cyber_stealer | 662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250610-en
submitted
30/06/2025, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe
Size 3.2MB
Sample250630-wtx2catpt4
SHA256 662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642
MD5 a61d62974755e0484666c617bf53627d
SHA1 b0970bfe2b8943b4536fc89cb23d03ce90c2b449
SHA512 5f126aac10ef003ea5179e4c42ed5ce91d0edf9c68ef754a5b4307a51f0115d0652ee1b633a03f24397b926bc35c1ca3212eb356c732c9a95af9546b9ee6c102
SSDEEP 49152:4xXXm66OSPBrotk/qIEic0c8ADZLJwb5zMhzEzftRD92mhUDzsPRMSy0xS76:4xHXSPBMkR4Ve5zMez7Dtgz4RMSm76
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cyber_stealer discovery execution stealer

Malware Config

Extracted

Family

cyber_stealer

https://paxrobot.digital/webpanel/

Attributes

pastebin
https://pastebin.com/raw/6K66Aeyr

Signatures

CyberStealer
CyberStealer is an infostealer written in C#.
stealer cyber_stealer
Cyber_stealer family
cyber_stealer

Detects CyberStealer 1 IoCs

resource	yara_rule
behavioral2/memory/4896-82-0x0000000025930000-0x00000000259FA000-memory.dmp	family_cyberstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to execute payload.

execution

PowerShell

T1059.001

pid	Process
2568	powershell.exe
5844	powershell.exe
4968	PowerShell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	regsvr32.exe

Executes dropped EXE 3 IoCs

pid	Process
224	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp
4848	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp
5556	Zip.exe

