA22A31315DF81B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

phanxwodm.duckdns.org:50007

Mutex

7tBCh6xBQkUuHcZE

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3584-90-0x0000024386750000-0x000002438675E000-memory.dmp	family_xworm

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\TileStoreSync_LIFE = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\jumplist_idx\\jumplist_idx_PEZUHENB.vbs\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\TileStoreSync_LIFE = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\jumplist_idx\\jumplist_idx_PEZUHENB.vbs\""	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5896	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6000	powershell.exe
4480	powershell.exe
2624	powershell.exe
256	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
256	powershell.exe
256	powershell.exe
6000	powershell.exe
6000	powershell.exe
4480	powershell.exe
4480	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2624	powershell.exe
2624	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	256	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeIncreaseQuotaPrivilege	2624	powershell.exe
Token: SeSecurityPrivilege	2624	powershell.exe
Token: SeTakeOwnershipPrivilege	2624	powershell.exe
Token: SeLoadDriverPrivilege	2624	powershell.exe
Token: SeSystemProfilePrivilege	2624	powershell.exe
Token: SeSystemtimePrivilege	2624	powershell.exe
Token: SeProfSingleProcessPrivilege	2624	powershell.exe
Token: SeIncBasePriorityPrivilege	2624	powershell.exe
Token: SeCreatePagefilePrivilege	2624	powershell.exe
Token: SeBackupPrivilege	2624	powershell.exe
Token: SeRestorePrivilege	2624	powershell.exe
Token: SeShutdownPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeSystemEnvironmentPrivilege	2624	powershell.exe
Token: SeRemoteShutdownPrivilege	2624	powershell.exe
Token: SeUndockPrivilege	2624	powershell.exe
Token: SeManageVolumePrivilege	2624	powershell.exe
Token: 33	2624	powershell.exe
Token: 34	2624	powershell.exe
Token: 35	2624	powershell.exe
Token: 36	2624	powershell.exe
Token: SeDebugPrivilege	3584	prevhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 256	2976	wscript.exe	89
PID 2976 wrote to memory of 5896	2976	wscript.exe	91
PID 5896 wrote to memory of 6000	5896	cmd.exe	93
PID 5896 wrote to memory of 5052	5896	cmd.exe	94
PID 5896 wrote to memory of 5996	5896	cmd.exe	95
PID 5896 wrote to memory of 4752	5896	cmd.exe	96
PID 5896 wrote to memory of 5844	5896	cmd.exe	97
PID 5896 wrote to memory of 4300	5896	cmd.exe	98
PID 5896 wrote to memory of 3456	5896	cmd.exe	99
PID 5896 wrote to memory of 3900	5896	cmd.exe	100
PID 5896 wrote to memory of 1212	5896	cmd.exe	101
PID 5896 wrote to memory of 4952	5896	cmd.exe	102
PID 5896 wrote to memory of 4592	5896	cmd.exe	103
PID 5896 wrote to memory of 4480	5896	cmd.exe	104
PID 4480 wrote to memory of 2624	4480	powershell.exe	106
PID 5896 wrote to memory of 3652	5896	cmd.exe	108
PID 2624 wrote to memory of 2868	2624	powershell.exe	110
PID 2868 wrote to memory of 2092	2868	csc.exe	111
PID 2624 wrote to memory of 1116	2624	powershell.exe	112
PID 1116 wrote to memory of 4880	1116	csc.exe	113
PID 2624 wrote to memory of 2412	2624	powershell.exe	114
PID 2624 wrote to memory of 1016	2624	powershell.exe	115
PID 2412 wrote to memory of 3584	2412	msiexec.exe	116
PID 2412 wrote to memory of 3584	2412	msiexec.exe	116
PID 2412 wrote to memory of 3584	2412	msiexec.exe	116

