xworm | 2bff9eeb072e4d37e129e9d37eb7c866051be1ace3d8702fc7ddac0953ea8dcd

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MT 103 USD 65660.01.js
Size 101KB
Sample261022-e19kaax1dw
SHA256 2bff9eeb072e4d37e129e9d37eb7c866051be1ace3d8702fc7ddac0953ea8dcd
MD5 065cdc313b853fb3cac3d5bdb146ebc2
SHA1 09b92cc4230ca50f10953ee35cec7458191de67b
SHA512 1284976e3262bc1de1de531ceeb53eee6cf34e8c79fa6c4fa7176157e31c512cd5b7643c0841834b2e19ab53fe48919f067110ab1e0196e32fb8dec1a93e5695
SSDEEP 768:HNfPhmziQ0kdcmVeD0zBNVlBqEa6H65ITWhQ:HFPQmQ0YcmVrB/lBqEa6H6vQ
TLSH
T1E5A3543DAD9A123B8AF9C759C1C61907F15396973135AD0D84EF53898BA3283BCC532E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://rough-truth-e072.publicftpresend.workers.dev/pfeeitvv
exe.dropper
https://rough-truth-e072.publicftpresend.workers.dev/pfeeitvv

Extracted

Family

xworm

Version

147.124.216.205:5151

Mutex

uW1YQSdZK8XVNNoZ

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4432-23-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2844	powershell.exe	90

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1744	powershell.exe
9	1744	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1744	powershell.exe
5560	powershell.exe
4624	powershell.exe
752	powershell.exe
4836	powershell.exe

System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 3 IoCs

Abuse Regasm to proxy execution of malicious code.

defense_evasion

Regsvcs/Regasm

T1218.009

description	ioc	Process
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	powershell.exe
File created	\??\c:\Users\Admin\AppData\Local\Temp\RegAsm.exe	csc.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	RegAsm.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RegAsm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RegAsm.exe

Executes dropped EXE 1 IoCs

pid	Process
4592	RegAsm.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 4432	1744	powershell.exe	93

