phantom_stealer | ebe55ff8fe1a36f2101dcf651a5941432575ca645200768288f30dafe0f2c57f

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ 33418 -models.js
Size 830KB
Sample260825-csjmsaff83
SHA256 ebe55ff8fe1a36f2101dcf651a5941432575ca645200768288f30dafe0f2c57f
MD5 cb6b306445a523130dde73a5c33cf7fc
SHA1 7150f5d94f99d031463287bdcd79de53fd635aa6
SHA512 34df68b20d09d73e93dad40e041a562d5632b3fc9adbb276cba9a318f554bc3cb874787290155344d32609bef2feac0135b2feedba6ffd2f0c2d43a633aa29eb
SSDEEP 24576:pTwhVOMQJneDP63jffLO9wcZItM7B80pwJn:pYZJ0t481x
TLSH
T13605011C1F062DFA5AEAC20A9A3344FD1DE7D6C3C09EE5CB920AB4617B1931365DAD0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.gpi.com.eg
Port
587
Username
[email protected]
Password
GizaPower@321

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
PlRSZn+NC6yheiMZeVVf98agDqiPVtXFI8GmSS2m3K9QAAAAGeuLI9NMc7O9IHESBjLvO6Y7qdxpROcGm8Zx+cWNBQXRZYhzFOidjxSp3Wn5Tbd/yf4ZlE/YwL8qAkWOaUb32idu8q/n8cw6gwHTwsXQvUhojGX2OSioIxFmCencVil/
Username
SWHSeYk9wOMRzxoLSFCyo0vEtCpR1L+0GZT9bdlymBFQAAAAnvFKHuJqWgeev8XkH4wsIJT2z7svx+OFc2GtSp2qCfmdAXxjkHliz0VpDSe70Fb1MyT7cVdEKdOuCutFiLT/d20GfpNnDPT2XutMmsmxKbzOnRMqv/0x1bcD9C5pR3gE
Password
NmfmMpbJy7c5baTjtD3yt1AsV+ESTeNVO68oSIytftVQAAAA6Dpxnt9xEvcBtIamUQN8ux7olujR2PJ9pvZE/Y5LOm03IjPTWic43QpU/1v+KtkRORNZsWk8JeSX/Du7gZyh9+CMWTfW1D6eqxnEtc1mAoXkZ20CdEJyNciW0wj9Urj0
Email to
mjoMjIUlCPar2Nw0a6IUIFV7omw2ZovRRR0PfJzlFvxQAAAAmgJMGtdI77VAOwX4GXxku5gzJiJaOVOFthCx5g5H04NsGTfiQxLphgXXnx9A0aq7niwxTBjPvLQdtfMQRspI6Nfffzq2duAiK2NdiIRM24EhwmMVm5wjx1Q5Vxpyc1waTx0sW/qK6nlRXG30EG2gig==

