agenttesla | 9c0eb19d1579fbc93030d42465b90e092889b930733ffda60b5acb137a346dac

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quote Ref #011599.js
Size 1.6MB
Sample260702-2wewfacy9m
SHA256 9c0eb19d1579fbc93030d42465b90e092889b930733ffda60b5acb137a346dac
MD5 bee96dd6dd3f1b7452507dee0b0f6923
SHA1 071ec523c70a4654e66dbb257be1ac4071b330e7
SHA512 da3f18f7144736d3730a4685bc8aeae425d52778e3c819cfa08a524d665e64f1d1c466dcc6cac4ee8e3e1b453bfad2cde81e986738261b60c9cc04ac4eb0dd21
SSDEEP 12288:Ge8IEdPRUwn+VpabD+WeKlZUQHstoMMAsfo:gPRbCu+AAko
TLSH
T1D9752335443DB2003427EE76C3AD64DADBCD5AE9BFAF51494036174A9227D8BCCC226B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution agenttesla xworm keylogger persistence pyinstaller rat spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.orangesac.com
Port
21
Username
[email protected]
Password
6a=HJxbSD@qn

Extracted

Family

xworm

Version

198.37.105.48:2233

Mutex

9MfYPXAECU0XFFxR

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.orangesac.com
Port
21
Username
[email protected]
Password
6a=HJxbSD@qn

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3292-14-0x0000022B25760000-0x0000022B25770000-memory.dmp	family_xworm

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3292	powershell.exe
10	3292	powershell.exe
12	3292	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe
4248	powershell.exe
3292	powershell.exe
4372	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 4 IoCs

pid	Process
2192	lbbtnr.exe
2108	powershell.exe
4140	cvogcemoczf.exe
1968	cvogcemoczf.exe