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	RegAsm.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1744	powershell.exe
1744	powershell.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
752	powershell.exe
752	powershell.exe
752	powershell.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe
4432	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe
4592	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	4432	RegAsm.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeIncreaseQuotaPrivilege	5560	powershell.exe
Token: SeSecurityPrivilege	5560	powershell.exe
Token: SeTakeOwnershipPrivilege	5560	powershell.exe
Token: SeLoadDriverPrivilege	5560	powershell.exe
Token: SeSystemProfilePrivilege	5560	powershell.exe
Token: SeSystemtimePrivilege	5560	powershell.exe
Token: SeProfSingleProcessPrivilege	5560	powershell.exe
Token: SeIncBasePriorityPrivilege	5560	powershell.exe
Token: SeCreatePagefilePrivilege	5560	powershell.exe
Token: SeBackupPrivilege	5560	powershell.exe
Token: SeRestorePrivilege	5560	powershell.exe
Token: SeShutdownPrivilege	5560	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeSystemEnvironmentPrivilege	5560	powershell.exe
Token: SeRemoteShutdownPrivilege	5560	powershell.exe
Token: SeUndockPrivilege	5560	powershell.exe
Token: SeManageVolumePrivilege	5560	powershell.exe
Token: 33	5560	powershell.exe
Token: 34	5560	powershell.exe
Token: 35	5560	powershell.exe
Token: 36	5560	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeIncreaseQuotaPrivilege	4624	powershell.exe
Token: SeSecurityPrivilege	4624	powershell.exe
Token: SeTakeOwnershipPrivilege	4624	powershell.exe
Token: SeLoadDriverPrivilege	4624	powershell.exe
Token: SeSystemProfilePrivilege	4624	powershell.exe
Token: SeSystemtimePrivilege	4624	powershell.exe
Token: SeProfSingleProcessPrivilege	4624	powershell.exe
Token: SeIncBasePriorityPrivilege	4624	powershell.exe
Token: SeCreatePagefilePrivilege	4624	powershell.exe
Token: SeBackupPrivilege	4624	powershell.exe
Token: SeRestorePrivilege	4624	powershell.exe
Token: SeShutdownPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeSystemEnvironmentPrivilege	4624	powershell.exe
Token: SeRemoteShutdownPrivilege	4624	powershell.exe
Token: SeUndockPrivilege	4624	powershell.exe
Token: SeManageVolumePrivilege	4624	powershell.exe
Token: 33	4624	powershell.exe
Token: 34	4624	powershell.exe
Token: 35	4624	powershell.exe
Token: 36	4624	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeIncreaseQuotaPrivilege	752	powershell.exe
Token: SeSecurityPrivilege	752	powershell.exe
Token: SeTakeOwnershipPrivilege	752	powershell.exe
Token: SeLoadDriverPrivilege	752	powershell.exe
Token: SeSystemProfilePrivilege	752	powershell.exe
Token: SeSystemtimePrivilege	752	powershell.exe
Token: SeProfSingleProcessPrivilege	752	powershell.exe
Token: SeIncBasePriorityPrivilege	752	powershell.exe
Token: SeCreatePagefilePrivilege	752	powershell.exe
Token: SeBackupPrivilege	752	powershell.exe
Token: SeRestorePrivilege	752	powershell.exe
Token: SeShutdownPrivilege	752	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeSystemEnvironmentPrivilege	752	powershell.exe
Token: SeRemoteShutdownPrivilege	752	powershell.exe
Token: SeUndockPrivilege	752	powershell.exe
Token: SeManageVolumePrivilege	752	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4432	1744	powershell.exe	93
PID 1744 wrote to memory of 4432	1744	powershell.exe	93
PID 1744 wrote to memory of 4432	1744	powershell.exe	93
PID 1744 wrote to memory of 4432	1744	powershell.exe	93
PID 1744 wrote to memory of 4432	1744	powershell.exe	93
PID 4432 wrote to memory of 5560	4432	RegAsm.exe	94
PID 4432 wrote to memory of 4624	4432	RegAsm.exe	97
PID 4432 wrote to memory of 752	4432	RegAsm.exe	99
PID 4432 wrote to memory of 4836	4432	RegAsm.exe	101
PID 4432 wrote to memory of 3276	4432	RegAsm.exe	104
PID 3276 wrote to memory of 4156	3276	csc.exe	106
PID 4432 wrote to memory of 4592	4432	RegAsm.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\MT 103 USD 65660.01.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Temp\rad5F6D6.tmp.ps1'; Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\rad5F6D6.tmp.ps1' -Force -ErrorAction SilentlyContinue"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Binary Proxy Execution: Regsvcs/Regasm
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Binary Proxy Execution: Regsvcs/Regasm
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4432
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4836
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_8f758d8141f84863a5b833ebb82db959.cs"
    3⤵
    - System Binary Proxy Execution: Regsvcs/Regasm
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED92.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8E7BD5AA805C4E8F9828D746C47828BD.TMP"
      4⤵
      PID:4156
- - C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" 4432
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

