Agent Tesla IOC's

Creates:
C:\Users\user1\AppData\Roaming\ScreenShot\screen.jpeg
C:\Users\user1\AppData\Local\Temp\Ftplist.txt

Checks:
HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites
HKEY_CURRENT_USER\Software\Paltalk
HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
C:\Users\Jonathan\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Jonathan\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
C:\Users\Jonathan\AppData\Roaming\.purple\accounts.xml
C:\Users\Jonathan\AppData\Roaming\Thunderbird\profiles.ini

Checks external IP:  checkip.dyndns.org with minimal headers (no UA)
May POST to a panel (php), usually api.php
May exfil data via email, usually submission; may exfil via web POST or FTP as well

May use a vbs file with the same name as the exe for persistance:
C:\Users\Administrator\AppData\Local\Temp\subfolder\filename.vbs
C:\Users\Administrator\AppData\Local\Temp\subfolder\filename.exe

Found in memory:
11658754 <br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:
11658874 <br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:
11659014 <br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;:
11659114 <br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;:
11659214 <br>OS&nbsp;Version&nbsp;&nbsp;&nbsp;&nbsp;:
11659322 <br>CPU&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:
11659490 <br>RAM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:
11659658 <br>VideocardName&nbsp;:
11659726 <br>VideocardMem&nbsp;&nbsp;:
11659806 <br>IP Address&nbsp;&nbsp;:
11659878 <br>=================