Loads dropped DLL 22 IoCs

pid	Process
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe
1968	cvogcemoczf.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\v2126\\v9495.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	lbbtnr.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000245c0-166.dat	upx
behavioral1/memory/1968-170-0x00007FFC7EB20000-0x00007FFC7F184000-memory.dmp	upx
behavioral1/files/0x00070000000245b3-172.dat	upx
behavioral1/memory/1968-174-0x00007FFC80580000-0x00007FFC805A7000-memory.dmp	upx
behavioral1/files/0x00070000000245bd-176.dat	upx
behavioral1/memory/1968-177-0x00007FFC9EF30000-0x00007FFC9EF3F000-memory.dmp	upx
behavioral1/files/0x00070000000245b2-178.dat	upx
behavioral1/memory/1968-180-0x00007FFC996B0000-0x00007FFC996C9000-memory.dmp	upx
behavioral1/files/0x00070000000245b6-181.dat	upx
behavioral1/memory/1968-183-0x00007FFC80550000-0x00007FFC8057B000-memory.dmp	upx
behavioral1/files/0x00070000000245bc-184.dat	upx
behavioral1/files/0x00070000000245ba-196.dat	upx
behavioral1/memory/1968-198-0x00007FFC9A7E0000-0x00007FFC9A7EF000-memory.dmp	upx
behavioral1/files/0x00070000000245b9-195.dat	upx
behavioral1/files/0x00070000000245b8-194.dat	upx
behavioral1/files/0x00070000000245b7-193.dat	upx
behavioral1/files/0x00070000000245b5-192.dat	upx
behavioral1/files/0x00070000000245b4-191.dat	upx
behavioral1/files/0x00070000000245c3-189.dat	upx
behavioral1/files/0x00070000000245c2-188.dat	upx
behavioral1/files/0x00070000000245c1-187.dat	upx
behavioral1/files/0x00070000000245bf-186.dat	upx
behavioral1/files/0x00070000000245be-185.dat	upx
behavioral1/memory/1968-201-0x00007FFC879B0000-0x00007FFC879C9000-memory.dmp	upx
behavioral1/memory/1968-203-0x00007FFC9A4C0000-0x00007FFC9A4CD000-memory.dmp	upx
behavioral1/memory/1968-205-0x00007FFC7F960000-0x00007FFC7F985000-memory.dmp	upx
behavioral1/memory/1968-207-0x00007FFC7F490000-0x00007FFC7F60F000-memory.dmp	upx
behavioral1/files/0x0007000000024585-210.dat	upx
behavioral1/files/0x00070000000245ae-209.dat	upx
behavioral1/memory/1968-227-0x00007FFC80580000-0x00007FFC805A7000-memory.dmp	upx
behavioral1/memory/1968-226-0x00007FFC804F0000-0x00007FFC80502000-memory.dmp	upx
behavioral1/memory/1968-225-0x00007FFC8E560000-0x00007FFC8E56C000-memory.dmp	upx
behavioral1/memory/1968-224-0x00007FFC93FF0000-0x00007FFC93FFC000-memory.dmp	upx
behavioral1/memory/1968-223-0x00007FFC95730000-0x00007FFC9573C000-memory.dmp	upx
behavioral1/memory/1968-222-0x00007FFC964E0000-0x00007FFC964EC000-memory.dmp	upx
behavioral1/memory/1968-221-0x00007FFC9A440000-0x00007FFC9A44B000-memory.dmp	upx
behavioral1/files/0x00070000000245a2-220.dat	upx
behavioral1/memory/1968-219-0x00007FFC7EB20000-0x00007FFC7F184000-memory.dmp	upx
behavioral1/files/0x0007000000024595-217.dat	upx
behavioral1/files/0x0008000000024583-215.dat	upx
behavioral1/files/0x0007000000024586-213.dat	upx
behavioral1/memory/1968-236-0x00007FFC9A7E0000-0x00007FFC9A7EF000-memory.dmp	upx
behavioral1/memory/1968-235-0x00007FFC7F950000-0x00007FFC7F95C000-memory.dmp	upx
behavioral1/memory/1968-234-0x00007FFC80550000-0x00007FFC8057B000-memory.dmp	upx
behavioral1/memory/1968-233-0x00007FFC86060000-0x00007FFC8606B000-memory.dmp	upx
behavioral1/memory/1968-232-0x00007FFC996B0000-0x00007FFC996C9000-memory.dmp	upx
behavioral1/memory/1968-231-0x00007FFC87370000-0x00007FFC8737B000-memory.dmp	upx
behavioral1/memory/1968-230-0x00007FFC875F0000-0x00007FFC875FB000-memory.dmp	upx
behavioral1/memory/1968-254-0x00007FFC7EB20000-0x00007FFC7F184000-memory.dmp	upx
behavioral1/memory/1968-288-0x00007FFC8E560000-0x00007FFC8E56C000-memory.dmp	upx
behavioral1/memory/1968-287-0x00007FFC93FF0000-0x00007FFC93FFC000-memory.dmp	upx
behavioral1/memory/1968-286-0x00007FFC95730000-0x00007FFC9573C000-memory.dmp	upx
behavioral1/memory/1968-285-0x00007FFC964E0000-0x00007FFC964EC000-memory.dmp	upx
behavioral1/memory/1968-284-0x00007FFC9A440000-0x00007FFC9A44B000-memory.dmp	upx
behavioral1/memory/1968-283-0x00007FFC7F950000-0x00007FFC7F95C000-memory.dmp	upx
behavioral1/memory/1968-282-0x00007FFC7F960000-0x00007FFC7F985000-memory.dmp	upx
behavioral1/memory/1968-281-0x00007FFC9A4C0000-0x00007FFC9A4CD000-memory.dmp	upx
behavioral1/memory/1968-280-0x00007FFC879B0000-0x00007FFC879C9000-memory.dmp	upx
behavioral1/memory/1968-279-0x00007FFC86060000-0x00007FFC8606B000-memory.dmp	upx
behavioral1/memory/1968-278-0x00007FFC80550000-0x00007FFC8057B000-memory.dmp	upx
behavioral1/memory/1968-277-0x00007FFC996B0000-0x00007FFC996C9000-memory.dmp	upx
behavioral1/memory/1968-276-0x00007FFC9EF30000-0x00007FFC9EF3F000-memory.dmp	upx
behavioral1/memory/1968-275-0x00007FFC80580000-0x00007FFC805A7000-memory.dmp	upx
behavioral1/memory/1968-274-0x00007FFC804F0000-0x00007FFC80502000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000900000002457d-100.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lbbtnr.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3608	taskkill.exe
1244	taskkill.exe
3432	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3292	powershell.exe
3292	powershell.exe
2324	powershell.exe
2324	powershell.exe
4248	powershell.exe
4248	powershell.exe
3292	powershell.exe
3292	powershell.exe
2192	lbbtnr.exe
2192	lbbtnr.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
3292	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe
2108	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	2192	lbbtnr.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	1968	cvogcemoczf.exe
Token: SeDebugPrivilege	1968	cvogcemoczf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3292	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3864	2692	wscript.exe	84
PID 3864 wrote to memory of 3292	3864	conhost.exe	85
PID 3292 wrote to memory of 2324	3292	powershell.exe	91
PID 3292 wrote to memory of 4248	3292	powershell.exe	93
PID 3292 wrote to memory of 2192	3292	powershell.exe	97
PID 3292 wrote to memory of 1736	3292	powershell.exe	98
PID 1736 wrote to memory of 4640	1736	csc.exe	100
PID 3292 wrote to memory of 2108	3292	powershell.exe	101
PID 3292 wrote to memory of 800	3292	powershell.exe	102
PID 800 wrote to memory of 3044	800	csc.exe	104
PID 3292 wrote to memory of 3996	3292	powershell.exe	106
PID 3996 wrote to memory of 5016	3996	csc.exe	108
PID 3292 wrote to memory of 4372	3292	powershell.exe	109
PID 4372 wrote to memory of 4140	4372	powershell.exe	111
PID 4140 wrote to memory of 1968	4140	cvogcemoczf.exe	112
PID 1968 wrote to memory of 3432	1968	cvogcemoczf.exe	113
PID 1968 wrote to memory of 3608	1968	cvogcemoczf.exe	115
PID 1968 wrote to memory of 1244	1968	cvogcemoczf.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	lbbtnr.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quote Ref #011599.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -w H -noP -NONi -Command ". ([scriptblock]::Create($env:QjoBeUt5UD3))"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w H -noP -NONi -Command ". ([scriptblock]::Create($env:QjoBeUt5UD3))"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Registers new Windows logon scripts automatically executed at logon.
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\lbbtnr.exe
      "C:\Users\Admin\AppData\Local\Temp\lbbtnr.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      PID:2192
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_36242bb71bda4523b39e4cfec2f9610d.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6174.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCE5780BB854248C18578509216F9D5A.TMP"
        5⤵
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\powershell.exe
      "C:\Users\Admin\AppData\Local\Temp\powershell.exe" 3292
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d3fa86f0342a4639a5b1793600f377c5.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6491.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDF81DD1BEF3B4786809E5B32114069EA.TMP"
        5⤵
        
        PID:3044
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_20e55fbcb57744f8b1fbafe062b720d9.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3752.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD02B4CAEFED84796BE26641156709AD5.TMP"
        5⤵
        
