9da498284e6bf12fde8df70054a26134500ed2d67f5f006ba2bb7417d07c9623

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DELIVERY RECEIPTإيصال التسليم-.js
Size 783KB
Sample260830-mt58aatyav
SHA256 9da498284e6bf12fde8df70054a26134500ed2d67f5f006ba2bb7417d07c9623
MD5 81bf19eb29cb3a2e0678a92b3f042dc2
SHA1 d872c05c263e27b6a51332a31631917beb94fde5
SHA512 8fdbc6d7173c5b007ce4aa481ac026eab35dfea2e489145711c475d24905b0de10b54ac3368217c8a7bed3e1db19d34574ca3088a354641e513df77265b3a2f6
SSDEEP 12288:6W4KlWWwFFNHHoQeNIvmBYRN2ADHvZ3n2GQ46iL7WrxMw31fOsbLAnUmo4h77E:T3lYFiQePYRN1pQ46inWrXVOsbSo4Z4
TLSH
T1ED0501483107F27EA897495A589B078D87D0D522C93A745C051E3CCBFAAAFC4EA3365F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Execution collection discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5336	.dfc_9d7bc4d9.dat
4664	.dfc_6e4bcdf3.dat

Loads dropped DLL 1 IoCs

pid	Process
3504	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Temporarily bypasses Powershell execution policy 1 TTPs 1 IoCs

Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

Execution

PowerShell

T1059.001

pid	Process
3308	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe
Key queried	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	CasPol.exe
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3308	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3308 set thread context of 2304	3308	powershell.exe	98

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2304	CasPol.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3308	powershell.exe
3308	powershell.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
5944	wmic.exe
5944	wmic.exe
5944	wmic.exe
5944	wmic.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe
2304	CasPol.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	2304	CasPol.exe
Token: SeIncreaseQuotaPrivilege	5944	wmic.exe
Token: SeSecurityPrivilege	5944	wmic.exe
Token: SeTakeOwnershipPrivilege	5944	wmic.exe
Token: SeLoadDriverPrivilege	5944	wmic.exe
Token: SeSystemProfilePrivilege	5944	wmic.exe
Token: SeSystemtimePrivilege	5944	wmic.exe
Token: SeProfSingleProcessPrivilege	5944	wmic.exe
Token: SeIncBasePriorityPrivilege	5944	wmic.exe
Token: SeCreatePagefilePrivilege	5944	wmic.exe
Token: SeBackupPrivilege	5944	wmic.exe
Token: SeRestorePrivilege	5944	wmic.exe
Token: SeShutdownPrivilege	5944	wmic.exe
Token: SeDebugPrivilege	5944	wmic.exe
Token: SeSystemEnvironmentPrivilege	5944	wmic.exe
Token: SeRemoteShutdownPrivilege	5944	wmic.exe
Token: SeUndockPrivilege	5944	wmic.exe
Token: SeManageVolumePrivilege	5944	wmic.exe
Token: 33	5944	wmic.exe
Token: 34	5944	wmic.exe
Token: 35	5944	wmic.exe
Token: 36	5944	wmic.exe
Token: SeIncreaseQuotaPrivilege	5944	wmic.exe
Token: SeSecurityPrivilege	5944	wmic.exe
Token: SeTakeOwnershipPrivilege	5944	wmic.exe
Token: SeLoadDriverPrivilege	5944	wmic.exe
Token: SeSystemProfilePrivilege	5944	wmic.exe
Token: SeSystemtimePrivilege	5944	wmic.exe
Token: SeProfSingleProcessPrivilege	5944	wmic.exe
Token: SeIncBasePriorityPrivilege	5944	wmic.exe
Token: SeCreatePagefilePrivilege	5944	wmic.exe
Token: SeBackupPrivilege	5944	wmic.exe
Token: SeRestorePrivilege	5944	wmic.exe
Token: SeShutdownPrivilege	5944	wmic.exe
Token: SeDebugPrivilege	5944	wmic.exe
Token: SeSystemEnvironmentPrivilege	5944	wmic.exe
Token: SeRemoteShutdownPrivilege	5944	wmic.exe
Token: SeUndockPrivilege	5944	wmic.exe
Token: SeManageVolumePrivilege	5944	wmic.exe
Token: 33	5944	wmic.exe
Token: 34	5944	wmic.exe
Token: 35	5944	wmic.exe
Token: 36	5944	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2304	CasPol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4768	3632	wscript.exe	91
PID 4768 wrote to memory of 3308	4768	cmd.exe	93
PID 3308 wrote to memory of 2476	3308	powershell.exe	94
PID 2476 wrote to memory of 3460	2476	csc.exe	95
PID 3308 wrote to memory of 2560	3308	powershell.exe	96
PID 2560 wrote to memory of 2708	2560	csc.exe	97
PID 3308 wrote to memory of 2304	3308	powershell.exe	98
PID 3308 wrote to memory of 2304	3308	powershell.exe	98
PID 3308 wrote to memory of 2304	3308	powershell.exe	98
PID 3308 wrote to memory of 2304	3308	powershell.exe	98
PID 3308 wrote to memory of 2304	3308	powershell.exe	98
PID 2304 wrote to memory of 5944	2304	CasPol.exe	99
PID 2304 wrote to memory of 3504	2304	CasPol.exe	102
PID 2304 wrote to memory of 2744	2304	CasPol.exe	103
PID 2744 wrote to memory of 3192	2744	csc.exe	105
PID 2304 wrote to memory of 5336	2304	CasPol.exe	106
PID 2304 wrote to memory of 6132	2304	CasPol.exe	110
PID 6132 wrote to memory of 2384	6132	csc.exe	112
PID 2304 wrote to memory of 4664	2304	CasPol.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CasPol.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\DELIVERY RECEIPTإيصال التسليم-.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i46ok59r\cfg_93476_2ab4.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -w h -nop -c "Set-ExecutionPolicy Bypass -Scope Process -Force; & 'C:\Users\Admin\AppData\Local\Temp\i46ok59r\run_99809_2a99.ps1'"
    3⤵
    - Temporarily bypasses Powershell execution policy
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gqkvdtmq\gqkvdtmq.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F6A.tmp" "c:\Users\Admin\AppData\Local\Temp\gqkvdtmq\CSCD9E9A7BDCABF462BA31CB19BEF7B2246.TMP"
        5⤵
        