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4752	attrib.exe
5844	attrib.exe
3900	attrib.exe
1212	attrib.exe
3652	attrib.exe
4300	attrib.exe
3456	attrib.exe
4952	attrib.exe
5052	attrib.exe
5996	attrib.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ 33419.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $OTDLON=$env:HSQSH;$RRWS=$env:KCPHOZQJ;$JQOVZCG=$env:REKGF+$env:DHUF+$env:JODNBXN+'.'+$env:UAKRV;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($JQOVZCG));$LHRCWLL=foreach($MASQYU in [IO.File]::ReadAllLines($RRWS)){if($MASQYU.IndexOf($OTDLON)-eq 0){$MASQYU.Substring($OTDLON.Length)}};[IO.File]::WriteAllLines($JQOVZCG,[string[]]@($LHRCWLL),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419740.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419740.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CLHVQUU))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6000
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.cmd"
    3⤵
    - Views/modifies file attributes
    PID:5052
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.bat"
    3⤵
    - Views/modifies file attributes
    PID:5996
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\jumplist_idx\jumplist_idx.dat"
    3⤵
    - Views/modifies file attributes
    PID:4752
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\jumplist_idx\jumplist_idx_PSCPZNSS.cmd"
    3⤵
    - Views/modifies file attributes
    PID:5844
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\jumplist_idx\jumplist_idx.dat"
    3⤵
    - Views/modifies file attributes
    PID:4300
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\jumplist_idx\jumplist_idx_PSCPZNSS.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3456
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\jumplist_idx"
    3⤵
    - Views/modifies file attributes
    PID:3900
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419740.cmd"
    3⤵
    - Views/modifies file attributes
    PID:1212
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\jumplist_idx\jumplist_idx_PEZUHENB.vbs"
    3⤵
    - Views/modifies file attributes
    PID:4952
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v TileStoreSync_LIFE /t REG_SZ /d "C:\Windows\System32\wscript.exe //B //nologo ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\jumplist_idx\jumplist_idx_PEZUHENB.vbs"""
    3⤵
    - Adds Run key to start application
    PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CLHVQUU))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CLHVQUU))"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hopfhmmg\hopfhmmg.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73A0.tmp" "c:\Users\Admin\AppData\Local\Temp\hopfhmmg\CSCC8E2C376104B4A2E8BAB24EADE7D61DD.TMP"
        6⤵
        
        PID:2092
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5t31mnvm\5t31mnvm.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1116
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74A9.tmp" "c:\Users\Admin\AppData\Local\Temp\5t31mnvm\CSCEA05AFCB214E4D53A43B68601DF2E1EA.TMP"
        6⤵
        
        PID:4880
    - - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2412
      - C:\Windows\system32\prevhost.exe
        
        "C:\Windows\system32\prevhost.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
    - - C:\Windows\system32\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        
        PID:1016
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419740.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20267251787624419740.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419740.cmd
Size 302KB
SHA256 a120a1ce60f21f8050ebbced8527c41529e93e801feb50cb13e26cc137f814fc
MD5 632e1b003f2f896ff097c932c05c05ad
SHA1 6d5e435f2cf4681eb85ab8421a184412d7dfe089
SHA512 3e653333989d96f50a47fb00e304393f6816d5c277bf63eafddc9020fedf93f7b76e4193df30cf7149dadeea8df587d5bd759e8e8111f4b0342a2b418d97b665
SSDEEP 6144:ipWlB053ds6H0DmbSex8jl6/t0RRrqn0m7RnUvgo4iRIwMWxPBC16MhG4Y8:iNs+8p6/MRUzavgolxUxY8
TLSH
T17D64F1F0A901BD616BF402A3C999DEC51BACE6D6C397F1CC784873D21A4E723EE25025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 f567c2c31603903065c15c1ac289f4d8dc1f8e258afd77bbb4649c71d2e56d8f
MD5 577766ce014fc071062e78c03f124c2b
SHA1 77bea107a682c0d610dd3d20c3278768137fb24d
SHA512 b99d651a960193d3f188acbdd7905b7b700262d3d6b3f51e56613d71c02238b2eb27d2985252d50b7f912a616ef61beac8c07850b907764bc8c405e7ab3a42a3
TLSH
T149116633F3CC8624DC5A403650DEAC1136B687CB409ECE6B7B84D154B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7a8ef3e2be3c4c43ee8abb7ae0a5730621310896948c75ad8ccf88881aee2350
MD5 f5acbcf25a96d909b593d9a39182b131
SHA1 7f3f2bc31ffe12819518a0e9197111e11023bb2c
SHA512 99ddb9accb310ddec8b404ebc5f126c82447d5684c6ea3800516a16a27085e1f60c6889fac3a35ac0b4d2e38751a902cb6f28d673e279e6a087f169f32df2722
TLSH
T197218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