Loads dropped DLL 5 IoCs

pid	Process
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
416	regsvr32.exe
1012	regsvr32.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\CloudStorage\OneDrive\desktop.ini	regsvr32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com
10	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3216	1012	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	regsvr32.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	regsvr32.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5516	ipconfig.exe
1440	ipconfig.exe
2396	ipconfig.exe
2620	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
2568	powershell.exe
2568	powershell.exe
4968	PowerShell.exe
4968	PowerShell.exe
5844	powershell.exe
5844	powershell.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
4896	regsvr32.exe
416	regsvr32.exe
416	regsvr32.exe
416	regsvr32.exe
416	regsvr32.exe
4896	regsvr32.exe
1012	regsvr32.exe
1012	regsvr32.exe
1012	regsvr32.exe
1012	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeIncreaseQuotaPrivilege	2568	powershell.exe
Token: SeSecurityPrivilege	2568	powershell.exe
Token: SeTakeOwnershipPrivilege	2568	powershell.exe
Token: SeLoadDriverPrivilege	2568	powershell.exe
Token: SeSystemProfilePrivilege	2568	powershell.exe
Token: SeSystemtimePrivilege	2568	powershell.exe
Token: SeProfSingleProcessPrivilege	2568	powershell.exe
Token: SeIncBasePriorityPrivilege	2568	powershell.exe
Token: SeCreatePagefilePrivilege	2568	powershell.exe
Token: SeBackupPrivilege	2568	powershell.exe
Token: SeRestorePrivilege	2568	powershell.exe
Token: SeShutdownPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeSystemEnvironmentPrivilege	2568	powershell.exe
Token: SeRemoteShutdownPrivilege	2568	powershell.exe
Token: SeUndockPrivilege	2568	powershell.exe
Token: SeManageVolumePrivilege	2568	powershell.exe
Token: 33	2568	powershell.exe
Token: 34	2568	powershell.exe
Token: 35	2568	powershell.exe
Token: 36	2568	powershell.exe
Token: SeDebugPrivilege	4968	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4968	PowerShell.exe
Token: SeSecurityPrivilege	4968	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4968	PowerShell.exe
Token: SeLoadDriverPrivilege	4968	PowerShell.exe
Token: SeSystemProfilePrivilege	4968	PowerShell.exe
Token: SeSystemtimePrivilege	4968	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4968	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4968	PowerShell.exe
Token: SeCreatePagefilePrivilege	4968	PowerShell.exe
Token: SeBackupPrivilege	4968	PowerShell.exe
Token: SeRestorePrivilege	4968	PowerShell.exe
Token: SeShutdownPrivilege	4968	PowerShell.exe
Token: SeDebugPrivilege	4968	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4968	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4968	PowerShell.exe
Token: SeUndockPrivilege	4968	PowerShell.exe
Token: SeManageVolumePrivilege	4968	PowerShell.exe
Token: 33	4968	PowerShell.exe
Token: 34	4968	PowerShell.exe
Token: 35	4968	PowerShell.exe
Token: 36	4968	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4968	PowerShell.exe
Token: SeSecurityPrivilege	4968	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4968	PowerShell.exe
Token: SeLoadDriverPrivilege	4968	PowerShell.exe
Token: SeSystemProfilePrivilege	4968	PowerShell.exe
Token: SeSystemtimePrivilege	4968	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4968	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4968	PowerShell.exe
Token: SeCreatePagefilePrivilege	4968	PowerShell.exe
Token: SeBackupPrivilege	4968	PowerShell.exe
Token: SeRestorePrivilege	4968	PowerShell.exe
Token: SeShutdownPrivilege	4968	PowerShell.exe
Token: SeDebugPrivilege	4968	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4968	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4968	PowerShell.exe
Token: SeUndockPrivilege	4968	PowerShell.exe
Token: SeManageVolumePrivilege	4968	PowerShell.exe
Token: 33	4968	PowerShell.exe
Token: 34	4968	PowerShell.exe
Token: 35	4968	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4848	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 224	1196	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe	81
PID 1196 wrote to memory of 224	1196	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe	81
PID 1196 wrote to memory of 224	1196	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe	81
PID 224 wrote to memory of 3860	224	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp	82
PID 224 wrote to memory of 3860	224	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp	82
PID 224 wrote to memory of 3860	224	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp	82
PID 3860 wrote to memory of 4848	3860	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe	84
PID 3860 wrote to memory of 4848	3860	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe	84
PID 3860 wrote to memory of 4848	3860	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe	84
PID 4848 wrote to memory of 2404	4848	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp	85
PID 4848 wrote to memory of 2404	4848	662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp	85
PID 2404 wrote to memory of 4896	2404	regsvr32.exe	86
PID 2404 wrote to memory of 4896	2404	regsvr32.exe	86
PID 2404 wrote to memory of 4896	2404	regsvr32.exe	86
PID 4896 wrote to memory of 2568	4896	regsvr32.exe	87
PID 4896 wrote to memory of 2568	4896	regsvr32.exe	87
PID 4896 wrote to memory of 2568	4896	regsvr32.exe	87
PID 4896 wrote to memory of 4968	4896	regsvr32.exe	90
PID 4896 wrote to memory of 4968	4896	regsvr32.exe	90
PID 4896 wrote to memory of 4968	4896	regsvr32.exe	90
PID 4896 wrote to memory of 5844	4896	regsvr32.exe	93
PID 4896 wrote to memory of 5844	4896	regsvr32.exe	93
PID 4896 wrote to memory of 5844	4896	regsvr32.exe	93
PID 4896 wrote to memory of 1440	4896	regsvr32.exe	95
PID 4896 wrote to memory of 1440	4896	regsvr32.exe	95
PID 4896 wrote to memory of 1440	4896	regsvr32.exe	95
PID 4896 wrote to memory of 2396	4896	regsvr32.exe	97
PID 4896 wrote to memory of 2396	4896	regsvr32.exe	97
PID 4896 wrote to memory of 2396	4896	regsvr32.exe	97
PID 4896 wrote to memory of 2620	4896	regsvr32.exe	99
PID 4896 wrote to memory of 2620	4896	regsvr32.exe	99
PID 4896 wrote to memory of 2620	4896	regsvr32.exe	99
PID 4896 wrote to memory of 5516	4896	regsvr32.exe	101
PID 4896 wrote to memory of 5516	4896	regsvr32.exe	101
PID 4896 wrote to memory of 5516	4896	regsvr32.exe	101
PID 4896 wrote to memory of 5556	4896	regsvr32.exe	106
PID 4896 wrote to memory of 5556	4896	regsvr32.exe	106
PID 1976 wrote to memory of 416	1976	regsvr32.EXE	108
PID 1976 wrote to memory of 416	1976	regsvr32.EXE	108
PID 1976 wrote to memory of 416	1976	regsvr32.EXE	108
PID 5192 wrote to memory of 1012	5192	regsvr32.EXE	110
PID 5192 wrote to memory of 1012	5192	regsvr32.EXE	110
PID 5192 wrote to memory of 1012	5192	regsvr32.EXE	110

C:\Users\Admin\AppData\Local\Temp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe
"C:\Users\Admin\AppData\Local\Temp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\is-H1TR9.tmp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H1TR9.tmp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp" /SL5="$4017A,2346512,817664,C:\Users\Admin\AppData\Local\Temp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Users\Admin\AppData\Local\Temp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe
    "C:\Users\Admin\AppData\Local\Temp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\is-K27TD.tmp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-K27TD.tmp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp" /SL5="$8027C,2346512,817664,C:\Users\Admin\AppData\Local\Temp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\Sysnative\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\DarkRed2.pfx"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2404
      - C:\Windows\SysWOW64\regsvr32.exe
        
        /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\DarkRed2.pfx"
        6⤵
        Drops file in Drivers directory
        Loads dropped DLL
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\DarkRed2.pfx\"' }) { exit 0 } else { exit 1 }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -NoProfile -NonInteractive -Command -
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5844
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        "ipconfig" /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:1440
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        "ipconfig" /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:2396
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        "ipconfig" /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:2620
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        "ipconfig" /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Zip.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Zip.exe"
        7⤵
        Executes dropped EXE
        
