xworm | b8444cb7142e36826e8f6c23166079795a5e6bbb56a32bcd00ac061d37fdd1b0

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTATION LIST_0398383_xls.JS.js
Size 3.3MB
Sample261027-q279dset6l
SHA256 b8444cb7142e36826e8f6c23166079795a5e6bbb56a32bcd00ac061d37fdd1b0
MD5 16398359a93c29b68ad7a61aef9428fb
SHA1 d21d5f5f5e9a0d40d8f3a1b35958275c90111cdb
SHA512 f123d7c3ffdb5d2923db7936bf2e0a2aee4030261e6c4a86030fa1dc1e06bf388cf547561cd8b6888b2fbb0488a0d90e2e2a25f82f62022fd9901e32e999bb20
SSDEEP 98304:YXynY+6pn8aY7mv1eSc1kPs6spRhz7eQvE8Rph3+NbZbb8EwglcJS7ENt8BSscHw:YX+Yzpn8aY71k02Q2dbb8H5JS7ZSsMId
TLSH
T10BF5928513C79532332FEB5C82369921990A500329C5DB39317CE31A767FE1BAF5CAE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

203.202.232.254:1122

Mutex

oM38H86nW2afasqD

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4568-156-0x0000000029BB0000-0x0000000029BC0000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5964	powershell.exe
5268	powershell.exe
1808	powershell.exe
3948	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4568	XHVGFGUFHRPULMBA.exe
1100	XHVGFGUFHRPULMBA.exe
2012	XWormClient.exe
2592	XHVGFGUFHRPULMBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\ABMLUPRHFUGFGVHX.vbs"	XHVGFGUFHRPULMBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Documents\\ABMLUPRHFUGFGVHX.vbs"	XHVGFGUFHRPULMBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	XHVGFGUFHRPULMBA.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5672	WScript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4568	XHVGFGUFHRPULMBA.exe
4568	XHVGFGUFHRPULMBA.exe
1100	XHVGFGUFHRPULMBA.exe
1100	XHVGFGUFHRPULMBA.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	XHVGFGUFHRPULMBA.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5040	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XHVGFGUFHRPULMBA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XHVGFGUFHRPULMBA.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XHVGFGUFHRPULMBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XHVGFGUFHRPULMBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	WScript.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\QUOTATION LIST_0398383_xls.JS.js:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5964	powershell.exe
5964	powershell.exe
5268	powershell.exe
5268	powershell.exe
1808	powershell.exe
1808	powershell.exe
3948	powershell.exe
3948	powershell.exe
4568	XHVGFGUFHRPULMBA.exe
4568	XHVGFGUFHRPULMBA.exe
4568	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe
2592	XHVGFGUFHRPULMBA.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	XHVGFGUFHRPULMBA.exe
Token: SeDebugPrivilege	1100	XHVGFGUFHRPULMBA.exe
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeIncreaseQuotaPrivilege	5964	powershell.exe
Token: SeSecurityPrivilege	5964	powershell.exe
Token: SeTakeOwnershipPrivilege	5964	powershell.exe
Token: SeLoadDriverPrivilege	5964	powershell.exe
Token: SeSystemProfilePrivilege	5964	powershell.exe
Token: SeSystemtimePrivilege	5964	powershell.exe
Token: SeProfSingleProcessPrivilege	5964	powershell.exe
Token: SeIncBasePriorityPrivilege	5964	powershell.exe
Token: SeCreatePagefilePrivilege	5964	powershell.exe
Token: SeBackupPrivilege	5964	powershell.exe
Token: SeRestorePrivilege	5964	powershell.exe
Token: SeShutdownPrivilege	5964	powershell.exe
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeSystemEnvironmentPrivilege	5964	powershell.exe
Token: SeRemoteShutdownPrivilege	5964	powershell.exe
Token: SeUndockPrivilege	5964	powershell.exe
Token: SeManageVolumePrivilege	5964	powershell.exe
Token: 33	5964	powershell.exe
Token: 34	5964	powershell.exe
Token: 35	5964	powershell.exe