5t31mnvm.dll

Path C:\Users\Admin\AppData\Local\Temp\5t31mnvm\5t31mnvm.dll
Size 66KB
SHA256 5753864e07a4aa1159675fd0838c0ab7fe3ee5f257744748fbe566afa28cac7b
MD5 7116c6b60a1c44751ece8a0632577355
SHA1 92025095e93923fb3691b06bd7cef4010a248f68
SHA512 5dd4d40c118ea01caabf9906b006fe7e6f8acbec33999a8ba979346a17429a4cc6308b1310d91f319d81d8bff8a9ae30fad1dba1ad58f82aeba6b5e1ef708fde
SSDEEP 1536:8pApJfk8mK288KbTC31L0Ea4WVIqJtPnItNGcMUYojGp/fCO+y34wgHHo5g97EaN:8pApJfTmKD8KbTClL0Ea4WfQQ5Ubjs32
TLSH
T13B63098577F84968F27E6B769AB101809734B0873B73E78E02E541E96F773C08616BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES73A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES73A0.tmp
Size 1KB
SHA256 e53a81519d293ab811e2541b599e3fc589b88e1539bb0dfe4cfef0ff7d69283e
MD5 2639dd7f62f24112e0d000e86efb7146
SHA1 861a9bb3c1615afc677e9b3bad2bd2f9ee5d1bfb
SHA512 4eba61a66d4a03149956214b2091cdd2a80cecebe976a644a81dadf2eef3534df29e2866c803a9fede8c73a02147feae8d0def2717ff736f030ded08b426088a
TLSH
T16721AA1493FD471FF077573268F6576FA274FC98EFA2A75A8544022C2C41604EEE1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES74A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES74A9.tmp
Size 1KB
SHA256 35277241ecee805f6a687b0f79121515ff51147593568184bfec788c3e230a57
MD5 09b27db598fc00b1030b821eaf7494ab
SHA1 120ab6f9ce880cf37fc530e038ae884eff13399c
SHA512 275822ba1bdb3a7b4a98220dd546b497ffa63862e677d4228b5a30e72606048b54dedfcbc1845a18f2da3db33e2b60501659affcae083871542dbdc7965b4578
TLSH
T186218C0483ED471FF073573169FA172BA278FD95EFA2E35A8540412D6C41644EEF0AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5lic3uwk.oln.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5lic3uwk.oln.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_2624_e597601.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_2624_e597601.txt
Size 70B
SHA256 817cc4bb96e652e715e04a0b5316f2e388b2fbb6db2f7e8542338fef47c6add8
MD5 88ff8d63de4a0ebce4317350d3d52fe4
SHA1 9534d574f91a5e2de4cf527acc79fe3be3c82737
SHA512 fa942d7633c6ee18ff4a2e50428c7a73813908da01414ed23a1a3af297fd57ccf3c21f9472ccfa09c7d93d613537bb52bc079a7c11dee7424ed17e9c0825c57f
TLSH
T13DA022AF0CB30C2AC22A8F28000C30C202E0B080A3C2A80083C003F0F008E30C300308
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_2624_e597601.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_2624_e597601.txt
Size 86B
SHA256 91cf8b90913695c563acb468d6af930499cd6638dfe21fcbb027ea3931da9671
MD5 fe44e81ab2f92d8cb9499c10f8fc15a1
SHA1 fc3176f4160970951121e70b192242eec24d6a4c
SHA512 d3d6b694a0034dd74515092f7aca679dcea2549c0b4a5284c5aa58262bef085f640d0734944b4a1158c403c779825d52035027128353da03f93621bc1277fefe
TLSH
T15CA0126E08630C15C1254F94100D30820190B44153C15480469003F0B008E22C700304
MD5 SHA1 SHA512 TLSH