Credentials

Protocol
ftp
Host
0
Username
0
Password
0

Mutex

6KOU7Z56D0O8MCHV7FX6

Wallets

Attributes

cookies
true
enable_ssl
true
keylogger
true
passwords
true
smtp_enabled
true

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HidMapRefresh_YQOI = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\print_spool_m\\print_spool_m_ZHLBZDCS.vbs\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HidMapRefresh_YQOI = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\print_spool_m\\print_spool_m_ZHLBZDCS.vbs\""	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
25	icanhazip.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1448	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
988	powershell.exe
4484	powershell.exe
4980	powershell.exe
3796	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	prevhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	prevhost.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
988	powershell.exe
988	powershell.exe
4484	powershell.exe
4484	powershell.exe
4980	powershell.exe
4980	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
3796	powershell.exe
1772	prevhost.exe
1772	prevhost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3796	powershell.exe
3796	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeIncreaseQuotaPrivilege	3796	powershell.exe
Token: SeSecurityPrivilege	3796	powershell.exe
Token: SeTakeOwnershipPrivilege	3796	powershell.exe
Token: SeLoadDriverPrivilege	3796	powershell.exe
Token: SeSystemProfilePrivilege	3796	powershell.exe
Token: SeSystemtimePrivilege	3796	powershell.exe
Token: SeProfSingleProcessPrivilege	3796	powershell.exe
Token: SeIncBasePriorityPrivilege	3796	powershell.exe
Token: SeCreatePagefilePrivilege	3796	powershell.exe
Token: SeBackupPrivilege	3796	powershell.exe
Token: SeRestorePrivilege	3796	powershell.exe
Token: SeShutdownPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeSystemEnvironmentPrivilege	3796	powershell.exe
Token: SeRemoteShutdownPrivilege	3796	powershell.exe
Token: SeUndockPrivilege	3796	powershell.exe
Token: SeManageVolumePrivilege	3796	powershell.exe
Token: 33	3796	powershell.exe
Token: 34	3796	powershell.exe
Token: 35	3796	powershell.exe
Token: 36	3796	powershell.exe
Token: SeDebugPrivilege	1772	prevhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	prevhost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 988	1584	wscript.exe	87
PID 1584 wrote to memory of 1448	1584	wscript.exe	89
PID 1448 wrote to memory of 4484	1448	cmd.exe	91
PID 1448 wrote to memory of 4884	1448	cmd.exe	92
PID 1448 wrote to memory of 2616	1448	cmd.exe	93
PID 1448 wrote to memory of 4692	1448	cmd.exe	94
PID 1448 wrote to memory of 4448	1448	cmd.exe	95
PID 1448 wrote to memory of 2276	1448	cmd.exe	96
PID 1448 wrote to memory of 4176	1448	cmd.exe	97
PID 1448 wrote to memory of 3732	1448	cmd.exe	98
PID 1448 wrote to memory of 4432	1448	cmd.exe	99
PID 1448 wrote to memory of 2928	1448	cmd.exe	100
PID 1448 wrote to memory of 980	1448	cmd.exe	101
PID 1448 wrote to memory of 4980	1448	cmd.exe	102
PID 4980 wrote to memory of 3796	4980	powershell.exe	104
PID 1448 wrote to memory of 4772	1448	cmd.exe	106
PID 3796 wrote to memory of 4732	3796	powershell.exe	108
PID 4732 wrote to memory of 4264	4732	csc.exe	109
PID 3796 wrote to memory of 1752	3796	powershell.exe	110
PID 1752 wrote to memory of 2300	1752	csc.exe	111
PID 3796 wrote to memory of 1804	3796	powershell.exe	112
PID 3796 wrote to memory of 3584	3796	powershell.exe	113
PID 1804 wrote to memory of 1772	1804	msiexec.exe	114
PID 1804 wrote to memory of 1772	1804	msiexec.exe	114
PID 1804 wrote to memory of 1772	1804	msiexec.exe	114

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4692	attrib.exe
4448	attrib.exe
2928	attrib.exe
4884	attrib.exe
2276	attrib.exe
4176	attrib.exe
3732	attrib.exe
4432	attrib.exe
4772	attrib.exe
2616	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ 33418 -models.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $PFVKXBW=$env:DDWWKV;$OQAU=$env:QCJTK;$MWCG=$env:ZCZJZDVW+$env:GNGJUHB+$env:QIIGNK+'.'+$env:UYQIWFV;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($MWCG));$TXAW=foreach($KQNOVQ in [IO.File]::ReadAllLines($OQAU)){if($KQNOVQ.IndexOf($PFVKXBW)-eq 0){$KQNOVQ.Substring($PFVKXBW.Length)}};[IO.File]::WriteAllLines($MWCG,[string[]]@($TXAW),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419425.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419425.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KFJBYNH))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4884
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.bat"
    3⤵
    - Views/modifies file attributes
    PID:2616
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m.dat"
    3⤵
    - Views/modifies file attributes
    PID:4692
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZOBFDGUZ.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4448
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m.dat"
    3⤵
    - Views/modifies file attributes
    PID:2276
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZOBFDGUZ.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4176
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m"
    3⤵
    - Views/modifies file attributes
    PID:3732
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419425.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4432
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZHLBZDCS.vbs"
    3⤵
    - Views/modifies file attributes
    PID:2928
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v HidMapRefresh_YQOI /t REG_SZ /d "C:\Windows\System32\wscript.exe //B //nologo ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZHLBZDCS.vbs"""
    3⤵
    - Adds Run key to start application
    PID:980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KFJBYNH))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KFJBYNH))"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3796
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fxqixltc\fxqixltc.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4732
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AE3.tmp" "c:\Users\Admin\AppData\Local\Temp\fxqixltc\CSC24D656B686AA41ABAB855BF492C6F825.TMP"
        6⤵
        
        PID:4264
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzuvok3r\bzuvok3r.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1752
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C4B.tmp" "c:\Users\Admin\AppData\Local\Temp\bzuvok3r\CSCE7558141E7E45428F58D0B93E40139D.TMP"
        6⤵
        