        PID:5016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\ijs3vy4myyh.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\cvogcemoczf.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\cvogcemoczf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\cvogcemoczf.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\cvogcemoczf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\cvogcemoczf.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM brave.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae
MD5 555e68af1b8e33f84346bf2335e6191a
SHA1 fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e
SHA512 6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e
TLSH
T10C112223F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
MD5 e58749a7a1826f6ea62df1e2ef63a32b
SHA1 c0bca21658b8be4f37b71eec9578bfefa44f862d
SHA512 4cf45b2b11ab31e7f67fff286b29d50ed28cd6043091144c5c0f1348b5f5916ed7479cf985595e6f096b586ab93b4b5dce612f688049b8366a2dd91863e98b70
TLSH
T1AC112223F38C8920CC96153A509DAC5172B586CB81AFDE9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Login Data
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cvogcemoczf.exe

Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\cvogcemoczf.exe
Size 10.1MB
SHA256 61a7989ded8bd5ef9abb110fa66f8579f315946d9ae1c8289e675b0cb1fced6a
MD5 3b310dc53796b40fc76eed863cd15ae8
SHA1 2741a6acbb5099cd1875faa5197e634870eccb66
SHA512 080de9cdc692e600cfffc32c6631865f0e2ae8d5f0583eeba1686c0455f5b9557f6d88d4d360a771630db39eb4a8bbf185212b4b46973fba2791df18c4779be2
SSDEEP 196608:l20fS8CIVwfI9jUCW6rlaZLH7qRGaIYQoF/s8LTGNrmhnRtECdemZEM:l2oSuaInD0d/YVF/5VdeJM
TLSH
T143B633966AC004F6E8E7A939E8D396128B31BEB017D0C7DB42546B3A1F231F154B9F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ijs3vy4myyh.ps1

Path C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_q2ujcwo3uu5\ijs3vy4myyh.ps1
Size 1KB
SHA256 214190a1534f6d57c108b23a3cfeae772bca6cfd533c7bfe7e2eca7af873aea4
MD5 4d275701127243e2b0e11df4bfded626
SHA1 b8d9046ba96f6c28ede25f94f06f8aa5f0f05175
SHA512 195f623c72f0e36a10c278648d73d75b06d960f57470679b25eeb864076ac004e198a0c2e5a0bea319ff19dff9427dfadf36b58db795644284faf93f259a7867
TLSH
T12E2110857AE6A732C5324B088E46D394C51F123620A7250077EC9341FF7869FC669BDC
MD5 SHA1 SHA512 TLSH

Submit Download

RES3752.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3752.tmp
Size 1KB
SHA256 d5f7af7ae9c5ba009f12e2c633ce677ac27cd80e899f0b761c01e46de90546e0
MD5 03ed1d03e05c00f13c538c9087ce8316
SHA1 5631f45ef622162a51e8d83704ccf8a4a2ed5021
SHA512 7ddad86f2a711d4666d084da964ecfd847dc915a13814e01f3564da39cf59d8a4737184c71e729443447ff8987e5aef40cf4836b8ffba917969f2ef60ca4da0b
TLSH
T15C41514083E8471EF17343312DF7532AA279BE54EE9B475EB484122E1E12240DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES6174.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6174.tmp
Size 1KB
SHA256 646cb268ab89e95f9558a69fc1368d361723b788bc8517cf001b0a28ab601b8d
MD5 88ed97daad1dc646761e5b5ad408b655
SHA1 ba1344b1d6026cd4d38e6ebfdd4e7b18e4887a91
SHA512 271237a540ce3e63d1138c15291a7eae3ea3da11c73888abb84c197d5a5455161a9d7f7b42e2aa96a6fa97cb5f01f63d5e1c3a7fe9fd6b3ae0c5c21481e54e72
TLSH
T16B41534083E8471EF17347312DF7532AA279BE55AF9A475EB184522E1E12240CE837B1
MD5 SHA1 SHA512 TLSH

Submit Download

RES6491.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6491.tmp
Size 1KB
SHA256 04136ee5525477b3a9ed0aebbc5bcea0f64cf54c96454a5a3f3ab5c7265fe6bb
MD5 69174e7acdbf4a3b3bda9d9c42e7d28b
SHA1 40c87505f5561b1e9cae657287b65dd5e9ccffa0
SHA512 86b838e03d7c90265c9084add532608c2cebd901dd6ad391ca98eca15d4211cbed0b630679f5a1032c6dae96807250d1590150e504546d77aa3badce602faf63
TLSH
T1C841514083D84B1EE17243326CF7972AA279BE55EE9A479EB484522E1E02700CD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