Submit Download

hopfhmmg.dll

Path C:\Users\Admin\AppData\Local\Temp\hopfhmmg\hopfhmmg.dll
Size 3KB
SHA256 9237103fe5bb468db06ebcdc4c183a0fe90bfedad5b2299c7468006a27b774d2
MD5 80b0f4a602d7a605eacd873ef950fe65
SHA1 436cabe66b2cd986ae1923336379621b689592dd
SHA512 f00da29d2e18d4efff57da726a5612044e8c2b3d823e910229e675a4fb85f4671da9d336674aec229c147afede913b60a7ddbcc7a8c40349d227ac7c67aadad5
TLSH
T15E51872697FC422BF0B74731AEF3472637B4F860DB3293AA1981432C6C606645E21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

5t31mnvm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5t31mnvm\5t31mnvm.0.cs
Size 94KB
SHA256 5f4d4e74281a58bf7a234c7f569b852cf6c1ba5abaa9e07292d7b6f77fc8e374
MD5 fcb6c6ac1176f29df65c11c8fd36d41c
SHA1 f253f7f7eb567596e88149bd6d05582f5c2bd1b7
SHA512 93860cfe0f7767642b77f37486e032833fb4d204ada298f743c65d0e7508342681085070a57ec9c17ed9bb779413c4f3fba84a7c350e3555329b3dd51c5732a6
SSDEEP 1536:XzrlD7vZAJLdOmXJ5UftfVpqu9qMipdjbbdAMwndoDNkm/MqB21Ss:974dOg5UlfVpqu9qMipdjfdAMwdoDNkb
TLSH
T15993C591A709912E6DD02529ACCC604EFB53C53123F914B4D9ADC1A03E4E67DD2BFFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5t31mnvm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5t31mnvm\5t31mnvm.cmdline
Size 247B
SHA256 097d9d1f6a0f16a3eee3d499e43e9407523c9518b2a751eeee88b6ff60a5a897
MD5 052651073ede01fb297a7e29b6d96a5b
SHA1 fac6acae6d815f0978bba1c3298d5affddb1d109
SHA512 05203650d42f406d8e63925dae93c8486f7719e256ca82cedcc59486497fd25933219d2d1539f284ca1a94728c0d24d0596bfc01de49da3f05f00c97596a9462
TLSH
T1E6D0A729C3C7CA6D22EC90172B97D8DD83B6995A2A5F3F508790424D513F54877D3F82
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEA05AFCB214E4D53A43B68601DF2E1EA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5t31mnvm\CSCEA05AFCB214E4D53A43B68601DF2E1EA.TMP
Size 652B
SHA256 8b29f0b623400de9686f56925e1ddc86373d916426ec793a58f8693b99670067
MD5 26d67fb89df467aff82a3f52262979d9
SHA1 11b366df87aee4ac83f9d7ce3192351e2a6de885
SHA512 0dd6d60defbbb57766409f8258f68ff5144253b35b339b03586da26e26563e72d83277a7cf878d29bd9ff1cd2bc9330b3ef730c792f458b8510f7b410a0fbbf4
TLSH
T1C0F05E0963FC020EF0F34B30BEF683A391A8BC65DE7293ED5440035D68646108A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC8E2C376104B4A2E8BAB24EADE7D61DD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hopfhmmg\CSCC8E2C376104B4A2E8BAB24EADE7D61DD.TMP
Size 652B
SHA256 559d213a1eac836c221718f053d34d310bcd7f2c77ef29bf5118b185e10e6789
MD5 ff03a1c491ccef2b3d41cb523e991e10
SHA1 9840429bbb340b2e1feac9db5f23d68b058f4eb4
SHA512 17efa834cd634d155e156ef35f73e52e05458786a2b56d228560b9190cacbdfcea6b0c8a4411a22223e81d8bc00af98ab5a85a6b5013900ded01ffd33572899a
TLSH
T146F05E0963FC020EF0F34B72BDF6836395A8BCA4DF3293ED1450031928645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hopfhmmg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hopfhmmg\hopfhmmg.0.cs
Size 60B
SHA256 987fefb55f5ec95ae927ada3bfbfb64e8f022193cfb3296ec65b561053578c72
MD5 5008e65bbf396b7984284b437a87f2f2
SHA1 05c32416a4a9ffc8f61bbc7c754803b56dbc06d6
SHA512 004d9177e0fab5c1e109d5243259b07c4de2c67ae4f9137b611f866395bf987f534c1f58011dbfd3c5b54de2819469fd21fd83e79678d68b28578f01f28b73f8
TLSH
T1E0A002413651E5350987D803C511CC33EB0694F05BBC7E12C1550F113E0040BB23816B
MD5 SHA1 SHA512 TLSH