        PID:3460
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zesqmngq\zesqmngq.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7015.tmp" "c:\Users\Admin\AppData\Local\Temp\zesqmngq\CSCE405C606C40F4E6188A94E74441F87E1.TMP"
        5⤵
        
        PID:2708
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      outlook_office_path
      PID:2304
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        "wmic" process where ProcessId=3308 get CommandLine /value
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Loads dropped DLL
        
        PID:3504
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_9d7bc4d9.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_9d7bc4d9.tmp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES964B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7721D83AA45F409F97DE26A0184DC736.TMP"
        6⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\.dfc_9d7bc4d9.dat
        
        "C:\Users\Admin\AppData\Local\Temp\.dfc_9d7bc4d9.dat" 3504 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.nacl.40201_0669"
        5⤵
        Executes dropped EXE
        
        PID:5336
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_6e4bcdf3.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_6e4bcdf3.tmp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6132
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9958.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8F9B840CA77743FBBDB1A4794525712F.TMP"
        6⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\.dfc_6e4bcdf3.dat
        
        "C:\Users\Admin\AppData\Local\Temp\.dfc_6e4bcdf3.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\aefqftga.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"
        5⤵
        Executes dropped EXE
        
        PID:4664

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 63KB
SHA256 0232e3d13e53fc069b113190903be389ec59f5991acd99aecc8011d19c2d9282
MD5 96a644ea4c30cd71c965810ad0bdad55
SHA1 e748e8bc6cee870b0fb5ea798faa29f0832170f3
SHA512 7b22ea69c18b7e1f4114fe2368688ebfc9a64803dfe23a2b0d460caf62c27e6f5b00b10752ebf69172eba040b7bcd5580a9fb9bf72025297dc6d47438fd13de0
SSDEEP 1536:MGLiTh9ZTWZg8FjwYDbCgs7ZodphAQ/m5:MGLiTh9uMYqgsiph9
TLSH
T1FF53C53871C981B7C297CD30586DBF12527330A38FE1669F33ACF61D1E7979A2A1650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_6e4bcdf3.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_6e4bcdf3.dat
Size 9KB
SHA256 9db87e112549f58809c45b00674b58c575dc8f447f6ee4ddeedab640ea461906
MD5 6062194c2b1fef5b2e1a4b6abb17fee7
SHA1 c31b1a6b93f17f5d1ece4578ca1c4beea7d95a5d
SHA512 f600189d88f3309a7d293eb926c4483f6028960fc5e1dda8eb8dbefa13d8eabef40e36fae8e3ca5ee517ccc5304f90813dbb925f5bd7f43f3b2debfaef936d2c
SSDEEP 192:L3GnXD2f3iMG1ImkWWZAZaoLlgEEUcr7BS:zm43ibpW0dnrc3
TLSH
T1F412D626B7F40662D9BE877D3872036052B0F6425973C74F2CDE396E9E713D54492BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_9d7bc4d9.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_9d7bc4d9.dat
Size 6KB