System Binary Proxy Execution

T1218

Regsvcs/Regasm

T1218.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7220bebdc502d464ae7087a99c3ede4111dd6b76b8489a2281ce01b4d63566f2
MD5 a3f595a1aa2a536a8f5ea99d048d48f4
SHA1 338a8fc468e637d82860acb35a8fa1a7dcc8e945
SHA512 b588bcf414558b1d680c337993cac897ac4331c56c7d0137197bdbaf57c68eac5353175e17999f7d46c91c4133cc3ef2bd0d5ff4935ebde2d3e7864a688c70c9
TLSH
T195216877F3DC8611DC9A403A50CEAC1436B687DB41DECF9BBB84D654A43F699CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 d652c466cbd8ec0fd7c58528d6315e9c483d1eca84b2226dc9a39f18a8d762a8
MD5 b8eb28842761404d376c6e8510f31166
SHA1 394f4fb33ae66cf103b30176f7945e0c13ca905b
SHA512 a0065b55a8a3188b4c2a26805bd218b2ce4834b8a593caabdd4499ac0a31ca4a09a6966f14d5bbdde36cca843fdf3bfb5ee6d53776d02d190aeb191f08f0bf87
SSDEEP 384:U1eBaoT1iBG+GW14biC/cp0ei+rLevrr2PndIAXz48+dWLStzKwIvYbhNqPMlRt6:AexZ6GNWieCl5+re61IAXzX+FVHbhNqJ
TLSH
T181A2B678213F6DC7D8D216B410D10AE7FBE4D489DAB610E4BF2BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 b24ef6f231e7020e83f5bab5247064e659afcfc7927bc0ed1bc41cb3de3e0af5
MD5 0cdee22a30f98248fe28f7c93cf31032
SHA1 f24d1e4ebc73865cf81ee63d3637155560693065
SHA512 d415e3a081216033122a0de043422bb89cd43e7f3da817d30ee6a7613de9eb9ec0a7722466209fc91b26a71504931833f6be6f40be10cd33b05635a2940332ee
SSDEEP 384:g1eBaoT1iBGQclb8Nonf+i9WIzhR2PtWOEPiUDzdC0MIACOIIuMxVOaqBBKpNv26:MexZ6GQclQ6f+iUESUN6UFC0MIAXD5bP
TLSH
T189A2F929226F5DCBC99121B810820797FBF4D459EBE151DBEB1BC91F1C81A7E8E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 a677d506489a88fc99260301941e192297e5ed3d9f4bcb5d2688febb47decaea
MD5 ea50822075740313b8f7bc9dd875a547
SHA1 3321c95cf270f034a74833d7871e909bab1d33e0
SHA512 24ac961d9bd2b3b5d39ba40b5daeac724881867db23e7a408170b95a648370319a4f0223f9a2adca3047448bf7a50dfbf57388e023d1ba2b45607bcf1b43f82f
SSDEEP 384:z1eBaoT1iBGXRiVawINDn4YIMH+xcorr2PuzdC0wIACOI/CvoaqB3KFpk7EJ5hWm:hexZ6GXAVawcDbZH+qY6cC0wIAXboaME
TLSH
T152A2081C266F89CFD99162B810824782FBF8D194E6E152DBFB5BC91F2C41A7E5E500F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESED92.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESED92.tmp
Size 1KB
SHA256 779f392c4106c86612fe1bb5c06a4dc738265ce5b117d4a027fed7451f9c6403
MD5 3576044a24d0b76cfad126a2ad9af566
SHA1 2080c4cd643e146363286eea3abfa0e5618f1217
SHA512 6d0409413a6e50f443a04e2fa3752fcc53ce38f7f60743011aa50d35a5c2ebc27978849411fd6b27a5a79b2144ec6f330ae626ae83ba7762436f9ab0b903ce3d
TLSH
T19741114083D84B2FE172473128F75725A678FE559EAA475EB888122E1E02740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Size 5KB
SHA256 ae3bfc98a7dba3b11107f612d7dd88d1ff8a76ecb714d06ce4209afc77daddc6
MD5 890d69d8320c5963e9a6b00a8f4342cb
SHA1 2de0d9d016da9203b25d52985477693c384b87fd
SHA512 ecea471c27b9d304210458c048c7fb04999724b465a9acef9e86c085dd544196ad6ab22f520d2923db90748a8a84978da92d6fef0a886bb3d6168cd54b0f2613
SSDEEP 96:rdew7V9qOOogcO8BynqgHlNxAEU7yxkfzNt:rv2OOwOoyqgHjvU7rJ
TLSH
T186C1B44797DC4366E0620731B9B3035527B8E9125A6BABAF24F4137A6EB639008173F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fikahyzy.thy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fikahyzy.thy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rad5F6D6.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\rad5F6D6.tmp.ps1
Size 1KB
SHA256 df71efa9915460ac3e12e7351def6f03690abf02370acfdd68de8522b4c7207a
MD5 f9aef6207d2a258447786472a381a0ce
SHA1 09b3a55e9a13a986807ca2886eac41056d936bb9
SHA512 ff590f097b7aecb87af6705d63fbf67543ef5c87cf7a641a2fadf8a5f1737cec36ebe997198b3a1dd1c58c56462b97554a0517eca31dd7c9a2a06339e05b7342
TLSH
T1F341A6DB967E31A6CC8A9AF9749640C8ED4E06C21505B4B2B6F0CF2D1612DF910796B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8E7BD5AA805C4E8F9828D746C47828BD.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC8E7BD5AA805C4E8F9828D746C47828BD.TMP
Size 1KB
SHA256 bd34fc804bcc189e1fd1b627b7285791b619377024dedd44186a5b1ad672befa
MD5 97ec6b32eec4673a2550f2676ecbd6c8
SHA1 b606c06593f3f969cf98dba246111075b548a761
SHA512 b4679a83961e687b6b3d3a8f772e0be6f44b3edf072a585dd96a107d0bdeeda0b34f32d4397b520c4f8c24af54e4d395f497d59f1c07c6a61127f9c1d867d24b
TLSH
T15721AB41A2E8421EF2B34B7179F2C362A1ACBE568D7A43EC7488175F1F16900C5836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_8f758d8141f84863a5b833ebb82db959.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_8f758d8141f84863a5b833ebb82db959.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-81-0x000000006FB50000-0x000000006FB9C000-memory.dmp