        PID:5556

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1980

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\DarkRed2.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\DarkRed2.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:416

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\DarkRed2.pfx"
1⤵
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\DarkRed2.pfx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 760
    3⤵
    - Program crash
    PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1012 -ip 1012
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DarkRed2.pfx

Path C:\Users\Admin\AppData\Local\DarkRed2.pfx
Size 2.6MB
SHA256 ec015ee7de7c5818b92c190c30a1dfd9c1bbc24afeefa2209302c8adfa28f94f
MD5 35822dc3551cf1941317ec4cee56a7ab
SHA1 405f07de95fc7c53e4dc0d43413dde176e727705
SHA512 316765715d99622406e33f255668aa8f84cc30463872759b352fda3c7e7087cf3c7242c611f1d01acb40c5cf2c65102f4e46aaeed4ff6786132cafea25868610
SSDEEP 24576:4ewZZIRgPQvLimVC1ZyNEDQmwpIlSY4xENr4IzP0hkwo967kVELRRnSLukeXSDbl:4Da0ryWRYwukPjucODjmbZumRZ0jqf82
MD5 SHA1 SHA512 SSDEEP

Submit Download

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 3f033142ed64a5d1e1e19d11a710e22a32827e98922769497ed6bd6e452e44de
MD5 5dc9a9599fb11ee70f9164d8fea15abf
SHA1 85faf41a206f3fa8b469609333558cf817df2cda
SHA512 499407006c53a5f8e5b2b00dab734613762e66a9080504ab50d21e4c8a32b75d7308ccaa0cecfbeb7058044448a40912715da1f02ec72994596d567b515dcfca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 d8a7a594fd86accf7514f8971b14287fd2681731f4238bee3e16b8fe9b1a6710
MD5 8dd1d0b6cc5f0d213e3a4861d662030b
SHA1 ee953820f0e9f405de622ce5c583aed7bc51c28c
SHA512 5a2c4adb10bde287fcdf88476fd5775b7d7ea616e4cb002a73707708920283ac6887d1a1e8b11c26e8d10826c06465e4a9c96b0952fcf64a1dba14c70c796948
SSDEEP 384:lTHR2SS15SPUGofwpLeSczpjsa1debXF5UWmlfde7/xEeRrbrKTd549PKH:mSSePUB6eBljVdy5UVhde7eeZeN
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 198ea0480ff8e149afd748bf8785e2b42aa43aa4cd3d199a1b155416bce6de7b
MD5 62bfc695920f072fa4e9616ac5b2712d
SHA1 c3ef05508a873e95508fef58e05e1cfaba5d008c
SHA512 998d7941d971a8c653a7395e8e18ccb90c0d7fa26239b88e36055566f6018d457ef1c09a65323756ea6720107af0384ea3572394b4a8f39d58fb43e1dd398c90
SSDEEP 384:1L3HTVSS1qSG2XRE0nnNzjs2CFKovk9BREfDE5dTtsYAccjbVQ:tJSSueRE0Nzj7CFKoc9BREfAdTthov+
MD5 SHA1 SHA512 SSDEEP