SHA256 7cc98e46f73bd25b5c8813cd2b365980cc5d88d3266421f843c13c9e3519241a
MD5 84c177d64083ec1b5db6a8a494e4c768
SHA1 eaef131cd205f5144b55898f1f76590fb39943e0
SHA512 13ef2adcc8d9464c6259bd958152603e34aca41232e18bcb6156b8ed3d4e0107d7d709c9a4687126cefd95f81315f5665e3822ca6b4d36023ed7e6539ee64c80
SSDEEP 96:+OoKU4XMuUdFis4hezvUvXf7dON88k38TbbkrV1QLBBzNt:W74hNL0Q7MBD
TLSH
T168C1099B87DC0772E8AD033C52B347112378E5A656138B9F2CC5416BAE23BE447233B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6F6A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6F6A.tmp
Size 1KB
SHA256 d068d40955c7bd044b52f83998de030de918e197006878ba140f3a3c82ebd0c1
MD5 3a3d927743507a10e4d6a6c1d84c5a2f
SHA1 7c5b6e1583f2e2811b7d140bc91897de7212ff04
SHA512 5782f9180a1af4b8e405fb14d7752d5b327e4a95a1d9d81789cbe498f5157fb48cbc56788a8df94f95cc9c26d23f277fc432283a26ca284a8f6c8c8657074087
TLSH
T12D218C0593E8871EF0734B3269F6172F9278FD54EFA1A75A9540422C2C51204EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES7015.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7015.tmp
Size 1KB
SHA256 6fa089c98c737af41b00b1209ca816f4f60f7b40e3892fa70c2d3dcac87d1547
MD5 b4f3e43052e48213949082494e66d78b
SHA1 9226f0998112df9b1c0f65481c01f5c043fe37fd
SHA512 86b4f60fc3a011f0fced80a5f81da87efddb7fdb31e0e47fc48f082e3d476669e72b4eebc0ee68c2169a8ee1382b3e16e4165bc8702dda87ba1591a1f43f8a17
TLSH
T163218C0557F9870EF0734B3169F6532F9274FE94AFA2935B868002286C52544EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES964B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES964B.tmp
Size 1KB
SHA256 ba73dac33dedabc552021b0b04d9d365c38127b3687557e2b03baefe6387fcb8
MD5 d01ed07a863f91f68007713efcb8809c
SHA1 07813762e58ebbe6600e5857e250fef97d10bbbc
SHA512 37f502ecbbbc9023e21d376884ae04eb28a672c3c41b853a54cee7a6187fe35308e987a5e017c465dc69d18a35faa8360b4f8e2f90d18ad9dd6c0af0c8f4a830
TLSH
T1A341444083EC8B2FE173433119F79729A774BF559EAA435D7188122E1E02744DEC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

RES9958.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9958.tmp
Size 1KB
SHA256 cc459dcbd8361a3af49515e769ae0d8329e2b6b69b3af0690a001b7106d75e00
MD5 95772d5c28b4c650f527a9b8c0a7be64
SHA1 4918d0f6f3e9f7146103b594432bac6e1343666b
SHA512 4ac095fd1af69a7a072eae9e6dadc4f40e8c88e7071df6cf26fc3aa80464650f34443c3f8bf6b4b800e7aa500100b1762539167a856b2bdd78eebb69092676ce
TLSH
T1AD41144093D8872FF173433229F79729A678BE56EADA875D7488122E1E02744DDD32B1
MD5 SHA1 SHA512 TLSH

Submit Download

gqkvdtmq.dll

Path C:\Users\Admin\AppData\Local\Temp\gqkvdtmq\gqkvdtmq.dll
Size 5KB
SHA256 2451a64d7c3a59c61ecf2d4b7533630aaff02412b72983d12242f927b0b05b22
MD5 2a06fb7a706dd2fe333e24ede54bb15c
SHA1 92629fe0e2b3d6b731d33f7f861c49b299827d73
SHA512 3aeeb40eb0179402faf2ad4441d279e8da8ff5ac39238adeb98feabfa237095e1194989338caef970c1a52b735d556171fb366ce66cf452e4bbd1356b012badf
SSDEEP 48:6oWqBYjSJHNDZMSaJD5a+5iFNaVje3bIIfib1gbmgDngdJjpjBXo+1ulda3Rq:04YjSJHpZMnJNtiKUrsXsPK
TLSH
T108B1821AD3DC0592F5AB073CBCB70B07E774E8844B2BCB6F19C4512A2CBBB641925B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg_93476_2ab4.cmd