Submit Download

hopfhmmg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hopfhmmg\hopfhmmg.cmdline
Size 369B
SHA256 50586c18e7ea3bdabf942c5e0221b9433fffce93b25e56a29ca4ea37bedbf734
MD5 6144b84d20d446914aae58fbb9a899a9
SHA1 5b97c8d571f595b38d80cd7fe4450b968b3dfa69
SHA512 f3de1c767aaead824a40f758846dfe8352fec751388a366fa99cfba719a240ad6eec1fc8b9d48873c504ebc87b46ef8695349204a5fd1a35016ba48c62484ee5
TLSH
T134E0C02AC2CFC67E01DE200725B9C5ECC3F617C32940BF847081441FD0170042BD1745
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-7-0x00007FFF609E0000-0x00007FFF61384000-memory.dmp

Download

memory/256-9-0x00007FFF609E0000-0x00007FFF61384000-memory.dmp

Download

memory/256-4-0x00007FFF609E0000-0x00007FFF61384000-memory.dmp

Download

memory/256-5-0x00007FFF609E0000-0x00007FFF61384000-memory.dmp

Download

memory/256-0-0x00007FFF60B6F000-0x00007FFF60B70000-memory.dmp

Download

memory/256-6-0x00007FFF609E0000-0x00007FFF61384000-memory.dmp

Download

memory/256-12-0x00007FFF609E0000-0x00007FFF61384000-memory.dmp

Download

memory/256-3-0x00000125B4CE0000-0x00000125B4D02000-memory.dmp

Download

memory/256-10-0x00007FFF609E0000-0x00007FFF61384000-memory.dmp

Download

memory/2412-59-0x00000281BC9F0000-0x00000281BCA40000-memory.dmp

Download

memory/2412-80-0x00000281BA100000-0x00000281BA109000-memory.dmp

Download

memory/2412-79-0x00000281BA100000-0x00000281BA109000-memory.dmp

Download

memory/2412-76-0x00000281BC9F0000-0x00000281BCA40000-memory.dmp

Download

memory/2412-64-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/2624-45-0x000001A04AE30000-0x000001A04AE38000-memory.dmp

Download

memory/2624-58-0x000001A04B0C0000-0x000001A04B0D8000-memory.dmp

Download

memory/2624-31-0x000001A04B0F0000-0x000001A04B11A000-memory.dmp

Download

memory/2624-29-0x000001A04B240000-0x000001A04B2F2000-memory.dmp

Download

memory/2624-28-0x000001A04B1B0000-0x000001A04B1CE000-memory.dmp

Download

memory/2624-30-0x000001A04B3C0000-0x000001A04B3CA000-memory.dmp

Download

memory/2624-32-0x000001A04B0F0000-0x000001A04B114000-memory.dmp

Download

memory/3584-83-0x00000243865B0000-0x00000243865B1000-memory.dmp

Download

memory/3584-82-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/3584-91-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/3584-90-0x0000024386750000-0x000002438675E000-memory.dmp

Download