Submit Download

GB_BFEBFBFF00090672Xeipinrc.zip

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc.zip
Size 892KB
SHA256 9c203aeee2d3f6c00b01839b8c29db495302086afec339f66077e349234a60e8
MD5 5f693aed66bcec69e156bc5539ca1323
SHA1 97d38efe4e50c4ee50f40a4f021e7031838e49ba
SHA512 0d564823ad25741abc12f533e8d06422241764ac59d47ca0bb1bced69935719f6079f135d81bd006c8ba3e0ec890c8a7033fd9a6764fa95e9bf118f27d76214b
SSDEEP 12288:O6U1xBskqsEixTDvu9HVwT5cJd8+IWDbd3RNyd4JQ4sETHUpVi3QBc26h70LB7up:Of1IsEmnunWrK8aJXsEY23QSvhWBq0i3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Chrome\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Chrome\Preferences
Size 11KB
SHA256 462e60fdc9c22f0ed9ec56a1cdfba366106663cd8fcb885e4c75773eef400b00
MD5 969659419c6230b131af9dd6063ec1d5
SHA1 8647793d46a2e5862540fabcdcf629c68e0e7234
SHA512 fdbbbf5cd9ce136f70c58b5d420bb7b5edc685ffe6ce796d9ce24834d14ca71add37558a738b84f1e25fb97ba4bbe339f22f93194bbae498620166697956bc6d
SSDEEP 192:jYXXheW9G6J78kyT7zqZ8PRpMKHS+WNYGE+SCHpnXk+wTQyIsnA/g4:jYXX0m78kyT7zDXMecYd+SwnXuZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Chrome\Secure Preferences
Size 15KB
SHA256 61b0ad34ad79fef4be4d5fcecbbf71fdc48bc8a3ea385306f3ae060e68d9fb0b
MD5 287d380b4f7dd9705e14448321c15432
SHA1 9af9de7b7814babc4ecb4b60848cd1c2458286b3
SHA512 6a6207104a83ff8942b0345f14b6fe4c23a0b6492fa7787e75a6d9a86efa743f2139e7e1092f8313e820d1f823f08ee3b0a90cd99f8221aa90db8593552547ea
SSDEEP 384:Oy9n7pLuLcgh2zXcNPkXqKf/pUZNCgVLH2Hf1iTrUjwHG0P/n6P3:Omn7pLuLpIbcNPkXqKf/pUZNCgVLH2HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Chrome\Top Sites
Size 20KB
SHA256 2b46a91579a5018dba7ce0ba48922e2f2e4632dbc4c890180728656955431570
MD5 d9f0b0474a300a011f68b46397f7d5a5
SHA1 d4310a12f754ef1d88b0b2187a291783db2673fc
SHA512 e443d1fa73bdc802c29be024e2389524c84d3639d404582c35bd7c6be1ae71b5d172bf86a17dabfe76bcb221a878ef023d571d44ccb521d70b64f752168d83a1
SSDEEP 12:TLiNKCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOS2Rccog2IccogL:TLigCZwE8I6Uwcco5fB2r2oL
MD5 SHA1 SHA512 SSDEEP

Submit Download

extensions_info.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Chrome\extensions_info.txt
Size 3KB
SHA256 79e2b66a203396e928e9da6b0ea7a51b2aa0b4b0becf48712c94980ff0c151db
MD5 f46af6b4d39146c256c9c7b52927ec2a
SHA1 9a2070041e51db84c049100da55b56578783986e
SHA512 d89cf1d13d547ea527354abf43a6364da4e215be596450191c0cd79475be016bd1384e7ef06075eacb65edb5c962841f3eb8220d148f135b151b2a54f8dc7bb5
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Edge\Favicons
Size 20KB
SHA256 be1b822e970dfe1a120d248db7000eaf799bd6531929a1308676c70fe1608d60
MD5 5688ce73407154729a65e71e4123ab21
SHA1 9a2bb4125d44f996af3ed51a71ee6f8ecd296bd7
SHA512 eb6452b23ea36c39d03ead154185616c13583f12f382cb2456beeb1ba6e5febdfd2a6f1064283cf115ad1c517dbf409777cdacb128e00c9d3f401335db355537
SSDEEP 24:LLiCxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:TBmw6fU1zBmI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Edge\Preferences
Size 73KB
SHA256 2304a3d2c107052c36cf9c53b5a8aa0dea7b3eb12a09afb5f550479c3da717ff
MD5 073bb276de7fefc22ed7956396a46ec0
SHA1 32eeb340885b0cbbc5367cb380ffdf9e481e203e
SHA512 64b36ea8c6e4981eeffbaf2647a7374a6c67424a8021e79500b7e70623b1263f01364767b61e17e0656f74f524f620549b9f1d520f4a7ada676b08b07661dccb
SSDEEP 384:lZxJFqdkT5i2+UOXCJgRX6uWei+O89ut9SKe:lhFqC42zrJg16uk+L9um
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Edge\Secure Preferences
Size 33KB
SHA256 605e069a4388c2037fc810ef7de3d924a2ac7effc52c1d037301eed6d2b6a541
MD5 4f0a38b36b87594958d852e04e061a04
SHA1 5944a005108aea67abc153e33500dc5f6d032a3f
SHA512 0117b4d6f3e4acfab80a002e7f3e9bc39303905a1a4eb30efd4e113d2602e5a7e82319ee535503a5c0e22e2d13a36fb29c44759fe78936e309c45e03efb6ae4f
SSDEEP 768:hpAeA8X02/m7pLuLN8bWRWf1QpJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV31sV6LlK:hpAeA8X02/GEN8bWRWf1QpJu1jaK1sVp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shortcuts