        PID:2300
    - - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1804
      - C:\Windows\system32\prevhost.exe
        
        "C:\Windows\system32\prevhost.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        outlook_office_path
        
        PID:1772
    - - C:\Windows\system32\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        
        PID:3584
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419425.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

20267251787624419425.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624419425.cmd
Size 805KB
SHA256 c57bf6cdc028cba0687de640d624902a24ae0358d7945a34124ecc1b40d94a2e
MD5 054692f07a5c8a18948bb7bea8ff835e
SHA1 a0d0a9e59f54709852e4c5ae5f15fbad0a18d73d
SHA512 4efc924d6c8fe2acffb597dfebf3120a3e80ff779453eab847ea2bf1ee5aae95ecabce6398f9ccb3fcf01d478af12d4800251dbc021227366ebe5e0ed6a9da5f
SSDEEP 24576:SVcpW5Lhfhgh6QbbqCJBp4JgVTMIZliZhd:ZnLRVdZcP
TLSH
T15D0522681E495EA8BDF5A12B9540DDE82B17EFC7436BEBCC340E7AE2150D607DB24843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e89ad586ef881dc10f8c2b5e3e6311f3d1ecf971b35655deb3e0c078cb27a749
MD5 c58e5ea85a22b1f8d2cf42a76a29f32e
SHA1 324f2aab48d66d2a04dc84f45a9d8796b2f7d01e
SHA512 1e9af06639ef953808d682145889f7d6d340caa31514bbc1f123636cf269251f61493f7018f2ea5a56284d8b61de9715f60d8a82da839b26719e30135fc124cf
TLSH
T155112223F38C8A60CC96163A509DAC5172B586CB81AEDF9F7BC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 39319b925401a80d0ae21f4939bef240b502cc3d5c7888d6b129e46e9725b766
MD5 617d85ff0f001d274e6288cda18ca5a6
SHA1 8c3a77941cd63b213d47e35774f4a21ef4ff92ed
SHA512 ab580aa49f4c7f85afef78a24824b313148910c4e062e8bcde093c547bcbd04e1abff8b45a2740663c7483d1f938e9d70a5ede00ab0b11594fa15b343f8f170f
TLSH
T194215627B3DC8921CC96163A109D9C1176B683C7819EDF9F6BC4D614A07F999CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

RES9AE3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9AE3.tmp
Size 1KB
SHA256 a04e7d9d42d4b584271d4cb8d4f243d7c2da1962e9635ec264566b0ad0298fe6
MD5 d9984599fe705251637d1968b247ce02
SHA1 449c7354568047d38c43982a55598256630a5ec0
SHA512 518a0cfb54782328e4b4fca8abbcc885a26bc9228d2d75db46d1bcd3dcc5404227a9d229270d0e4625d41d42591781f3a3406436bd412ecfc79e34be608a7b9f
TLSH
T1A621AA0457EA471BF0B35B3179FB072BA624FD55EFA6935B8540522C2C42604EEE0AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES9C4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9C4B.tmp
Size 1KB
SHA256 5f10228e0b2227db12fce3f9a1066e2811ae8fb1ab47cc788d828f81c60908b4
MD5 04b3711b6434ab048ab7bec1a36e0a00
SHA1 fefd97ac8d2667c1f7e99cb9a9b9c594e707a589
SHA512 1d8d87af761d1972f8b46b5e90693d1c594d1c0170fe365d791ab3fb72bf60197b2b832c7b192dc46960d86422a18c4959dbc9e6eb5fae8b0ac939c2cfa083a2
TLSH
T17C21AA0453EC431BF073573169F6076BA275FEA5EF62939B854052282C51604EEE1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rpzkybal.ufs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpzkybal.ufs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bzuvok3r.dll

Path C:\Users\Admin\AppData\Local\Temp\bzuvok3r\bzuvok3r.dll
Size 66KB
SHA256 c44cfbe3f649aa229fc30003830228cb35f23c6be41de8a14635c79865f554cb
MD5 8f9e90e0ece7a23402220a32b18c737d
SHA1 0887a87307e30bfcc0d59a2afb1b4c924a66d71d
SHA512 ea644a47a08360f678cf0224820fd5dbeb8f07efb9a70834ac19f006f8c28c0455b09d1c9653a2bfbf3a533deed0a8e1a62f2b5f900f34cee8059b81380416a7
SSDEEP 1536:5pApJfk8mK288KbTC31L0Ea4WVIqJtPnItNGcMUYFtDfCO+y37wgHHo5g97EaU/x:5pApJfTmKD8KbTClL0Ea4WfQQ5UItx3G
TLSH
T1F663195577F84968F27E6B7696B102809738B0873B73E78E02E541E92F737C08616BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxqixltc.dll