Path C:\Users\Admin\AppData\Local\Temp\i46ok59r\cfg_93476_2ab4.cmd
Size 351B
SHA256 fad5801671b4413aea5b848c84012a39ba055e7f15175d6d787f80c2958afe13
MD5 4f9d128af8b7fc7e14e600937e775c77
SHA1 d79c9f5c554b77624807c2789869aa3b97541004
SHA512 8da54f1b0a56cb2870e71a218f79a1e4588f0d8415a05bd16752028785bb8203c36aefb42099abf830be74d133ef4172b2584bbdf9183cc56db1e5964bb2391b
TLSH
T12EE026C5B19A871C5C2CC82745B1DF3DD8B718596F427B91FB20841C778113CEB99349
MD5 SHA1 SHA512 TLSH

Submit Download

run_99809_2a99.ps1

Path C:\Users\Admin\AppData\Local\Temp\i46ok59r\run_99809_2a99.ps1
Size 733KB
SHA256 306535d99e4860a9e28a6db8692b663bfc92de7e5ae291fe21202260f5ada948
MD5 13a542300430ba7552617768b399c1ff
SHA1 97dca6d6593a93257e69854ccb6e21e7d5d3193f
SHA512 8a5084babb5da377003c228b6ab841457ecb1a68294663f8ba82abbbd9a44f7f316222e5871cf7352eb3d524dd05fe193149d36afd0765994114cf19cb7eb1d8
SSDEEP 12288:+V4KuW+whOuNzri7AIhmtwHN45QHFQpnZGZ6SNT2OpS3UQ1uOXuLAIF7O8hOV7:i3u+Oei7mwHNTTZ6SNiOp9pOXutO8kt
TLSH
T12FF402483507F2AEA8A3495D44D6479983C08133C579345C751E2CCBFFAAE88AE3379E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zesqmngq.dll

Path C:\Users\Admin\AppData\Local\Temp\zesqmngq\zesqmngq.dll
Size 4KB
SHA256 3818800a747a415959e12e46521dd5b3408e52f081128ce9f37e35a888584a55
MD5 2360705427e6a3aa8a6abc38c01c866a
SHA1 5dc81a0cc1e90a8bc1feaf834d8a7d59e9517d76
SHA512 cfdd86b6f0643c149ee7d20629e8a8b952643988ac0a751b8aacd6669c67a001f82641767b0a753a35ab1b8731f11c28fe0e993d858796f7dcdf444652b9eba3
TLSH
T1F1817606B7ED410EE07747715AF317636A74E9A0AE2773AF6DE002286C643609D21BF1
MD5 SHA1 SHA512 TLSH