_chacha20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\Crypto\Cipher\_chacha20.pyd
Size 10KB
SHA256 c47eac09db874fb173a8f92af90bcd51ee2d045357fe225bccf82cd7d26701e5
MD5 9cac6634d0c505275e81ce1d0d444083
SHA1 36c44f0f4a86f6f2cb84d80afeaf5cffd8829fb7
SHA512 513fc7b8387f167025f45b65678953ea9930804a2b96cf8e604f4a923f5811eae7fc94a70ed6cb4c83ec0a6e4a284c47f0217c099e43bf42528b0254a1ff556b
SSDEEP 192:8QMgWcmpbVnK8V0e4Eg0pCkeDa+QzEIJillcKkYj273QJXhnNAkc9lk:ecMVae4EgHDa+uEIJ1KZa7gJX3/c9
TLSH
T1EE227CDB531AE0FCC85644B309A78988BF713C33A6125F0F19D4217FADB3EA46A10631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\Crypto\Cipher\_raw_aes.pyd
Size 17KB
SHA256 bc5a926a9001ed94c7b040db1f4986a507379dd3e4ee0102862b2582bdc3db37
MD5 940476bb647158428febd1e68d2178d6
SHA1 c0dfc1ffee7595f432f7127e3236e1f3e43247ca
SHA512 6ece420809c741b214b3c6d4bfb92731183ab47d3e05490ae56f77d5dd4aed7e3afad5255853f408396826e43d61be39b312f1c299b2770b1d2b7c6d37368358
SSDEEP 384:/KO4ybrS6X6d0Gtbdc/4xOxmOq4JAQnpvnOIh+duZa7gJX8CS://tKvcg4IOqkAMpvDpMCS
TLSH
T1F372AFE5A2BEC8FCC8B560320CE25969F7217B6B6413031F0590267E5EB3D541F36B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\Crypto\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 b71906a166c3bf344fd2d60f104cebb9519a1cace400da10c5e68bc8764d9f45
MD5 66e11637a30e0a6ac5503007fa973558
SHA1 2c6a7caffc86b28f7612840b84c00df863253071
SHA512 27f9b9cb1e399ca3f5ed0cd17879f244c75a5ea0fd3508781a4975741e158230bd8369ff2c27d3377956b8f7e67c7941100570388dd13efc60742eabbe2ab564
SSDEEP 192:atpdrvzmhp8BShP1nmQ2Ia+hyKnhSqwT4RRL4MDkYj273QJXlEnLU:uLl0hP/vLys0q+4gMDZa7gJXW
TLSH
T109329ED78219EAFCC4B674B358A75A94FB323436112A9B2F08C9377E9CB76143020774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\Crypto\Hash\_BLAKE2s.pyd
Size 11KB
SHA256 630fbfbffb43d7abfa444519f9a95d44fd8e63ae6b0d1207cd8a2eac3dfd2a1b
MD5 0c1dd6c924463d7a4114c94422eace37
SHA1 7f568932f79b0af09f67797bb9dbe633c8b64806
SHA512 dad1b6c39e0c4c334aba55f35e89e7d7650f4a37f42d2c770700215dd381e0f69be4d51df8a7ebc24332398a0df34cec40c8d95f5e23f2c6ed30555ef8f23730
SSDEEP 192:wDPewzRKCnCLrNy++19mdxJnPAnARooC32/bdkYj273QJXbniA3P:kPewzaLrI++7mFPyARfdZa7gJXOc
TLSH
T138325DE7C2D6E97CC876AAB608675848E7317C279205571F09A431BF5CB2A923A30773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_poly1305.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\Crypto\Hash\_poly1305.pyd
Size 11KB
SHA256 387ec446781eb5554ee23cdaafd673c29c5f2412b8f5b713d3d6796964e83819
MD5 014e57265accb1efccc8cc812fa177ad
SHA1 42e3031daf796074976da780d2e9232ab89417aa
SHA512 896c1cb8b6152ea5286490f92598699cb8775504ec68db11d91686f1972ee8f58349a858ae202ec342f5b5cbeb193f029d2b2fd729e873ef01e9077c3c1c4db0
SSDEEP 192:snUIoSVglOuObZmA8ZShML/8kCZODhYgbQGWPYkYj273QJXZnqg:DRlOuObZ857NSODh5xaYZa7gJX8
TLSH
T143327DEB5A46D6B8C56B5CF1186A8CC8FB7A7813A512671F68F036FF0CF72542920630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\Crypto\Util\_cpuid_c.pyd
Size 9KB
SHA256 10e3fcef5e0b7de6319e8db63a238e9ac4a4632826dd903f1f105d2b988216bc
MD5 b5032e108fb3bdb47bed67a1fea60e54
SHA1 9a14c8f44f167c4c0ffebc67b2b58b93c6cb1986
SHA512 43b97e3514d0d0305ecf475f5954ce4f4e980477ea64bad13756ead775eeed3c56959aca9d6a2b38ebc1d2930409a43392a446ec87586b2ab94df82757b1d987
SSDEEP 192:dkSlQHLyJVf5DoE+uJL72iD5UR9rGHcO4rhkYj273QJXpHzI:qSGoVf9L7DD569q8OkhZa7gJXZI
TLSH
T187124CF7937EF2FCC53654B60A4A4858FA65F83BD222131F01E532FA4CA62527D22271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_bz2.pyd
Size 50KB
SHA256 2f26db49a787063a4ce2bce5a90871da8b3e78e3801f6f18e9b345add44991e3
MD5 9effb75170147c0fa5897f8e57a7a45c
SHA1 5380e27884fa621f8a3d6e720fd575f789026837
SHA512 dd5ab5189a05977a73c6dca79a24eb564576623d62a7d18fdcbdd30908fe8c36ca99be33002d752ba612de3e4e7514d3ddb7f6f36cc0001d92fdbb3be61c90b4
SSDEEP 1536:4TvumeSe2uD4e4elWrlkIDLVzZ7yo47Q9M/fITjNO:GvxeSeVd4elsGIDLVzZkY1O
TLSH
T16433D0CA83BA8057EF9369B191E0E8DBFE353BD39814421A3099B59A1E537C1C71133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_ctypes.pyd
Size 64KB
SHA256 2202b5cdacec8b923dffb79438fea65de38831a22ac1ff4a06ca95fc510f6a36
MD5 4a8c4df330385606331fbbbd580dd51c
SHA1 aa7416ca1c731411e911c37571610a6b031badf7
SHA512 7a591e86340e72b3ed2dcac61b86de96ac02e3c19cb4e61cee762b915194433631b7e85b82e74004c2eabb0e0ae200c2c8b6e46065996e64cca15b7e8f33b9be
SSDEEP 1536:gZADR3OqwGETEepRgi29lY68KULvIDyPI37yo47Q9efITKE2:gWDVCGMEmgRJUzIDyPI33f2
TLSH