Download

memory/1744-20-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-25-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-19-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-1-0x00007FF9C2F3F000-0x00007FF9C2F40000-memory.dmp

Download

memory/1744-21-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-22-0x0000021D7DC70000-0x0000021D7DCAA000-memory.dmp

Download

memory/1744-15-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-17-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-14-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-16-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-13-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-11-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-18-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-7-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/1744-8-0x0000021D7D9E0000-0x0000021D7DA02000-memory.dmp

Download

memory/1744-10-0x00007FF9C2DB0000-0x00007FF9C3754000-memory.dmp

Download

memory/4432-26-0x0000000074162000-0x0000000074163000-memory.dmp

Download

memory/4432-109-0x0000000074150000-0x000000007490C000-memory.dmp

Download

memory/4432-114-0x0000000007770000-0x0000000007778000-memory.dmp

Download

memory/4432-113-0x00000000076B0000-0x000000000772C000-memory.dmp

Download

memory/4432-112-0x0000000007B70000-0x000000000812A000-memory.dmp

Download

memory/4432-111-0x0000000007510000-0x00000000075A2000-memory.dmp

Download

memory/4432-110-0x0000000074150000-0x000000007490C000-memory.dmp

Download

memory/4432-23-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4432-27-0x0000000005440000-0x00000000054DC000-memory.dmp

Download

memory/4432-96-0x0000000074162000-0x0000000074163000-memory.dmp

Download

memory/4432-126-0x0000000008480000-0x0000000008642000-memory.dmp

Download

memory/4592-125-0x0000000000160000-0x0000000000168000-memory.dmp

Download

memory/4624-58-0x00000000058E0000-0x0000000005C3B000-memory.dmp

Download

memory/4624-66-0x000000006FB50000-0x000000006FB9C000-memory.dmp

Download

memory/4836-97-0x000000006FB50000-0x000000006FB9C000-memory.dmp

Download

memory/5560-30-0x0000000005100000-0x0000000005122000-memory.dmp

Download

memory/5560-56-0x00000000075C0000-0x0000000007656000-memory.dmp

Download

memory/5560-55-0x00000000073C0000-0x00000000073CA000-memory.dmp

Download

memory/5560-53-0x0000000007990000-0x000000000800C000-memory.dmp

Download

memory/5560-54-0x0000000007350000-0x000000000736A000-memory.dmp

Download

memory/5560-52-0x0000000007210000-0x00000000072B3000-memory.dmp

Download

memory/5560-51-0x0000000006FB0000-0x0000000006FD0000-memory.dmp

Download

memory/5560-43-0x0000000006FD0000-0x0000000007006000-memory.dmp

Download

memory/5560-44-0x000000006FB50000-0x000000006FB9C000-memory.dmp

Download

memory/5560-42-0x0000000006010000-0x000000000605C000-memory.dmp

Download

memory/5560-41-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

Download

memory/5560-39-0x0000000005AD0000-0x0000000005E2B000-memory.dmp

Download

memory/5560-32-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Download

memory/5560-31-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download

memory/5560-29-0x00000000052F0000-0x000000000593A000-memory.dmp

Download

memory/5560-28-0x00000000027D0000-0x0000000002806000-memory.dmp

Download