xworm | 0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
Size 747KB
Sample260830-3lphkabl3x
SHA256 0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139
MD5 f03ddef69caf6b0bdd009f2ec1f41c0b
SHA1 9fde07b3c8e28944dacdb8bdfada5a3d8bdf5eac
SHA512 8b97cfff357d553fa7355a42242cba07969f63ba3f4cc9813126c9a86a0175b2337f9220a84deb3f74d033fca3996a846f782c3c04dfb6eafab43de11a1d6c4e
SSDEEP 12288:yS1FlJdbPoA0/ncMpxV3AmQ4ZiCLQY8QUqf4NkAHAPO4xwoHZzAeETkmmOHBsNBV:VFd0/n3pxOmQ4Zi1nqf4SAHAPOYmTXHw
TLSH
T129F4121C6A1BE917C54013360BA1F275127E5EDAA812D227BFDD2EDFBE32B168D401D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery evasion execution xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:1012

Mutex

aGO284VKfQVe8Vup

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2932-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe
1660	powershell.exe
360	powershell.exe
3840	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe

Executes dropped EXE 4 IoCs

pid	Process
2760	bin.exe
5052	bin.exe
2148	bin.exe
5372	bin.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
Key opened	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
Key opened	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4132 set thread context of 2932	4132	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	89
PID 2760 set thread context of 5052	2760	bin.exe	108
PID 2148 set thread context of 5372	2148	bin.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
1660	powershell.exe
1660	powershell.exe
360	powershell.exe
360	powershell.exe
3840	powershell.exe
3840	powershell.exe
2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeIncreaseQuotaPrivilege	5040	powershell.exe
Token: SeSecurityPrivilege	5040	powershell.exe
Token: SeTakeOwnershipPrivilege	5040	powershell.exe
Token: SeLoadDriverPrivilege	5040	powershell.exe
Token: SeSystemProfilePrivilege	5040	powershell.exe
Token: SeSystemtimePrivilege	5040	powershell.exe
Token: SeProfSingleProcessPrivilege	5040	powershell.exe
Token: SeIncBasePriorityPrivilege	5040	powershell.exe
Token: SeCreatePagefilePrivilege	5040	powershell.exe
Token: SeBackupPrivilege	5040	powershell.exe
Token: SeRestorePrivilege	5040	powershell.exe
Token: SeShutdownPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeSystemEnvironmentPrivilege	5040	powershell.exe
Token: SeRemoteShutdownPrivilege	5040	powershell.exe
Token: SeUndockPrivilege	5040	powershell.exe
Token: SeManageVolumePrivilege	5040	powershell.exe
Token: 33	5040	powershell.exe
Token: 34	5040	powershell.exe
Token: 35	5040	powershell.exe
Token: 36	5040	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeIncreaseQuotaPrivilege	1660	powershell.exe
Token: SeSecurityPrivilege	1660	powershell.exe
Token: SeTakeOwnershipPrivilege	1660	powershell.exe
Token: SeLoadDriverPrivilege	1660	powershell.exe
Token: SeSystemProfilePrivilege	1660	powershell.exe
Token: SeSystemtimePrivilege	1660	powershell.exe
Token: SeProfSingleProcessPrivilege	1660	powershell.exe
Token: SeIncBasePriorityPrivilege	1660	powershell.exe
Token: SeCreatePagefilePrivilege	1660	powershell.exe
Token: SeBackupPrivilege	1660	powershell.exe
Token: SeRestorePrivilege	1660	powershell.exe
Token: SeShutdownPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeSystemEnvironmentPrivilege	1660	powershell.exe
Token: SeRemoteShutdownPrivilege	1660	powershell.exe
Token: SeUndockPrivilege	1660	powershell.exe
Token: SeManageVolumePrivilege	1660	powershell.exe
Token: 33	1660	powershell.exe
Token: 34	1660	powershell.exe
Token: 35	1660	powershell.exe
Token: 36	1660	powershell.exe
Token: SeDebugPrivilege	360	powershell.exe
Token: SeIncreaseQuotaPrivilege	360	powershell.exe
Token: SeSecurityPrivilege	360	powershell.exe
Token: SeTakeOwnershipPrivilege	360	powershell.exe
Token: SeLoadDriverPrivilege	360	powershell.exe
Token: SeSystemProfilePrivilege	360	powershell.exe
Token: SeSystemtimePrivilege	360	powershell.exe
Token: SeProfSingleProcessPrivilege	360	powershell.exe
Token: SeIncBasePriorityPrivilege	360	powershell.exe
Token: SeCreatePagefilePrivilege	360	powershell.exe
Token: SeBackupPrivilege	360	powershell.exe
Token: SeRestorePrivilege	360	powershell.exe
Token: SeShutdownPrivilege	360	powershell.exe
Token: SeDebugPrivilege	360	powershell.exe
Token: SeSystemEnvironmentPrivilege	360	powershell.exe
Token: SeRemoteShutdownPrivilege	360	powershell.exe
Token: SeUndockPrivilege	360	powershell.exe
Token: SeManageVolumePrivilege	360	powershell.exe
Token: 33	360	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2932	4132	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	89
PID 4132 wrote to memory of 2932	4132	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	89
PID 4132 wrote to memory of 2932	4132	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	89
PID 4132 wrote to memory of 2932	4132	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	89
PID 4132 wrote to memory of 2932	4132	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	89
PID 2932 wrote to memory of 5040	2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	90
PID 2932 wrote to memory of 1660	2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	93
PID 2932 wrote to memory of 360	2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	96
PID 2932 wrote to memory of 3840	2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	98
PID 2932 wrote to memory of 3404	2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	100
PID 2932 wrote to memory of 4852	2932	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe	105
PID 4852 wrote to memory of 4220	4852	csc.exe	107
PID 2760 wrote to memory of 5052	2760	bin.exe	108
PID 2760 wrote to memory of 5052	2760	bin.exe	108
PID 2760 wrote to memory of 5052	2760	bin.exe	108
PID 2760 wrote to memory of 5052	2760	bin.exe	108
PID 2760 wrote to memory of 5052	2760	bin.exe	108
PID 2148 wrote to memory of 5372	2148	bin.exe	110
PID 2148 wrote to memory of 5372	2148	bin.exe	110
PID 2148 wrote to memory of 5372	2148	bin.exe	110
PID 2148 wrote to memory of 5372	2148	bin.exe	110
PID 2148 wrote to memory of 5372	2148	bin.exe	110