T17E53D0C249698027EB238FB1A2D2C9C7B9387B639120467A51E522715B577E4F337328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_decimal.pyd
Size 119KB
SHA256 87df002c3bd6b9dd44e51623d1bf962000cfa0397aac63465cfdfe0b0aa95eb6
MD5 441aefa7adeab0d02c80789f1d2f123f
SHA1 06638ea751e3c3ae02595188171a1f4b4a969af1
SHA512 7432a4d62330b8251e1163588b553a05d8dc8738c0aaf930bbd2a0eec8f7b99e42d0d8d7be61bf80432f8358710acf232483590e92b1bc8504057fc38b6fc468
SSDEEP 3072:ElvnMQn9zks952682EZn+Gyq4Jrx1IDvqyEfhBn:WvnMQn9AsTb8tZ+CAgEfhV
TLSH
T12BC3F1FA25E89297E9176A3283E0E894B23D6FD35755CB1C101553EF0FC27C38B1A25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_hashlib.pyd
Size 36KB
SHA256 4bf372b29b83a6c6ed26645d4d7f7feb4b41f7764d989bd31bcc425d98987d1c
MD5 4506ed59d28328fca7c98e00daab6b2c
SHA1 df32b59c6d96b602e00829370a952261099a5085
SHA512 3e3775f10bc9919810e16486ce9f69b3017fe5f2d17813e45e3f520612b3d2b0a03b5dc53ed1a54b81dc957e97a88a821b8cb1971fbc8bbae6d6aa84f4f6872c
SSDEEP 768:9ITuxGTp+IEoJJf0IPHpPbIDvI+FQ+Eyobo+Y7N2Ip4D6Cxf1mlY6C7Ep:9I2GwoJyW9bIDvI+27yo47Q9LfIi7K
TLSH
T106F2CFCA55399116CA9375F152E9ED82FD3877F398048BAF308D52590EA33D1EB06239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_lzma.pyd
Size 87KB
SHA256 f60654d44f3d29fd0a487a24b4e8bafc3792116e2c581f53c977a643645e5914
MD5 7b6cd4cee5a7ae3bc97207c6b7860924
SHA1 88001ebe8fcea1f4513f35e8137b3cf7e5fb2a13
SHA512 e0e19e801e20842a80b11821725012a85a9b428500e69a13f95a6747eec738323e14e22e3da286ff897f678946cf97b5c1373b35ec00460f8b7ae70d10c53ca9
SSDEEP 1536:zE29OZvi4bwTlI+rWNp+UavAZauaND+cJyBvNMRq/2ID01497yo47Q9gfIbvFFZ:lMviSJj+Jea7RytGvID0149p5f
TLSH
T1999302C5DFB48017D991DDB196E0DA82B4B4B3EB5C70D88F30AA95A60D533D0E748B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_socket.pyd
Size 45KB
SHA256 37eae46ecdba0091811de4ce84f57224b691b49acc543be45fe0852ca04da53a
MD5 3523c31b27e716a16860cc8a5bd5ee73
SHA1 d9f0c2ad6eb6ad9febf8a312e6d0daf25eb06de1
SHA512 6f7db177cb0c98d9021e40c7729a02d94446c4a4454a259ae4810c6b16b39521317aec83d11089d7318208591800cdc36de660fc57f735065aac832cc7898e78
SSDEEP 768:IVO07RbhED2LEIuo4OCYvmDrzbKXh4sSpuu7QptTnIDywjmRQ+Eyobo+Y7N2Ip4f:6PkD2LEIuo4EsAtSplKTnIDywjma7yo7
TLSH
T19F23D0DA86FC905AF6429BB252E4D990FB34BB939840C71F30E6516B4C537C0E71627D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_sqlite3.pyd
Size 59KB
SHA256 ff9e0d97ecbb28516eadff85865d9a0a42a68f5a4324b10e94404832e00b17aa
MD5 0de94e91892efd4aeb396947e7086d65
SHA1 d8546478c46d4a95cc5c819e4f6c7722a1d05b16
SHA512 44d5f2d6a7e6e2583153a5445518bfeb8349bf5ca25bdc82f02916270ff372f18f291240b426800f4c19b5f7916750adb310aa7f2df504c9e6fdaebfc9d19edc
SSDEEP 1536:EjbxuYH/ubG5c+D4aBRYjia2DaaAUaF6IDvQDF7yo47Q9e0fIbF/:wbUYH/MoZDB/DpAUaoIDvQDFqZ
TLSH
T10E53E1C949BC4049EE53AFB292E1F5C2FD74E7D394778F5F6097A2290E92340A305366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_ssl.pyd
Size 68KB
SHA256 8c29a572830012481266da375c60a058641342f945ca6e7c5e1c480e20d6fc41
MD5 dbe84b94eb12cf7f9f779adf8180faaf
SHA1 b6a87bfaac721fb4fc3f39c28fba8cd41cb12925
SHA512 bb8e06b7de25b3f41b82aaf4ebc912edabb2d286ae3b27eaa2f2e4127281a44fb633eb2ce940e41b65f6c68b6e1c61172c21e0eee2af686b154d9698f6dff1b9
SSDEEP 1536:UDX4Y6/mp7lYpRHoQXN9cEpPCtsYEb7whNW6CZuTMIDL7odb7yo47Q9BfIUjC:Ep1lYp57Nnp6nEb7wh3CEgIDL7oZiz
TLSH
T17F63E1DE8468D563CE52EDB042E4DE82BE38B7E39850C22F30C557A91E773E1530667A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\_wmi.pyd
Size 30KB
SHA256 8bcea63a10547ec7e6dd25c68b97ea8d59a9953dce55798bc1b3354efc271150
MD5 2980fe5727634871a69ed4992afffd66
SHA1 4a7920befb95df4a49f51ec9001e59fc2f53e16c
SHA512 ea975bf3f132f1eb6f82b44ac181893ae0acbbbc039135e8d3466736aa49f6b78b24be6bdfc7ef5933d0fdd9f9ecd77274157ecf9209959b065dec31c1279e26
SSDEEP 768:/uIi2GqkkJXzrpl7IIDLiOmQ+Eyobo+Y7N2Ip4QTxf1mlWZG8vD8r/+w:/uIicX77IIDLiOn7yo47Q98fIW44D8rr
TLSH
T135E2AFDB853C8166EE93AE7162E5DD82F834BBD39411461B30DA62EA0D673C0E316339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\base_library.zip
Size 1.3MB
SHA256 af3e4f7dfcb438efe43f9730897867d3c4eb1bb023b47196bd2d602a7c10a1ef
MD5 e024d486afd8ec4d0c4ec7798dc5bad4
SHA1 7c3d29b5778f2dae842d735287c774e712553732
SHA512 6be98a6d6eea51afe1adf5c2cd93a14352257060aeb4dc17567d236ab08343762776687e8de580ea2190feed8a75aaca30e523706a69691e85e9737fa8a7ec1b
SSDEEP 12288:x6TL+Dci2W7WpfuOBa80201jwCVRDVoioSYB/i2cPPdxhYqPaQrZ56RjZXqtYzGF:37Wpfz/5cPPdxhYbSeT1GJdZ+LJit
TLSH
T177550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\libcrypto-3.dll