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Edge\Shortcuts
Size 20KB
SHA256 ff1398edcfa0ea35375afa95cd25bc086af7ce25cba4a85318eebd1252e29b4f
MD5 c135aeda0eeffc53bbf903913c861f3e
SHA1 c294f21924c0eed4aa1527f8ce867c96833ee834
SHA512 f72555fd484139dd4b59281375ccbf109c8196635f5e08e574e89d137e42886c1b62f4f8d3318963a469725faae42c7d64d47dcb41210833383e978d611dc87e
SSDEEP 12:TLiNMUMskMVUsLjCTH3EfxHQSOaQlvsdFxOUwa5qgufTJpbZ75fOS:TLiTMnYLjw0JQoQlvsd6UwccNp15fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

extensions_info.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Edge\extensions_info.txt
Size 3KB
SHA256 86dc1dda12feb79e29b5c92ec89e9ae9f5e2b89808416496aa94755b0c5e4658
MD5 f39304d0dfaf4577ac2e760c674e9496
SHA1 b343f461caf807556136cb8c0251983426fee3f9
SHA512 7f1b4ef778c443b13b091cbd6daadf0066a57b89f4a1e4a56e33dc16a2b5687a940225ec8084201a28704bdae25be68976a25b54236a262602759e965d98eb61
MD5 SHA1 SHA512

Submit Download

containers.json

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Firefox\c8mmgl7g.default-release\containers.json
Size 688B
SHA256 b32a837702b91f3d6c3a6a50da2e31f1cbe6384e991aefd08eb595a05dd27761
MD5 332d1459439502d9605d59b2c597af52
SHA1 aeee847012744a06ccd5201f288efc6c0ee6094e
SHA512 18ebc86d13eec67ac1e3705ce9239598f1a9b7ea5d5406ae41b854caba080d4d9f9cf3965643b793e6c8561f96177aa68806bb7ecb700e8515e8ce3be0095278
MD5 SHA1 SHA512

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Firefox\c8mmgl7g.default-release\extension-preferences.json
Size 799B
SHA256 8961a82960c13dfdca794fe3fd6f448ff49a93a8c59782b47f5004b11d3da145
MD5 12c305f5f06290b5f4f4a55d6b4b4389
SHA1 815edc293ed9e3ca3866898438e762b4d10e803a
SHA512 d7aa4af5550695f93724c3159c29d81518c33575459669f1c4b35751df54799cd9eef584119e0c8230b4a0b1f545fadd207e7497619bffa4164ec7b291339801
MD5 SHA1 SHA512

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Firefox\c8mmgl7g.default-release\extensions.json
Size 14KB
SHA256 576f62e11c8e95dea933fbec891f49b0e286c1f110702a5e272b22104e617d01
MD5 98a4e5c9d71664fa0ac3fd08648de239
SHA1 5ed17e3e7f6baec1c51b0de25f028ce52e7e36cf
SHA512 bde4916c4afbf3e5958afc439cf6773e7728f90f2e1c78d7e9a6cabd86b67c762a8ad648d7bc8f73ec432a9d0074844eec0208439f3c3dd1f819abb0cdfc7700
SSDEEP 384:OkI4vvCUmldvc8dhWV94zK96oML4HBL4PLL4HmL4H6L4HC:hI43CRfFXc4K65454v4s4o4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

permissions.sqlite

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Firefox\c8mmgl7g.default-release\permissions.sqlite
Size 96KB
SHA256 a3b1af0e1f39b3009364ed72d7938e21078aa16486e0ffd8441019c9415833d0
MD5 5d71251eaf95bb4a39b58612866b623e
SHA1 9e176ccfd61e19f127f33cddb9dad34533136ec0
SHA512 0a7179b5afff803ca165a53211f082d6bbc52a0d81c00234635500d395a1cdc6c2d97c035bbcf05b72f587d0424786ea6056819c5d86906db54d74d2052ae279
SSDEEP 12:DBl/EX/bWla0mwPxRymgObsCVR45wcYR4fmnsCVR4Y:DLEvb5sh7Owd4+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

search.json.mozlz4

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Firefox\c8mmgl7g.default-release\search.json.mozlz4
Size 327B
SHA256 a4c8d0344cbf6e230cecbc4d989de36ec075cd8eda7ae740242e1b05b5dd3fd4
MD5 240589068f063f8f706378168230e975
SHA1 9531374a22dea374d032f7484567fb1b201af87d
SHA512 6d04629da44769a64b8808d198f3b3ba6388a0cd5441269e35ca39e7595c4e9abd32618f76ff60b79df80732838ee2a67455e195a801a67334a592b6b6240da5
MD5 SHA1 SHA512