Submit Download

.dfc_6e4bcdf3.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_6e4bcdf3.tmp
Size 5KB
SHA256 ee9b5b8c049eeaca0772d78791e4cbff4049d0390caf07a77ee27070df096f3a
MD5 d7433bc585ec75f7b7bd952a4cb6ebef
SHA1 7aafd22384aeaf19431c19c684e41d2d580ebb62
SHA512 2a5e5951acf357da7240b61db3716b5ca55e8f706d75b4757240fdca9d91acdd8510823c7983659658836aa557f8a19a247d21824f2fb6cadbadb4913debaac4
SSDEEP 96:6jPKov0Eqt0lGfVwarkv8ZE498dmzUYK+8hwbaTy8bLvbq7VOgQTy/x:GNc7yKE49JzUh+8WeyMhTwx
TLSH
T1E5B1954435A0E92BCEF4184A04DB067DEA42567347744CB3C7E64E094EB7912E179F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_9d7bc4d9.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_9d7bc4d9.tmp
Size 3KB
SHA256 b2039360f11e07eea9c58b242176fb079d2d8612c468ff8c5e126312cd64965a
MD5 d61abc178862a54927023622c2eba9fc
SHA1 6d0fc4892b1c793dbd98ef7e4eb65831c191eb54
SHA512 dc36c30a6cd42123ef69cb93aeae789d56642d514b78cda71547f1bb53a444ce290b6ac42c488452a8ec94639edc3682597d52b3ef029c9d030fbe8c91c74a2f
TLSH
T19161EE94235BA76026A3041F4ADBC059F3679133473EEC14BEAD8512AF8911FB379BA1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7721D83AA45F409F97DE26A0184DC736.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC7721D83AA45F409F97DE26A0184DC736.TMP
Size 1KB
SHA256 07fd16ad7e20807e4bfeb2a3a75a1f49d236e55e0dcba28917e5839586d05ae2
MD5 37be689cddf4c73011bef63e785a0351
SHA1 aba45df7dbfe47189ac3cf8cb7f6e3db4f734b9a
SHA512 9dcb352900cabb7edce2ba4c01192a6b356862e8153fb684120f28acd5f919eebe2e2a6b843ff4f34c8098ea832425d9b952a3da85b038bdb6e7d6fe6d7f3f5a
TLSH
T13521C981A3E8432EF1B347302AF2D3639568BF569D7983EC348C171F2F25A0089936B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8F9B840CA77743FBBDB1A4794525712F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC8F9B840CA77743FBBDB1A4794525712F.TMP
Size 1KB
SHA256 fc3e603042f7e36ee0ae34b57e9cef57c01aa936d9edf3dd2d9937500da81a03
MD5 95bf6354cd7c993a54b53fa5e112e5dc
SHA1 14d1638de8c695672594aaf13ac8f74088b74b27
SHA512 40b5fa5f3f62da70b24468e838c205593b66ae90635daa3e1f1fb83d6dc184aaa6f0d3dabd275c024be8809b93802781005a862d0ea219c7189721fa1950e931
TLSH
T1A121CC41A3E8821EF1B3473029F2C363956CBF56ACBA43EC3488175F2F15A0089936B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD9E9A7BDCABF462BA31CB19BEF7B2246.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gqkvdtmq\CSCD9E9A7BDCABF462BA31CB19BEF7B2246.TMP
Size 652B
SHA256 3c1f796b7a418e8ef079984a9e53283cbe3197d108893827ded896bead257ead
MD5 689b35cb0dd4f1b1b734e27e93adb12e
SHA1 1666c6eaf2e1a27b3aac50b08dc9b86d88ef366f
SHA512 c4cded3babd4649af651987f6f1d92ab80d5018e8b79c4ab1adca8577188aa72fceddab1e19a9d8606e1810614b11ed6e70f9066aea6dddd56417f010f3c3b20
TLSH
T1BBF03A09A3F8520EF0F34B30B9F6536391A8BD64DE32A3ED2444531D2C746109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gqkvdtmq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gqkvdtmq\gqkvdtmq.0.cs
Size 3KB
SHA256 d7603f5d018b5911bec49d7b9f4af4432a1bfe65569477fd3e2380cc439fe0f9
MD5 2a206de1a016d16431401f75cef137da
SHA1 b39ba632fb7d9b4788b9bd1829782977f3be84b9
SHA512 b39b6a8259eb47678b1e865a96260c88ffbf2cdc04e550c03a1a5599c73d5535050c1eb9155c96e364e009712cc46c7af435250467b5fc6e7be4eca3accc4c2f
TLSH
T15F613328136687A024D71025FA87A08BF613407329FF9C3079FD47261F8B249E4B2B6E
MD5 SHA1 SHA512 TLSH

Submit Download

gqkvdtmq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gqkvdtmq\gqkvdtmq.cmdline
Size 369B
SHA256 a8296a5b63b80ebd4850a24de49fc150409888ec85b897130a5a5841c3393637
MD5 7dec4fe7d3b6973872d5271dc3cb5b56
SHA1 81533ec53a29cb06eb7799cf2d8768c10f55943c
SHA512 c1a23095cdcbb295aee8af30fdb0b1b9e3d22a7a59274e58628830aa4ecf125ba6aadef6342f86dc9bb00a14d1a9ece27c3e9c8ba92ff60e69c405d154068710
TLSH
T1EBE0C02A4256C77EB1DD90076169CCACD37207532F403F845050441EE11B800A7E5781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE405C606C40F4E6188A94E74441F87E1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zesqmngq\CSCE405C606C40F4E6188A94E74441F87E1.TMP
Size 652B
SHA256 469f55f1765ecb61624ee1c492d5e22a28107ee2796041963ec6fa76e1a8738f
MD5 ae40ae9bef430e57f99d2a33bd139311
SHA1 0bd937c225696a56ddf4f08667d70b29dcd83e54
SHA512 562350cd7a4ef7ecf392df098785e0205ae47becb3c089ee8039247cb7c61f14e689d025fcfe86c74fab3d6c05e0fa3f8cba503187aa5ba806c119ed9ff9084f
TLSH
T1EDF05E0963F8420EF0F34F30BDF6936391A8BD64DE3293ED5540031928A45109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zesqmngq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zesqmngq\zesqmngq.0.cs
Size 2KB
SHA256 291785496efa7cf758790d1099c06384b3b4a6abae37d9f172f93ee7dce805ef
MD5 7b641fcc51c78df821f7ac51ca7c7dea
SHA1 d6a174f52d0ebd9afb24aafaffe6d41ca4292629
SHA512 fdf45d3b8216673851d652dc221a7653a9c662beb9e52cafc86ed48e2044f63650b8ad617bc0b3c9ed9baef980e657f0f3b5b3bde14f745caebf7be91780b4ce
TLSH
T1CB41AC41D9E3DA791A8784398F7DD5023798E03326E8FC48BD1DA6640F225511BF4A9E
MD5 SHA1 SHA512 TLSH