Size 1.6MB
SHA256 e01d675e9e6a5d07078429a230f07bee0610631c1aa21ec274cec58d599da85d
MD5 d1d098014222c37db86aa9a57ff7d044
SHA1 02e4d5264e44292b9237f9c5be3d31207997a785
SHA512 aaf62336ba3bcacd195a296e4f7dfa9aaf4c6999f66928e5f0315a2e9acf3ca21505830422629e2492a0a1ff48b4fefd5d660cb2ed257643a1ac474a8aa99bf5
SSDEEP 49152:43Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:0Y7Bm3dz6Q5c1CPwDvt3uFlDCm
TLSH
T1AC75131424BF680BF69AAC788E708E2A896A1731B31CDFB32D6DDD184C18D1E59F44DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\libffi-8.dll
Size 29KB
SHA256 516743d3e2e8ea88243747060cda2f2fc9174c538a29305d62b830f7bca89d98
MD5 658fa8b1b9e9bd4f57607507c2b2508a
SHA1 0fcd0e582132141eb45ea5e0228b030db4a22528
SHA512 555906c7ad0cd7ccaa4337314272d9568e1e1ed0e32d6b5fcc3d9a3a0226400a3723c1b136168e4de8049a40bf5090d5d3148e15f26140b27bbdeeb2dce98535
SSDEEP 768:op/6aepjG56w24Up3p45YiSyvkIPxWEqG:qA154spK7SytPxF
TLSH
T199D2CFB34521BC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\libssl-3.dll
Size 221KB
SHA256 1c2134bc76d79bf6cc7c4cef92f3ce3a7b42d640e156fcb9b480d56f7b708245
MD5 ad95e111f85b6997e475a5ac34660e4a
SHA1 140127857362adfa9e50fc24510877a7b4f5c9ed
SHA512 814bcbfaaf8e3024eb2824961805c79ac9bb5994306242a86b272ce7b5786075cfafbfa2ae1f16ec932460090624c58992d9fa976c93b51956aba5d44b1e41e1
SSDEEP 6144:2pEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:2pAqo92h3Y660Ew+OTbAFLQd2lw
TLSH
T1642401933E2FD83AC803AD76AE7492D2D26C37424702DE66370BC9A97B75E4D617C052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\pyexpat.pyd
Size 89KB
SHA256 0d0adda7deec625cc84d83c9801eab4c9b04bfd135efcd8565a8cc68fc6f37fc
MD5 c6b65d8ebe8e82b3253394f6722b0d4b
SHA1 6845b2f344e2fdddd318e997ee346102439f4995
SHA512 811b53e4a909fe11f94702cd71a81d0efd426303c420861714f16a6e9d50f5f7d4edf034209dd6b4f8d0184024f1ab45d9c7517c71057c9e0828ca4f9d89b4b4
SSDEEP 1536:Igx80H0w/GuWuyH50NdsWZ+cYm24tmFajNJC5m8pqAE7sIcbxg3BIDyhF97yo47M:Igx80UMX705ItYcXDtmFaxJomKq2xgxl
TLSH
T1619302C607A4E581E9F3A97220E9E59EB93073C3E881CE2FA4A553590D933C15B2735F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\python313.dll
Size 1.8MB
SHA256 425f2d00057beea4a924c413cc801cd7ae90924ac8c927eaec8e41ca18a87a4f
MD5 e0a9948b92524e2dec22ae62c9da511c
SHA1 30ee8784b1948ee57a28b29bbb920c84c2da433c
SHA512 658e3f75be217b701f5fdd8cc8f36e69d911b61331bcd4755c0991312791f188716a92c825baa185fabdbf033e13c35b8257acdc5a15a89e2e3a1a596c891bf2
SSDEEP 49152:xCVE4q6qI1HNZYzIUJQTNOT9ZhXzXFWnJaeiZkYxaKE:xduqi5xOZZxzVRe6bI
TLSH
T195853333ADCE45F3D5DB56B193DBEF111D2EAA43911D42C5D890EA930E87620172BB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\select.pyd
Size 26KB
SHA256 69654034477b0414f1632704f0afbe02d5e34a7972c7cf87c98f27dba37d9a46
MD5 c3fc7efde1366631e2e6ff149186141c
SHA1 a5d5649fb1da08415c4e7640b89cf0d90d1ad551
SHA512 dbcf495bc85a3fac3c80570ba0482a56d1d461d2b6bdac827c0cec99aa1cafa898dc775576286e06fb592d4e74b62858640d35de17e2aa674d68a761f316f53c
SSDEEP 768:VaWKrKpYrmID9GuOQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:0lrprmID9Gu/7yo47Q9S+fIir
TLSH
T1E5C2BFCE067C9257DE63AAB141E0DD92FD38B7835914828F30DDA1BA0D533D1A31A37A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\sqlite3.dll
Size 645KB
SHA256 0ad401f5177320d1d2fcaaeee1a9b3ec4c819062928a9021e47c3c4054b7f53d
MD5 2428c9e3e6177545e8404a2fcb5e740e
SHA1 a9f7226f79bccc442d93e78f09fc60333ce6deeb
SHA512 1b62e39a66df88ca05826bc49ffbf8739451a2438e1f4a4851684ba8620664a9fd17057d4074843da079a3db38e358d387ae35b74e10b9d98d9affe1cde37763
SSDEEP 12288:GpZ29aLlU2+a9Li5EMtSJS3mIgwgPlXtovn7RY/AWHAGPxVNpxQ+ch:qvipaE5gNOvlYIGAAith
TLSH
T175E423E31ABA4E0CE9F260709BC624D1A424336265F96AEFF55453FC2E9FAD1D1B0144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41402\unicodedata.pyd
Size 261KB
SHA256 222a6a35a4b303c0fd293fd74526347ad08cf6c23cf3c624a1bc96455fbc3718
MD5 39668b33daf92cabccba2c52ce2007c9
SHA1 23ce75040b37588989cdc792e2753afe5982732d
SHA512 5abe3fbaf9d92685375cd053c271e4b825c4642ab97371069a9c9811375245787a1c5484efe25e7e2ceeb56dac1658a5ee31154b84db2dd64c5e259409140c64
SSDEEP 6144:TFHvhlPKHwqcv9DqegNsKUuFLttFHg+hMrZ99hYN8khEnELU8Z:TtJlyHwqSBqpNsKUuntFJhMF9HC8VEx
TLSH
T1EC4412C3E194D62AF71BE8F0C3B98CA6D47F77829701C26A261C93991F2637A424173D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_md1xunhh.g02.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_md1xunhh.g02.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