Submit Download

extensions_info.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Firefox\extensions_info.txt
Size 15KB
SHA256 ee1e1ac0492b2706af8c5d2e3c69abe4212e9d6fe18a51a571c8942aa46508ee
MD5 c477bd5ed4ba42ffe75cad8cf3a7da99
SHA1 e7204e02ab4420bb8acc5f9fee7f22e0c097caf9
SHA512 511659b030eca30d017a50577febdcabc22f7552e109b6ddfd34399516663912803482ada386ae352c0c08f3d4a355bc4f5e6a46e385d4bbba5cdd84d56676bb
SSDEEP 384:gkI4vvCUmldvc8dhWV94zK96oML4HBL4PLL4HmL4H6L4HKCT8fciZXn:HI43CRfFXc4K65454v4s4o4qCT8fciZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Google\Recovery\Chrome\Login Data For Account
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Google\Recovery\Chrome\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 72d049174f8bb874a5db67735ce76cab400f25a72391ec557ef2720785b4c4ac
MD5 febe8b30c72b9ed5786ae265ebaf844a
SHA1 010452344e00fcf8609b9df083803311efe683e9
SHA512 01863fd726d2bb344f368673a31df809a58c810940200a8cf02d1be09ce92f1d097419fffabbada9651d2977948111e0916e2012d92974f96ce7c942ef01732e
SSDEEP 24:TLP91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:Tr9aw/aHLopFMavU1iB
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery_summary.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Browsers\Google\Recovery\recovery_summary.txt
Size 11KB
SHA256 9137da6ca8775c24cbfca713709dc6021d161d6480e5ff7a47b733f9cd30b78c
MD5 d3dc6f8b06dfb054bdbffcd2cbcd7d6e
SHA1 2d0282033c2f6bb0971f741b58d3ebcc5d1104ab
SHA512 2e6c04fac6f516bf8f2e84521ded54514c477bc5b9362779893ea8c0cf572beb2a6bdf43426fd029af2008d38ae716844bd8e8cc1be414ab7db1f74bb600183b
SSDEEP 192:wYXXheW9G6J78kyT7zqZ8PRpMKHS+WNYGE+SCHpnXk+wTQyIsnA/gM:wYXX0m78kyT7zDXMecYd+SwnXuZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

onedrive_registry.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\CloudStorage\OneDrive\Registry\onedrive_registry.txt
Size 111B
SHA256 d18bd1d05749cb334fce6cc35d1486e215ceceaa1e89af7b18b1a2f0326834fb
MD5 02f290c81ae080b41fc88cce228c118b
SHA1 3093c26e138b3448cea59000861aa3c05eadef60
SHA512 de21e62db7a1bc883ad55b495238bd833f7167652f0c407dba9e2d33649e314f3e11e42e9b32f160741218a51ce6a5d958ad793b49692b60780b19162fe422ac
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\CloudStorage\OneDrive\desktop.ini
Size 96B
SHA256 e5bfc54e8f2409eba7d560ebe1c9bb5c3d73b18c02913657ed9b20ae14925adc
MD5 c193d420fc5bbd3739b40dbe111cd882
SHA1 a60f6985aa750931d9988c3229242f868dd1ca35
SHA512 d983334b7dbe1e284dbc79cf971465663ca29cec45573b49f9ecdb851cdb6e5f9a6b49d710a1553bdae58c764887c65ba13fd75dfdd380c5c9ef9c0024aa3ef0
MD5 SHA1 SHA512

Submit Download

LimitCopy.docx

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Files\Desktop\LimitCopy.docx
Size 393KB
SHA256 834d28fb8068fc99a3b56011664190719af94dce4fee3bfd759040f57b0b3d5f
MD5 e6652980f99b1dcc0b320270cf685980
SHA1 37642205e710a37962e94d83b6bf4346f098da04
SHA512 a04c0c4dc9ab7b1ae4abe327d34ca48a8777ee5b8b0cfff0748ca7b87649aa9bfb625d1a8e9d242702fb9d981ca89074648af7d3704040025be401eeb622ee8d
SSDEEP 12288:3bd3jNyv4ns4qETTU5pc3qPY26JHWlB7uVPU:3aAnDqEcI3qgvJ4BqVM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SkipSwitch.docx

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Files\Desktop\SkipSwitch.docx
Size 14KB
SHA256 f65501edd6b1265ec92164a1e838ae8a2c4f2accee897010b3f832163e2d5455
MD5 98bf360a81852ae2b2eaf98f7eb225ed
SHA1 0cb0df79f8ef41c878a899a8fdd6cc3f65de8c7a
SHA512 5d3c410c4f34bba5305c4d8fb110d54e3839888739a6871ebea58e5e9a469abb33e58ecc0a0a2cfe1ce3d8b70f6453c9de0fc85e1e2a55d4f3458490ae2d5677
SSDEEP 384:ahOTgxy6VtRWXYyh0krdNxt/ZtNNhqd+zIFHO3A5+L:T8t0XZ0yxllNhqdAItRM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProgramList.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\ProgramList.txt
Size 2KB
SHA256 18abe23efd1a4ebb0d69cfd542bceda9c4e7a2b1ca3400f8cc3c9135aa0cf531
MD5 7da9cc2d29ee18a0c2542db36090794f
SHA1 4f890b113c898b1155ecc8ef219e07af3f5c4df3
SHA512 6f81f89e41daa8f2996cce347c577183aeefb387e3b7917f77d05306cef5cb78444d54f1c1e2bd93d89600191cb42822f59989daafd06156f9ecc3aa1bbda2f9
MD5 SHA1 SHA512