Submit Download

zesqmngq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zesqmngq\zesqmngq.cmdline
Size 369B
SHA256 05245ae9901b1ea8eb841fab011b0ade441bb69b07a87423eef4473ed13a915f
MD5 eee6159d3277a075797f662df3891d46
SHA1 aebd00fc508dc00d0e35fca3ffeae4cb0f560a67
SHA512 409ca1846424cff515a56da2280682c3e9aae73044c60cbead505356ba67509467342106b31c2adb0a478138f18a8079a81bfa13a599dbc59df079d5714ec1d2
TLSH
T132E0C03A5667C27D0FDD51072169C4BCE7F207C329403F845240441DF01B84437D1751
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2304-74-0x0000000008820000-0x0000000008870000-memory.dmp

Download

memory/2304-57-0x0000000000740000-0x00000000007D6000-memory.dmp

Download

memory/2304-76-0x0000000009140000-0x000000000966C000-memory.dmp

Download

memory/2304-75-0x0000000008A40000-0x0000000008C02000-memory.dmp

Download

memory/2304-64-0x00000000070E0000-0x00000000070EA000-memory.dmp

Download

memory/2304-63-0x0000000006F30000-0x0000000006FC2000-memory.dmp

Download

memory/3308-23-0x00000000060D0000-0x00000000060F0000-memory.dmp

Download

memory/3308-28-0x00000000070A0000-0x0000000007136000-memory.dmp

Download

memory/3308-20-0x00000000708D0000-0x000000007091C000-memory.dmp

Download

memory/3308-56-0x0000000007020000-0x0000000007028000-memory.dmp

Download

memory/3308-25-0x0000000007470000-0x0000000007AEC000-memory.dmp

Download

memory/3308-58-0x00000000071A0000-0x00000000071C2000-memory.dmp

Download

memory/3308-59-0x00000000080B0000-0x000000000866A000-memory.dmp

Download

memory/3308-26-0x0000000006E30000-0x0000000006E4A000-memory.dmp

Download

memory/3308-27-0x0000000006EA0000-0x0000000006EAA000-memory.dmp

Download

memory/3308-29-0x0000000007040000-0x0000000007051000-memory.dmp

Download

memory/3308-43-0x0000000006EA0000-0x0000000006EA8000-memory.dmp

Download

memory/3308-24-0x0000000006CF0000-0x0000000006D93000-memory.dmp

Download

memory/3308-19-0x0000000006CA0000-0x0000000006CD6000-memory.dmp

Download

memory/3308-18-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Download

memory/3308-17-0x0000000005AD0000-0x0000000005AEE000-memory.dmp

Download

memory/3308-16-0x00000000055C0000-0x000000000591B000-memory.dmp

Download

memory/3308-9-0x0000000000E30000-0x0000000000E66000-memory.dmp

Download

memory/3308-13-0x0000000004E10000-0x0000000004E76000-memory.dmp

Download

memory/3308-12-0x0000000004DA0000-0x0000000004E06000-memory.dmp

Download

memory/3308-11-0x0000000004D00000-0x0000000004D22000-memory.dmp

Download

memory/3308-10-0x0000000004EF0000-0x000000000553A000-memory.dmp

Download

memory/4664-114-0x0000000000DF0000-0x0000000000DF6000-memory.dmp

Download

memory/5336-87-0x00000000006F0000-0x00000000006F6000-memory.dmp

Download