lbbtnr.exe

Path C:\Users\Admin\AppData\Local\Temp\lbbtnr.exe
Size 239KB
SHA256 066676c81d5e29b350e3f607e661f68d9ab86881b8b8b00e2c4021b1497d63e2
MD5 295f4b39f97dfcf7d8fc0d1cdc4b8f1d
SHA1 234445b674531351c7f7a6ad90974afe990ed251
SHA512 65c1d1bb2e205fbe730775e725894ef25f5549f838179b51e73c1ed3fae871699af3217e5bc7cd351854b28fc4fce9c915187e65fa3738cabcb46c3aa9f2192b
SSDEEP 3072:I/kNVPxH19ld17e8Tb2yYEhR5m26Yy5Th7kSEX:IMNRxH19ld17e8TbJVZd6Ys7F
TLSH
T1A9340F037E88EB15E1A87E3782EF6C2413F2B4C71633860BAF49AF6515522525C7E72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe

Path C:\Users\Admin\AppData\Local\Temp\powershell.exe
Size 5KB
SHA256 445bb04a7353f673a2ac18e678353a1c5662429971f54b1e4df3c0a2dbc00d5c
MD5 951181afce27f42855d6e92cb7323109
SHA1 bf30c637dddd72cf598f9f462f837853f8f3efd5
SHA512 4fc172130a57b9eb51dde75c5f990dc9587f79096696a66f62b376cbaa1ba532ddd219898004b35ea1b56c7343ff953683a3dd3d3f781f7c7a4e05cc525a51bb
SSDEEP 96:Odew7V9yCHqYeSsX8BynqgHlNx4Ejj7azQtzNt:OvdaXoyqgHjz/7lH
TLSH
T1ADC1B44797DC436AE0A30371BCB303122774E8129A7BABAF25E4527A6EB534008537F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCCE5780BB854248C18578509216F9D5A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCCE5780BB854248C18578509216F9D5A.TMP
Size 1KB
SHA256 cd1db24295205f2549bd66ba1ab66e62d6f14ceaa58082a7b2d26e237e1f70f4
MD5 cf342b19dd6b2401025ddc78300688c5
SHA1 e743742c42e6cfbe868c131d358c5d5063899deb
SHA512 32403333094d8eb51ac61eab013aa21ec55440600dcee772c0c2ddc6124428ac20b766940c05835de2788d3ded3c94ffea8f90bbc17eb7cbb604dd6df1925259
TLSH
T19921C980A3E8421EF2B347307DF2C363A16DBE66CD7A43EC3488171B1F2550085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_36242bb71bda4523b39e4cfec2f9610d.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_36242bb71bda4523b39e4cfec2f9610d.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1968-254-0x00007FFC7EB20000-0x00007FFC7F184000-memory.dmp