Submit Download

ProsessList.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\ProsessList.txt
Size 1KB
SHA256 e930d80862e976a59b66ae6f1e93859b09c529f2cfe814fe30bea351136341e8
MD5 61336b15246760cf877a959d7e6d15b7
SHA1 ceb8421087dc9a87c62ab5b7a2727a11441a7fc7
SHA512 0dc14571625b02646b4c06a3928e92fbba5e9af52e489583b8c2c28ef62317b105ab5647e632b8b14ca92bf7ec6b7b81d0bcf7f434b66513891a35d9e6ba2e28
MD5 SHA1 SHA512

Submit Download

Screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\Screenshot.png
Size 419KB
SHA256 61b2f54777f6722338f7688cfc4995920b18f259620fbd9a1cf330fb5e4a904b
MD5 80d4dcda7b5ce285f06d634adcd4dc32
SHA1 a53bc06c7604e50dd2b20049929eaacfc5727273
SHA512 109eded1b3b527ae9672ed2d6ef887154908a35a3a0848ad3d58b072b379d0ce04bbdd55996675227989db480ee25e250a10e73152d59002ffc26724e0eac08c
SSDEEP 12288:LZdMQ1n1uXxOxTbDMtELvx+Iir71w0Lyr:LZd711uXxoHDMc+Iir5w0Lyr
MD5 SHA1 SHA512 SSDEEP

Submit Download

info.txt

Path C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672Xeipinrc\info.txt
Size 7KB
SHA256 01146ed62afd6a02ac238b5b233c1658e58f0bec90024b15abb6a2dfda0b0860
MD5 568c1b2cf68dfa204df370c6073a79d2
SHA1 e46dfccccee66bac6eb88bae2a8a6bd4c935f181
SHA512 530586a8028437ca5057426023f3491130835fdd6826403574a65e1093993d48d4df00b1a5e36a790896241561f5fb984ab54298eb54c3bf70810936118ff2bc
SSDEEP 192:LEJveGArhuNyrP8p0ivKkhuNyrP8p0ivKu:WeLrhuNyrP8p0ivKkhuNyrP8p0ivKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll
Size 398KB
SHA256 977998aec486395eaba6ce5661648425a1a181ce18c2c87c6288af62b87d5eca
MD5 f75fe8d06448d07720d5456f2a327f08
SHA1 dba5d60848a7c24ce837225709d9e23690bb5cb3
SHA512 eb05696f92881a698b7def0f8852286212a5eb235a2ff8a41460dedbc6ae1964bfbef613d3bec736df66525bf6e5a6c95ff5e0a71c904fa70b5c6675e2275a34
SSDEEP 6144:/+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWk:WPw2PjCLe3a6Q70zbR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zip.exe

Path C:\Users\Admin\AppData\Local\Temp\Zip.exe
Size 32KB
SHA256 41bb07763250248ddd7273e9c2be51f095a4ad6cadb513bf186c92e5804e4d82
MD5 3331f4e716921b0a3710ef0291958254
SHA1 e5661e224e52476e0c463fae38e1c40fd3a40c16
SHA512 d50b307ba97b432288291ca22dbaed0b72053cc1a3a907111eb2ac5c6b2679d3b9b15e93c86bacd02d9d3c2d5945d5e73daa1f2a92b14db27840d7658fa9c244
SSDEEP 384:5fVA8uZUK06fKSU4B6T/r4Ay0Lk24jXPlwLoeq/xYpPIr+EVpa:Q8u6KHKSU4B67kAy42XPSYa
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_farmdrs4.52v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_farmdrs4.52v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-H1TR9.tmp\662cead953a8efcec16e7222836d5bdfe698fb9956390a25765a74c43b852642.tmp
Size 3.3MB
SHA256 167285a6a9bf021554fb0741ec75dbe38a006c51c8ef27cdfad53618b503a524
MD5 4426cc3d1029087690dcffbf78cd3288
SHA1 e89f7453f62a899bf07fcafec54e0aafd9586f2c
SHA512 987dd1940fc9a509ee3f59bd7cb39c7007ed79bac13c1125b02d6ae4a43b42eb064b8369b4338d624d990899587af78d31dc2f8aad295dae39ed53c45a7178e4
SSDEEP 49152:IWwGHAkqMu7ot6SCiGoghuXs7+KXrmeSVrJuh52gu8Z333WP:I9GdkJuXbeSVQduy333E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-5-0x00000000036A0000-0x00000000036A1000-memory.dmp