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe

C:\Users\Admin\AppData\Local\Temp\0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
"C:\Users\Admin\AppData\Local\Temp\0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe
  "C:\Users\Admin\AppData\Local\Temp\0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe"
  2⤵
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:360
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3840
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_e3d8e6b739c6480fbef6a4271a2bff8c.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4EA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEDBE73A2CAE244068ABC6A2E32BFE7B.TMP"
      4⤵
      PID:4220

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5052

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 b2c5528ed7cba1837e9f6001803374231975da4e6e0954f675e54e79ad633394
MD5 ce39338c0df11faa8e670be9c07a35c4
SHA1 26233656127ae1a68e7b283a1613a3ca8fef1080
SHA512 ee92a968f8ee53087d03747a4c2dde1c01bbbfa9bbf6bc4d86d68a7c91025e2883b1cb906e77fd43ab0f2313b21cf3210160817df96d30ac4624740b9e6e9860
SSDEEP 384:OISEboT1iBGDGW14bT3u+8tJ+geC4hp2Pn9IAXz48+FWbStzKwEvYbhNaPkWRtTa:OM0Z6GKWiv++8v+7k1IAXzX+RV7bhNaG
TLSH
T1B4A2B578213F6DC7D8D216B010D10AF7FBE4E489DAB651D4BF1BDA2F4C90EB64A60624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 b715ffeebac0f794d5fbbba720704829f76244b60a69156edaec70590405308f
MD5 892267bf15a9c61f728fcb3844bcc83f
SHA1 78ed4660b458123c97fb7a26ea6b157d2d1e14ac
SHA512 1e6dcc5b7e21a35f8aec3e9101d3a7c177f92e315924dbb7ee4d4a5c3a629b54b711f600956859e38c5ccda41618406e83d2aab9bb28bf5aa455daffd52b5260
SSDEEP 384:H1eBaoT1iBGSb8Xj0Y6+EEeThR2Pnf0BWIAgKIZREoaqB3KFw/7hN/UJhqRWhjBF:VexZ6GSbKjt6+tyS30BWIAgK6GoaM6Fz
TLSH
T178A2F62D266F88CFD85261B400824783F7A8D559EBE192DBBF0BC91F1C09A7D5E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 d89a3f6ae1e4fad791e2a60a3e5ca8a47a197474cf7871e54816983481154e3b
MD5 64c9bb55e0e8fa6b9573faa1da8d07ef
SHA1 0dcb94e02a187233c22157dff0c431387b889eb5
SHA512 88f9abe454d75e9f49835d282248ae9dd4a99ce06be8784b94c98ad1f62055d0bb1f9bc1d93b4268fa923b499b73fc0fc291e8160ec535047ddb69d3fcecb244
SSDEEP 384:71eBaoT1iBGtRGW16l1LqTf+J5niD+ggrr2PtWOEPiUDzdC0wIAXIjbQxVOaqBUn:5exZ6GtEWYl1L+foZiD+gQ6UN6UFC0wp
TLSH
T103A2072C26AF8CCFD95161B800810786FBF8D555E3D192DBAB5BCA1F2C41A3E5E900F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESD4EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD4EA.tmp
Size 2KB
SHA256 e6c0898b3d9e60e5c6a433ca02a4dd3022b650693dc8d3fe4dea114eadc4fd12
MD5 af37dc873baff21346b23002ab486e3e
SHA1 20f22cb8ac39699752405fae65bb96b5bc89a1ef
SHA512 512e0997d07344e80b80f5cb3492aa44855cfa349babc41412831e02078a75e0ca8bcc25239e1283072399c97d18bd346c127e0024509c547edfcc2706216328
TLSH
T11641401497D88B2FE172433058F2935AFA647D52BE5A5B4E718A132E1E03B80DDC32B6
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b4dchjk2.y5h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b4dchjk2.y5h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 747KB
SHA256 0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139
MD5 f03ddef69caf6b0bdd009f2ec1f41c0b
SHA1 9fde07b3c8e28944dacdb8bdfada5a3d8bdf5eac
SHA512 8b97cfff357d553fa7355a42242cba07969f63ba3f4cc9813126c9a86a0175b2337f9220a84deb3f74d033fca3996a846f782c3c04dfb6eafab43de11a1d6c4e
SSDEEP 12288:yS1FlJdbPoA0/ncMpxV3AmQ4ZiCLQY8QUqf4NkAHAPO4xwoHZzAeETkmmOHBsNBV:VFd0/n3pxOmQ4Zi1nqf4SAHAPOYmTXHw
TLSH
T129F4121C6A1BE917C54013360BA1F275127E5EDAA812D227BFDD2EDFBE32B168D401D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCEDBE73A2CAE244068ABC6A2E32BFE7B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCEDBE73A2CAE244068ABC6A2E32BFE7B.TMP
Size 1KB
SHA256 0cc63bc9dc4359d0a74d721086dc5ec82e6b97cae9673727b4be3e270b4f2cea
MD5 ec5991a528df0e6e528a6153c7e17309
SHA1 a60b214342d772d3e115db98ff69a2404cd94a7a
SHA512 3191f0da260e12def7aaf85a096ac01acd04c027c7f1bc85ddda3bb3ea6043447a321b7a6d9b34b26eb9b9d72322565b2e574c78233df25842a99ee374237d55
TLSH
T14C21CD54A6E4522EF1B38330A9F182A3EA587E136D6A4B9D308A134B1A16B4189C35BD
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_e3d8e6b739c6480fbef6a4271a2bff8c.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_e3d8e6b739c6480fbef6a4271a2bff8c.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-47-0x0000000005A10000-0x0000000005D6B000-memory.dmp