Token: 36	5964	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	5268	powershell.exe
Token: SeSecurityPrivilege	5268	powershell.exe
Token: SeTakeOwnershipPrivilege	5268	powershell.exe
Token: SeLoadDriverPrivilege	5268	powershell.exe
Token: SeSystemProfilePrivilege	5268	powershell.exe
Token: SeSystemtimePrivilege	5268	powershell.exe
Token: SeProfSingleProcessPrivilege	5268	powershell.exe
Token: SeIncBasePriorityPrivilege	5268	powershell.exe
Token: SeCreatePagefilePrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5268	powershell.exe
Token: SeRestorePrivilege	5268	powershell.exe
Token: SeShutdownPrivilege	5268	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeSystemEnvironmentPrivilege	5268	powershell.exe
Token: SeRemoteShutdownPrivilege	5268	powershell.exe
Token: SeUndockPrivilege	5268	powershell.exe
Token: SeManageVolumePrivilege	5268	powershell.exe
Token: 33	5268	powershell.exe
Token: 34	5268	powershell.exe
Token: 35	5268	powershell.exe
Token: 36	5268	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeIncreaseQuotaPrivilege	1808	powershell.exe
Token: SeSecurityPrivilege	1808	powershell.exe
Token: SeTakeOwnershipPrivilege	1808	powershell.exe
Token: SeLoadDriverPrivilege	1808	powershell.exe
Token: SeSystemProfilePrivilege	1808	powershell.exe
Token: SeSystemtimePrivilege	1808	powershell.exe
Token: SeProfSingleProcessPrivilege	1808	powershell.exe
Token: SeIncBasePriorityPrivilege	1808	powershell.exe
Token: SeCreatePagefilePrivilege	1808	powershell.exe
Token: SeBackupPrivilege	1808	powershell.exe
Token: SeRestorePrivilege	1808	powershell.exe
Token: SeShutdownPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeSystemEnvironmentPrivilege	1808	powershell.exe
Token: SeRemoteShutdownPrivilege	1808	powershell.exe
Token: SeUndockPrivilege	1808	powershell.exe
Token: SeManageVolumePrivilege	1808	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4568	XHVGFGUFHRPULMBA.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 5040	4116	wscript.exe	89
PID 4116 wrote to memory of 4568	4116	wscript.exe	91
PID 5672 wrote to memory of 1100	5672	WScript.exe	95
PID 4568 wrote to memory of 5964	4568	XHVGFGUFHRPULMBA.exe	97
PID 4568 wrote to memory of 5268	4568	XHVGFGUFHRPULMBA.exe	100
PID 4568 wrote to memory of 1808	4568	XHVGFGUFHRPULMBA.exe	102
PID 4568 wrote to memory of 3948	4568	XHVGFGUFHRPULMBA.exe	104
PID 4568 wrote to memory of 5988	4568	XHVGFGUFHRPULMBA.exe	109
PID 5988 wrote to memory of 1476	5988	csc.exe	111
PID 4568 wrote to memory of 2592	4568	XHVGFGUFHRPULMBA.exe	112

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\QUOTATION LIST_0398383_xls.JS.js"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\QUOTATION LIST_0398383_xls.JS.js:Zone.Identifier"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  PID:5040
- C:\Users\Admin\Documents\XHVGFGUFHRPULMBA.exe
  "C:\Users\Admin\Documents\XHVGFGUFHRPULMBA.exe" C:\Users\Admin\Documents\ABMLUPRHFUGFGVHX
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\XHVGFGUFHRPULMBA.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XHVGFGUFHRPULMBA.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5268
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XHVGFGUFHRPULMBA.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_0e14a319cab649789bc704e8d7e1653f.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FC1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD81D49EFF584CA39638DF78AF68EF55.TMP"
      4⤵
      PID:1476
- - C:\Users\Admin\AppData\Local\Temp\XHVGFGUFHRPULMBA.exe
    "C:\Users\Admin\AppData\Local\Temp\XHVGFGUFHRPULMBA.exe" 4568
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2592