Download

memory/224-8-0x0000000000350000-0x00000000006B4000-memory.dmp

Download

memory/1196-12-0x0000000000D00000-0x0000000000DD7000-memory.dmp

Download

memory/1196-0-0x0000000000D00000-0x0000000000DD7000-memory.dmp

Download

memory/2568-51-0x00000000075F0000-0x000000000760A000-memory.dmp

Download

memory/2568-37-0x0000000005820000-0x000000000586C000-memory.dmp

Download

memory/2568-54-0x00000000077F0000-0x0000000007801000-memory.dmp

Download

memory/2568-53-0x0000000007870000-0x0000000007906000-memory.dmp

Download

memory/2568-22-0x0000000002A50000-0x0000000002A86000-memory.dmp

Download

memory/2568-23-0x0000000005960000-0x0000000005F8A000-memory.dmp

Download

memory/2568-24-0x00000000052E0000-0x0000000005302000-memory.dmp

Download

memory/2568-25-0x00000000053A0000-0x0000000005406000-memory.dmp

Download

memory/2568-26-0x0000000005410000-0x0000000005476000-memory.dmp

Download

memory/2568-35-0x0000000005F90000-0x00000000062E7000-memory.dmp

Download

memory/2568-36-0x00000000057E0000-0x00000000057FE000-memory.dmp

Download

memory/2568-52-0x0000000007640000-0x000000000764A000-memory.dmp

Download

memory/2568-38-0x0000000007240000-0x0000000007274000-memory.dmp

Download

memory/2568-39-0x000000006F6D0000-0x000000006F71C000-memory.dmp

Download

memory/2568-48-0x0000000006840000-0x000000000685E000-memory.dmp

Download

memory/2568-49-0x0000000007280000-0x0000000007324000-memory.dmp

Download

memory/2568-50-0x0000000007C70000-0x00000000082EA000-memory.dmp

Download

memory/3860-9-0x0000000000D00000-0x0000000000DD7000-memory.dmp

Download

memory/3860-78-0x0000000000D00000-0x0000000000DD7000-memory.dmp

Download

memory/4848-79-0x0000000000090000-0x00000000003F4000-memory.dmp

Download

memory/4848-16-0x0000000002E90000-0x0000000002E91000-memory.dmp

Download

memory/4848-80-0x0000000002E90000-0x0000000002E91000-memory.dmp

Download

memory/4896-133-0x00000000297B0000-0x0000000029B07000-memory.dmp

Download

memory/4896-89-0x0000000026F50000-0x000000002747C000-memory.dmp

Download

memory/4896-83-0x0000000025A00000-0x0000000025A9C000-memory.dmp

Download

memory/4896-82-0x0000000025930000-0x00000000259FA000-memory.dmp

Download

memory/4896-81-0x0000000073650000-0x0000000073907000-memory.dmp

Download

memory/4896-85-0x0000000025AA0000-0x0000000025B32000-memory.dmp

Download

memory/4896-86-0x0000000023550000-0x000000002355A000-memory.dmp

Download

memory/4896-294-0x0000000073650000-0x0000000073907000-memory.dmp

Download

memory/4896-84-0x0000000026050000-0x00000000265F6000-memory.dmp

Download

memory/4896-272-0x0000000073650000-0x0000000073907000-memory.dmp

Download

memory/4896-96-0x00000000292C0000-0x0000000029326000-memory.dmp

Download

memory/4896-88-0x0000000026850000-0x0000000026A12000-memory.dmp

Download

memory/4896-132-0x0000000027AB0000-0x0000000027AD0000-memory.dmp

Download

memory/4896-87-0x0000000025B40000-0x0000000025B96000-memory.dmp

Download

memory/4968-67-0x000000006F6D0000-0x000000006F71C000-memory.dmp

Download

memory/5556-222-0x00000226F87E0000-0x00000226F89A2000-memory.dmp

Download

memory/5556-225-0x00000226F8780000-0x00000226F8792000-memory.dmp

Download

memory/5556-224-0x00000226F8750000-0x00000226F875A000-memory.dmp

Download

memory/5556-221-0x00000226F5EC0000-0x00000226F5ED0000-memory.dmp

Download

memory/5556-223-0x00000226F8EE0000-0x00000226F9408000-memory.dmp

Download

memory/5844-125-0x0000000007A30000-0x0000000007A45000-memory.dmp

Download

memory/5844-122-0x00000000076F0000-0x0000000007794000-memory.dmp

Download

memory/5844-113-0x000000006D660000-0x000000006D6AC000-memory.dmp

Download

memory/5844-112-0x00000000068E0000-0x000000000692C000-memory.dmp

Download

memory/5844-123-0x0000000007A00000-0x0000000007A11000-memory.dmp

Download

memory/5844-110-0x0000000005FB0000-0x0000000006307000-memory.dmp

Download

memory/5844-124-0x00000000079C0000-0x00000000079CE000-memory.dmp

Download

memory/5844-126-0x0000000007B20000-0x0000000007B3A000-memory.dmp

Download

memory/5844-127-0x0000000007B00000-0x0000000007B08000-memory.dmp

Download