Path C:\Users\Admin\AppData\Local\Temp\fxqixltc\fxqixltc.dll
Size 3KB
SHA256 135a5ba0d9dae575e440c1b2740a5c44f0271e363046e13827262ceefb154078
MD5 419344af676d74da5661cf8df00cb6c1
SHA1 d59803e7d66623ac01189c14a67bac6208038365
SHA512 08eed2407ff568bc0059e47008a58787a5e724a4449257ba30fd75055d548a834b2d627eb5a404a58906b55c355797993afe724904a0ad964acd0ef43eced1d5
TLSH
T16E51782657E94227F0B74B306EF3072736B4F9208F76935E1981032C6C50AA46E61FB1
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_3796_e589d54.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_3796_e589d54.txt
Size 86B
SHA256 81f886195b6b64ce22c3dedd3a9db000e6611ab1ea7b24a652f9a53dc046013e
MD5 50769c4e86d38b15132118338fda86e5
SHA1 d69bad6282b8d00c66c4bf4e04c9f462fb811917
SHA512 d3f3770779177db55376fc84e472cdd7620912406fc8691206e5daa2a58e4c6f29ec7ece666d13c5b0baddbe6d3f09b85c57c694ea8787d3cfc93ddfe96293f6
TLSH
T1F2A0112A08A30C0AC22A0F80200E308202A0B8822BC2AC808AA00BF0B008E22CB08328
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_3796_e589d54.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_3796_e589d54.txt
Size 70B
SHA256 965854201ec62c9df59ce96aa44be32e1e53a8bdb6a1656a1dce8738a5c92d69
MD5 c4f02cf94ea68adb6d9c9f924d8bc2d3
SHA1 40b15bdc3aaf6e230cd8ac4e12cdc71818a8803f
SHA512 95bb8416a75e58ebdd7f6955a078cb67f7717df361da5fcbfdfb25e86df05d78a4ccdd71e7956f066f15e0639c7ecf9f4e296deee642e5dad63e5437e682c6a1
TLSH
T14DA0026F0CB74C5BC65A1F15154D71D146A0B5826BD7BC40D6D047F1B059E75C309768
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE7558141E7E45428F58D0B93E40139D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bzuvok3r\CSCE7558141E7E45428F58D0B93E40139D.TMP
Size 652B
SHA256 1863ce0e0291bf994f7a81b203acac533e75d724a879edc850282cb20c317e92
MD5 a65f289b7c9e8edb6b24bcb6b5d1ed6c
SHA1 e25527b02a23fb313558c6988c711e18e1e8db0e
SHA512 70e464ee000d1a648127a15db82aedb0e54f0b52b07c6d711fbfd9a6789f5eb0a0f5eb350f373115c323c2bc46c6480bea83eae2b75a6d425a428f4d5ef91f04
TLSH
T16EF0540963F8020EF0F34B30BDF543A39169BCA5EE3253ED5440431D1C7451089A2F72
MD5 SHA1 SHA512 TLSH