Download

memory/360-51-0x0000000071330000-0x000000007137C000-memory.dmp

Download

memory/1660-42-0x0000000071330000-0x000000007137C000-memory.dmp

Download

memory/2760-69-0x0000000005190000-0x00000000051A4000-memory.dmp

Download

memory/2760-80-0x0000000006520000-0x00000000065C6000-memory.dmp

Download

memory/2932-71-0x0000000007D70000-0x0000000007DEC000-memory.dmp

Download

memory/2932-66-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2932-12-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2932-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2932-72-0x0000000008070000-0x0000000008078000-memory.dmp

Download

memory/2932-46-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2932-70-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/2932-81-0x0000000008B00000-0x0000000008CC2000-memory.dmp

Download

memory/3840-58-0x0000000071330000-0x000000007137C000-memory.dmp

Download

memory/4132-13-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/4132-0-0x0000000074FA2000-0x0000000074FA3000-memory.dmp

Download

memory/4132-1-0x0000000000010000-0x00000000000D2000-memory.dmp

Download

memory/4132-2-0x0000000005150000-0x000000000570A000-memory.dmp

Download

memory/4132-3-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Download

memory/4132-4-0x0000000004C00000-0x0000000004C0A000-memory.dmp

Download

memory/4132-5-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/4132-6-0x0000000004DF0000-0x0000000004E04000-memory.dmp

Download

memory/4132-7-0x0000000074FA2000-0x0000000074FA3000-memory.dmp

Download

memory/4132-8-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/4132-9-0x0000000005010000-0x00000000050AC000-memory.dmp

Download

memory/4132-10-0x00000000050B0000-0x0000000005156000-memory.dmp

Download

memory/5040-34-0x00000000077F0000-0x000000000780A000-memory.dmp

Download

memory/5040-24-0x0000000006190000-0x00000000064EB000-memory.dmp

Download

memory/5040-23-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/5040-21-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/5040-22-0x0000000005F30000-0x0000000005F96000-memory.dmp

Download

memory/5040-17-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/5040-15-0x00000000058E0000-0x0000000005F2A000-memory.dmp

Download

memory/5040-16-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/5040-14-0x0000000002C20000-0x0000000002C56000-memory.dmp

Download

memory/5040-18-0x00000000057C0000-0x00000000057E2000-memory.dmp

Download

memory/5040-38-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/5040-36-0x0000000007A60000-0x0000000007AF6000-memory.dmp

Download

memory/5040-35-0x0000000007860000-0x000000000786A000-memory.dmp

Download

memory/5040-25-0x0000000006120000-0x000000000613E000-memory.dmp

Download

memory/5040-33-0x0000000007E30000-0x00000000084AC000-memory.dmp

Download

memory/5040-32-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/5040-31-0x0000000006A70000-0x0000000006A90000-memory.dmp

Download

memory/5040-28-0x0000000071330000-0x000000007137C000-memory.dmp

Download

memory/5040-27-0x0000000007690000-0x00000000076C6000-memory.dmp

Download

memory/5040-26-0x0000000006540000-0x000000000658C000-memory.dmp

Download