Download

memory/1968-287-0x00007FFC93FF0000-0x00007FFC93FFC000-memory.dmp

Download

memory/1968-177-0x00007FFC9EF30000-0x00007FFC9EF3F000-memory.dmp

Download

memory/1968-259-0x00007FFC9A7E0000-0x00007FFC9A7EF000-memory.dmp

Download

memory/1968-180-0x00007FFC996B0000-0x00007FFC996C9000-memory.dmp

Download

memory/1968-263-0x00007FFC7F490000-0x00007FFC7F60F000-memory.dmp

Download

memory/1968-183-0x00007FFC80550000-0x00007FFC8057B000-memory.dmp

Download

memory/1968-170-0x00007FFC7EB20000-0x00007FFC7F184000-memory.dmp

Download

memory/1968-270-0x00007FFC875F0000-0x00007FFC875FB000-memory.dmp

Download

memory/1968-198-0x00007FFC9A7E0000-0x00007FFC9A7EF000-memory.dmp

Download

memory/1968-271-0x00007FFC87370000-0x00007FFC8737B000-memory.dmp

Download

memory/1968-274-0x00007FFC804F0000-0x00007FFC80502000-memory.dmp

Download

memory/1968-275-0x00007FFC80580000-0x00007FFC805A7000-memory.dmp

Download

memory/1968-276-0x00007FFC9EF30000-0x00007FFC9EF3F000-memory.dmp

Download

memory/1968-277-0x00007FFC996B0000-0x00007FFC996C9000-memory.dmp

Download

memory/1968-278-0x00007FFC80550000-0x00007FFC8057B000-memory.dmp

Download

memory/1968-279-0x00007FFC86060000-0x00007FFC8606B000-memory.dmp

Download

memory/1968-280-0x00007FFC879B0000-0x00007FFC879C9000-memory.dmp

Download

memory/1968-281-0x00007FFC9A4C0000-0x00007FFC9A4CD000-memory.dmp

Download

memory/1968-282-0x00007FFC7F960000-0x00007FFC7F985000-memory.dmp

Download

memory/1968-283-0x00007FFC7F950000-0x00007FFC7F95C000-memory.dmp

Download

memory/1968-201-0x00007FFC879B0000-0x00007FFC879C9000-memory.dmp

Download

memory/1968-203-0x00007FFC9A4C0000-0x00007FFC9A4CD000-memory.dmp

Download

memory/1968-205-0x00007FFC7F960000-0x00007FFC7F985000-memory.dmp

Download

memory/1968-207-0x00007FFC7F490000-0x00007FFC7F60F000-memory.dmp

Download

memory/1968-284-0x00007FFC9A440000-0x00007FFC9A44B000-memory.dmp

Download

memory/1968-285-0x00007FFC964E0000-0x00007FFC964EC000-memory.dmp

Download

memory/1968-227-0x00007FFC80580000-0x00007FFC805A7000-memory.dmp

Download

memory/1968-226-0x00007FFC804F0000-0x00007FFC80502000-memory.dmp

Download

memory/1968-225-0x00007FFC8E560000-0x00007FFC8E56C000-memory.dmp

Download

memory/1968-224-0x00007FFC93FF0000-0x00007FFC93FFC000-memory.dmp

Download

memory/1968-223-0x00007FFC95730000-0x00007FFC9573C000-memory.dmp

Download

memory/1968-222-0x00007FFC964E0000-0x00007FFC964EC000-memory.dmp

Download

memory/1968-221-0x00007FFC9A440000-0x00007FFC9A44B000-memory.dmp

Download

memory/1968-286-0x00007FFC95730000-0x00007FFC9573C000-memory.dmp

Download

memory/1968-219-0x00007FFC7EB20000-0x00007FFC7F184000-memory.dmp

Download

memory/1968-174-0x00007FFC80580000-0x00007FFC805A7000-memory.dmp

Download

memory/1968-288-0x00007FFC8E560000-0x00007FFC8E56C000-memory.dmp

Download

memory/1968-230-0x00007FFC875F0000-0x00007FFC875FB000-memory.dmp

Download

memory/1968-236-0x00007FFC9A7E0000-0x00007FFC9A7EF000-memory.dmp

Download

memory/1968-235-0x00007FFC7F950000-0x00007FFC7F95C000-memory.dmp

Download

memory/1968-234-0x00007FFC80550000-0x00007FFC8057B000-memory.dmp

Download

memory/1968-233-0x00007FFC86060000-0x00007FFC8606B000-memory.dmp

Download

memory/1968-232-0x00007FFC996B0000-0x00007FFC996C9000-memory.dmp

Download

memory/1968-231-0x00007FFC87370000-0x00007FFC8737B000-memory.dmp

Download

memory/2108-63-0x0000000000BE0000-0x0000000000BE8000-memory.dmp

Download

memory/2192-73-0x0000000006920000-0x00000000069B2000-memory.dmp

Download

memory/2192-51-0x0000000000150000-0x0000000000192000-memory.dmp

Download

memory/2192-52-0x0000000005CB0000-0x0000000006254000-memory.dmp

Download

memory/2192-53-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/2192-76-0x0000000000570000-0x000000000057A000-memory.dmp

Download

memory/2192-75-0x0000000006B40000-0x0000000006BDC000-memory.dmp

Download

memory/2192-74-0x0000000000460000-0x00000000004B0000-memory.dmp

Download

memory/3292-11-0x0000022B25720000-0x0000022B25732000-memory.dmp

Download

memory/3292-0-0x0000022B402E0000-0x0000022B402F0000-memory.dmp

Download

memory/3292-14-0x0000022B25760000-0x0000022B25770000-memory.dmp

Download

memory/3292-9-0x0000022B27F80000-0x0000022B27FA2000-memory.dmp

Download

memory/3292-77-0x0000022B4B510000-0x0000022B4C34C000-memory.dmp

Download

memory/3292-35-0x0000022B402E0000-0x0000022B402F0000-memory.dmp

Download

memory/3292-78-0x0000022B4C350000-0x0000022B4CDA8000-memory.dmp

Download

memory/3292-34-0x0000022B402E0000-0x0000022B402F0000-memory.dmp

Download

memory/3292-47-0x0000022B42B10000-0x0000022B42B44000-memory.dmp

Download

memory/3292-10-0x0000022B256C0000-0x0000022B2571E000-memory.dmp

Download

memory/3292-64-0x0000022B43490000-0x0000022B4350C000-memory.dmp

Download

memory/3292-65-0x0000022B43150000-0x0000022B43158000-memory.dmp

Download

memory/3292-48-0x0000022B402C0000-0x0000022B402C6000-memory.dmp

Download

memory/3292-1-0x0000022B402E0000-0x0000022B402F0000-memory.dmp

Download