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\ABMLUPRHFUGFGVHX.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\Documents\XHVGFGUFHRPULMBA.exe
  "C:\Users\Admin\Documents\XHVGFGUFHRPULMBA.exe" "C:\Users\Admin\Documents\ABMLUPRHFUGFGVHX"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1100

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 0703eb6109b8eac911df06aed7a786558260c4d8720656d30f1bb7a308cc0b8d
MD5 8d688fc58e82131aeccb5132e966ef96
SHA1 1e6ad2e36d424556e952ea5d3c4fa25557c9a5b5
SHA512 9f9213355be1c722351bf239afaa712806c9cb9571af2562a42b871447a74943b89396dd9643bd5aa9a376aafab077a8e44d846e61498099b0af4e7bb80bca62
SSDEEP 384:u1eBaoT1iBGHGW14bVjpd4+d7rLtJ2PnNIAXz48+ZWTatzKwovYbhNaPQlRtnZRO:+exZ6GmWiJjs+jEFIAXzX+NVnbhNaP4c
TLSH
T1E7A2C478213F6DC7D8D216B410D20AB7FBE4D489DAB651D8BF1BDA2F0C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3c5f7dd4e0da67fe108a86487639124426f2ac166cb0de46ea33b1ba5f76ef93
MD5 7707eae9677c5abb278f1f2c6f024d9a
SHA1 1071e1b645841529aeeb0930c3b1fcefe38c56d4
SHA512 efb04be5976312302acf23f58ffbd9f4f4213fe2c221e00ac67e5baf424d883b2995e5c72fac89775580fe72d27fc3ab062c8b4f676ba00fe492c48a46d93c52
SSDEEP 384:CSEboT1iBGtxGWibl3MOrkzjwhrkBKNhRsWOEkMzdC0oIAgKIIsbOvoaqB3K6KpO:W0Z6GtkWibl3AnwhrkE5NZC0oIAgKDPi
TLSH
T144A2072C226F5D8FE95210B400C20B8AFBF4E595E7E152DBEB1BC91F1C45A7E4A901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 e354eb71fa89af865578495c8a42ef5a3ace8aa482a46f42ed607cb2f7334fea
MD5 93773dd4515f1ce7d9ee016002cdd978
SHA1 db237608266481523e24509ba7eff99796bdc3af
SHA512 0beaa016f8c56fc4317ed72655eb4b6a5212e6502d8c00a3997125d88bb73e0428da09feba7813ebea322a2831a8ec411b86ef8e9fddbf33401710c35d76dbea
SSDEEP 384:91eBaoT1iBGqib/9kZPLZ6gIzhR2PtEPiUDzdCFIAXIPbCXNoaqB3KFpMAeUJhtd:XexZ6G/b9k1Z6gESu6UFCFIAXlXNoaMI
TLSH
T14AA2081C26AB89CFEA5161F810814385FBE4E1A2E2D592DBEF1BC91F284193D5E900FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES9FC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9FC1.tmp
Size 1KB
SHA256 6be5a29b0b6d62bc60784c88d74200f35cf983dd78678b0154f1cae0baee74df
MD5 1aa9b9af4ec8a97d6247cd26df4f4dd3
SHA1 1356193d29ef1c3a9e647f9a31ffdf9d745586d5
SHA512 2ea8beb27c3c13366b5c2e2a3a4980149261e0722e8827652bb703c69dddfea6674e50f53811284edcf9372a42283513b5f40f62769117e8857b1a9bdfce2ffb
TLSH
T1D341860193E8871FE173833128FB9729B374BE059E9A435EB484022E1F02704DDC32B2
MD5 SHA1 SHA512 TLSH