Submit Download

bzuvok3r.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bzuvok3r\bzuvok3r.0.cs
Size 94KB
SHA256 91be6c0d34859ccf98fb316499e9e13c9cdfa9f59e16bda4eb5ba34d3e9002fd
MD5 4f3ffc42331eda49772b993e0a82f8f1
SHA1 97912aceaaf15d65d7637ccbb0eab0bb00afe17f
SHA512 9ebad6d939b2467645f16702a8e879492d4cbceb842fdc2a0fd0553251978435adc78ddf7fd60c5c6c1fca07f573951bccc79bfb60c3d71498eb81432a04c370
SSDEEP 1536:GzrlD7vZAJLdOmXJ5UftfVpqu9qMipdjbbdAMwndoDNkm/MqB21Ss:W74dOg5UlfVpqu9qMipdjfdAMwdoDNkb
TLSH
T11493C591A709912E6DD02529ACCC604EFB53C53123F914B4D9ADC1A03E4E67DD2BFFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzuvok3r.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bzuvok3r\bzuvok3r.cmdline
Size 247B
SHA256 1fbaeaf270740a4549dfb2737fe0f68e271a75380aed9aa2893e52f758a2416b
MD5 f004b9674785e5df75304f8cfa3c5599
SHA1 9c8120c4d82ef73d1e7e8b0d5a4041173080a4da
SHA512 16f0f6061a1fd917fe162bce51f5ae8cecd4cec53e0a8dc644a5399851addf07afcf61f744f5599e4492e1bb40ad7399dd0dfcde97298bc57fcb84e3c0b75823
TLSH
T19ED05E2983C6C62B32D910572896C4AC43F29B195F473F50F5A4824C25170497AD17D6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC24D656B686AA41ABAB855BF492C6F825.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fxqixltc\CSC24D656B686AA41ABAB855BF492C6F825.TMP
Size 652B
SHA256 1859881bdca57593c4663f1544bd196bc8cfaa1ccde083191cfca7208f698424
MD5 57d959b34be20c66c30e05083845f8f4
SHA1 658c4ddbe8b53977cf51c5e8ac29e519c2b6a00d
SHA512 cdec33f1e9fb0804c865ca58c0fe3888b3d05c06d0891014eb0a6e9cd27171717006726a27f40096164d649bce9ff273b6d18171e87274280160ca2d4d80d568
TLSH
T1FFF05E0967F9420EF0F34F31BDF6436395A8BC64DE3293ED1480031D286591089B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fxqixltc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fxqixltc\fxqixltc.0.cs
Size 60B
SHA256 987fefb55f5ec95ae927ada3bfbfb64e8f022193cfb3296ec65b561053578c72
MD5 5008e65bbf396b7984284b437a87f2f2
SHA1 05c32416a4a9ffc8f61bbc7c754803b56dbc06d6
SHA512 004d9177e0fab5c1e109d5243259b07c4de2c67ae4f9137b611f866395bf987f534c1f58011dbfd3c5b54de2819469fd21fd83e79678d68b28578f01f28b73f8
TLSH
T1E0A002413651E5350987D803C511CC33EB0694F05BBC7E12C1550F113E0040BB23816B
MD5 SHA1 SHA512 TLSH

Submit Download

fxqixltc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fxqixltc\fxqixltc.cmdline
Size 369B
SHA256 2a43bbcc59198a45a2c64d60d35df7365bb484a8a76ad4d43ce238352f8b8f4c
MD5 8e3312f7f750c5a7c8331c983e7fe506
SHA1 71dd882c4b2c1b4f24ad8e28eb87efebaef3bbad
SHA512 b1c53b94e05f2507aba667b753450e78f422ae997811ec2839a881a7b736d388e4407f77631ddc4c9ac44194ab9009a273bc7eda18298a7a23cf0a983bbb97e6
TLSH
T1C5E06F3B4286C27D01E9180B226AC6BCA37206833AC8BF849C40840DE0A74C43BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-1-0x0000028ACE030000-0x0000028ACE040000-memory.dmp

Download

memory/988-0-0x0000028ACE030000-0x0000028ACE040000-memory.dmp

Download

memory/988-4-0x0000028AE8810000-0x0000028AE8832000-memory.dmp

Download

memory/1772-122-0x0000024DE79B0000-0x0000024DE7ED8000-memory.dmp

Download

memory/1772-116-0x0000024DE72B0000-0x0000024DE7472000-memory.dmp

Download

memory/1772-117-0x0000024DE70E0000-0x0000024DE7156000-memory.dmp

Download

memory/1772-107-0x0000024DCE670000-0x0000024DCE6DA000-memory.dmp

Download

memory/1772-99-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/1772-108-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/1772-100-0x0000024DCC940000-0x0000024DCC941000-memory.dmp

Download

memory/1772-118-0x0000024DE7160000-0x0000024DE71B0000-memory.dmp

Download

memory/1804-95-0x0000024D2DBB0000-0x0000024D2DC00000-memory.dmp

Download

memory/1804-98-0x0000024D2DC00000-0x0000024D2DC67000-memory.dmp

Download

memory/1804-96-0x0000024D2DC00000-0x0000024D2DC67000-memory.dmp

Download

memory/1804-83-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/1804-79-0x0000024D2DBB0000-0x0000024D2DC00000-memory.dmp

Download

memory/3796-78-0x000001C0C4790000-0x000001C0C47A8000-memory.dmp

Download

memory/3796-65-0x000001C0AA200000-0x000001C0AA208000-memory.dmp

Download

memory/3796-52-0x000001C0C49C0000-0x000001C0C49E4000-memory.dmp

Download

memory/3796-51-0x000001C0C49F0000-0x000001C0C4A1A000-memory.dmp

Download