Submit Download

XHVGFGUFHRPULMBA.exe

Path C:\Users\Admin\AppData\Local\Temp\XHVGFGUFHRPULMBA.exe
Size 5KB
SHA256 cbf0ec3c28321c7aa9fd837985a8b2a098696f3052b417d6b52da684e42c2057
MD5 68bd24e3904e0e7d2088b5a12b8885a6
SHA1 264a8ae89ceb918b8712b81e40f2723cc51c0799
SHA512 eb31b2c327dcee75951729486b3a8925217e2e6a61cd9837b9c36bf351593f264c47c49e7991f670f4bae5087f1776270d91f37fdbc1cba56b6c8c8841e42d8c
SSDEEP 96:Pdew7V9bW8KQb2f08BynqgHlNx6WEN7fYSyzNt:PvPC0oyqgHjQN7B0
TLSH
T1C1C1D54797984366D463073178B303612778D8124BBBA7AF29E4027A6EEA78048537F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pt50dk2g.jgs.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pt50dk2g.jgs.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ABMLUPRHFUGFGVHX

Path C:\Users\Admin\Documents\ABMLUPRHFUGFGVHX
Size 634KB
SHA256 de82b1f6b9b1639e3b46adb37076e4680c824c3c346097149657b728a0e3ea3a
MD5 93f6cd9e84043c66717095a1b8c36cd6
SHA1 9192db10561c99d94eed4fd2ca1d5623d1ae2e24
SHA512 15347a477973f256ec209097c2021df77581b4e22e0b4ab0b12ed49b4ec9e75acbb3670381c7782b0cfbd9b2da032b45c3fa75d941a3e242f7c20aad3b00d65f
SSDEEP 12288:21BufJbdxtzuF8mPUHnLIHONddXsHMl4nmEuhei5G1o9P4DD0/UItCfBDM8/q:06BxtzuF8mPUHnLIHONddXsHMl4nmEu7
TLSH
T1A7D4438FB2CB7A5861F761E1DC1F099AB076D0E9135E0A174E45C0E13A20B6CD5FAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ABMLUPRHFUGFGVHX.vbs

Path C:\Users\Admin\Documents\ABMLUPRHFUGFGVHX.vbs
Size 234B
SHA256 b86a618b6448e8ca7382625d0d262c385e7f4f06a6d9df76f524b79bd0dfe665
MD5 37ac07090126e7cf986a27f183732149
SHA1 adf707b3b56775cc4940888dcbd03f8268d533c9
SHA512 44b3a99a940f539001960224c47e91e9c320802c8473010c2c341f711cfd49f1c466364f3f20184dfe255bcf223e7fee233621d646cceeda56c0e4838f58287e
TLSH
T113D0A90DD8EDD6254445C9223BB0D80EEF989E17A82AB41E6718881823009E41242687
MD5 SHA1 SHA512 TLSH

Submit Download

XHVGFGUFHRPULMBA.exe

Path C:\Users\Admin\Documents\XHVGFGUFHRPULMBA.exe
Size 499KB
SHA256 d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49
MD5 7675b38aabebc8427171447edd484b5b
SHA1 145c72f8acdcd366869f955dffd000d3bc146b6e
SHA512 bc9bddbee59f165742a3203f9e2ba9de409e66de6334cb352cded84cce3e1074dbd0ac17b29e58c8729906848b64d1486fb8c848ca15422127b2baeb4c5e5dbe
SSDEEP 12288:HW7YOPcqPqvopYJNWGIbK8AJYlqWuSr7B/Uj:HW7RPcqPqvopYJYK8AyldpUj
TLSH
T176B43AC4BACB08F1E2A355B0C49BDB7F96349A050022D5BAFF5CBD59EC33746092725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XHVGFGUFHRPULMBA.mui

Path C:\Users\Admin\Documents\XHVGFGUFHRPULMBA.mui
Size 1B
SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
MD5 c81e728d9d4c2f636f067f89cc14862c
SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
MD5 SHA1 SHA512

Submit Download

CSCD81D49EFF584CA39638DF78AF68EF55.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD81D49EFF584CA39638DF78AF68EF55.TMP
Size 1KB
SHA256 5202493b76c7383065d35bf8b93ce51d1cbf30da8b58421bb8370200588b515d
MD5 d6ee6f53f71a02256b2455f4927ae435
SHA1 857e366b56fc6917d4bdee98f29d5996ca2e749a
SHA512 45c408db5f292874625c5929a478cd43c16eb517f26d99370b7dc8eeb5bae08c74cb1102fec181ac35616f508c628889ea9c05072fd11c9d726073e3c0e8ecb3
TLSH
T11F21C041A2F8421DF1B3873079F5D362A2797E168D7A43EC3488175F2B1590084935B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_0e14a319cab649789bc704e8d7e1653f.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_0e14a319cab649789bc704e8d7e1653f.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-347-0x0000000070540000-0x000000007058C000-memory.dmp

Download

memory/1808-340-0x0000000005E70000-0x00000000061CB000-memory.dmp

Download

memory/2592-382-0x0000000000190000-0x0000000000198000-memory.dmp

Download

memory/3948-355-0x0000000070540000-0x000000007058C000-memory.dmp

Download

memory/3948-351-0x00000000056B0000-0x0000000005A0B000-memory.dmp

Download

memory/4568-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-24-0x0000000002A70000-0x0000000002A71000-memory.dmp

Download

memory/4568-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-76-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-75-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-74-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-73-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-155-0x0000000074E32000-0x0000000074E33000-memory.dmp

Download

memory/4568-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-25-0x0000000002A80000-0x0000000002A81000-memory.dmp

Download

memory/4568-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-156-0x0000000029BB0000-0x0000000029BC0000-memory.dmp

Download

memory/4568-157-0x0000000029BF0000-0x0000000029C8C000-memory.dmp

Download

memory/4568-158-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4568-159-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4568-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-19-0x0000000002750000-0x0000000002751000-memory.dmp

Download

memory/4568-369-0x000000002D230000-0x000000002D264000-memory.dmp

Download

memory/4568-370-0x000000002D280000-0x000000002D286000-memory.dmp

Download

memory/4568-368-0x000000002D1B0000-0x000000002D22C000-memory.dmp

Download

memory/4568-366-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4568-363-0x000000002B670000-0x000000002B67A000-memory.dmp

Download

memory/4568-362-0x000000002B550000-0x000000002B5E2000-memory.dmp

Download

memory/4568-361-0x000000002ABE0000-0x000000002B19A000-memory.dmp

Download

memory/4568-360-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4568-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-338-0x0000000074E32000-0x0000000074E33000-memory.dmp

Download

memory/4568-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/4568-344-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4568-346-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4568-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp

Download

memory/5268-335-0x0000000070540000-0x000000007058C000-memory.dmp

Download

memory/5964-320-0x0000000006500000-0x000000000654C000-memory.dmp

Download

memory/5964-317-0x00000000060F0000-0x000000000644B000-memory.dmp

Download

memory/5964-327-0x0000000007E70000-0x00000000084EC000-memory.dmp

Download

memory/5964-326-0x00000000076D0000-0x0000000007773000-memory.dmp

Download

memory/5964-325-0x0000000006AB0000-0x0000000006AD0000-memory.dmp

Download

memory/5964-321-0x0000000007480000-0x00000000074B6000-memory.dmp

Download

memory/5964-328-0x0000000007830000-0x000000000784A000-memory.dmp

Download

memory/5964-322-0x0000000070540000-0x000000007058C000-memory.dmp

Download

memory/5964-319-0x00000000064C0000-0x00000000064DE000-memory.dmp

Download

memory/5964-329-0x00000000078A0000-0x00000000078AA000-memory.dmp

Download

memory/5964-314-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Download

memory/5964-313-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Download

memory/5964-312-0x00000000056F0000-0x0000000005712000-memory.dmp

Download

memory/5964-311-0x0000000005820000-0x0000000005E6A000-memory.dmp

Download

memory/5964-310-0x0000000002C60000-0x0000000002C96000-memory.dmp

Download

memory/5964-330-0x0000000007AA0000-0x0000000007B36000-memory.dmp

Download